Apparatus, system and method for operating a wireless network

Abstract

A method 200 of operating a telecommunications network 100, the telecommunications network comprising: a user equipment (UE) (110); a wireless access point (WAP) (120) identifiable by means of a network equipment identifier; a source wireless local area network (WLAN) (130-1) provided by means of the WAP and identifiable by means of a source network identification; a target WLAN (130-2); and the method comprising the steps of: generating an encrypted output by performing an encryption function on both the source network identifier and the network equipment identifier (220); allocating an access credential to the target WLAN, wherein the access credential comprises the encrypted output (220); and by means of the UE: identifying the source network identifier and the network equipment identifier (230); performing an encryption process on the identified source network identifier and the identified network equipment identifier to derive the encrypted output (240); and using the access credential derived by the UE from the encrypted output to request a connection to or via the target WLAN (250).

Description

Technical Field

[0001] This invention relates to a method for operating a telecommunications network, particularly a wireless local area network (WLAN), and systems and components for using the method. Background Technology

[0002] Wireless access points (WAPs) can facilitate data connectivity between wide area networks (such as fixed access broadband networks) and wireless communication devices (also referred to here as "user equipment", UEs).

[0003] WAP provides wireless local area networks (WLANs) that operate on radio frequency spectrum with low transmit power (typically providing a range of a few meters). For example, WLANs can be used with IEEE... RTM The 802.11 family of standards (commonly known as Wi-Fi) RTM Any one of the following. The UE can be used to connect to a WLAN provided by WAP.

[0004] In order for a UE to connect to a WLAN, the UE must first identify the WAP providing the WLAN, and also identify the WLAN itself. After identifying the WLAN and the WAP, the UE will typically (and as is generally recommended) need to be authenticated to connect to the WLAN; this is usually performed by a user who provides WAP access credentials (such as a password) associated with the WLAN.

[0005] With the increasing number of WAP, WLAN, and UE devices, managing secure access to WLAN can be a cumbersome task for UE users, requiring manual identification of the WLAN and input of access credentials.

[0006] To help reduce this burden, a method has been proposed for automatically exporting WLAN access credentials and then using these exported access credentials to connect to the WLAN; this can be called a “zero-touch connection” process because the UE does not require user input to connect to the new WLAN.

[0007] To facilitate zero-touch connection, access credentials can be encoded within a broadcast network identifier (such as a Service Set Identifier (SSID)) used for WLAN, and the UE can decode the network identifier to derive the access credentials. The UE then attempts to connect to the WLAN associated with those access credentials.

[0008] However, existing zero-touch connectivity systems may have limited functionality and are typically configured only to establish a small number of Internet of Things (IoT) devices, with little dynamic control over which WLAN a device connects to.

[0009] Furthermore, more sophisticated methods are being developed to compromise the secure operation of WLANs, and zero-touch connectivity systems may be particularly vulnerable because they rely on transmitted secret access credentials.

[0010] The purpose of this invention is to at least alleviate some of the aforementioned problems. Summary of the Invention

[0011] According to a first aspect of the present invention, a method for operating a telecommunications network is provided, the telecommunications network comprising: a user equipment (UE); a wireless access point (WAP) identifiable by means of a network device identifier; a source wireless local area network (WLAN) provided by means of the WAP and identifiable by means of the source network identifier; and a target WLAN; and the method comprising the steps of: generating an encrypted output by performing encryption on both the source network identifier and the network device identifier; allocating access credentials to the target WLAN, wherein the access credentials include the encrypted output; and, by means of the UE: identifying the source network identifier and the network device identifier; encrypting the identified source network identifier and the identified network device identifier to derive the encrypted output; and using the access credentials derived by the UE from the encrypted output to request a connection to or via the target WLAN.

[0012] Preferably, in response to the UE recognizing a predefined string in the source network identifier and the network device identifier, the step of encrypting the recognized source network identifier and the recognized network device identifier is performed.

[0013] Preferably, encryption is performed only on a portion of the source network identifier and / or network device identifier, which can be identified by the UE using a predefined string in the source network identifier and / or network device identifier.

[0014] Optionally, the target WLAN is hidden (where the target WLAN and the WLAN are different). Preferably, the UE is within range of both the source WLAN and the target WLAN.

[0015] As used herein, “exported in an encrypted manner” and / or “processed in an encrypted manner” preferably means generated as a result of performing an encryption function, which may include encryption, decryption, encoding, decoding, hashing and / or salting.

[0016] Preferably, the encryption function is performed by the WAP or by a remotely accessible server of the WAP. Preferably, the "network identifier" (e.g., "source" and / or "destination") is a Service Set Identifier (SSID). Preferably, the network device identifier is a Basic Service Set Identifier (BSSID). Preferably, the step of assigning access credentials is performed before the step of assigning the source network identifier and / or network device identifier to the source WLAN and / or WAP.

[0017] Preferably, the step of generating encrypted output is performed to output a single text string. Optionally, the source WLAN and / or the target WLAN is secure (private or encrypted), thus requiring access credentials for the UE to connect to the WLAN.

[0018] According to another aspect of the present invention, a method for operating a telecommunications network is provided, the telecommunications network comprising: a user equipment (UE); a wireless access point (WAP) identifiable by means of a network device identifier; a source wireless local area network (WLAN) provided by means of the WAP and identifiable by means of a source network identifier; and a target WLAN; and the method comprising the steps of: assigning an access credential to the target WLAN; performing encryption on the assigned access credential to generate an encrypted output; and assigning a value derived from the encrypted output as the source network identifier and the network device identifier; by means of the UE: identifying the source network identifier and the network device identifier; encrypting the identified source network identifier and the identified network device identifier to derive the access credential; and using the access credential derived by the UE to request a connection to or via the target WLAN.

[0019] Preferably, the target WLAN can be identified using a target network identifier, and the method further includes the step of providing the target network identifier to the UE using a source network identifier and / or a device network identifier. Alternatively, the UE can preload the target network identifier, and the step of requesting a connection to the target WLAN can be performed by default in response to the discovery of the target network identifier.

[0020] Optionally, the UE is configured to be biased, forced to prioritize, and more preferably to prioritize, attempting to connect to the target WLAN.

[0021] Preferably, the target network identifier is provided as part of the encrypted output. Alternatively, the target network identifier is provided in plaintext as part of the source network identifier and / or device network identifier.

[0022] Optionally, the target WLAN and the source WLAN are different. Optionally, the target WLAN is provided by another WAP instead of the stated WAP. Optionally, the target WLAN is provided by the stated WAP. Optionally, the target WLAN and the source WLAN are the same.

[0023] Preferably, the encryption function includes multiple encryption functions, and wherein a single encryption function among the multiple encryption functions is performed on each of the source network identifier and the network device identifier. Alternatively, the same encryption function may be applied.

[0024] Preferably, the access credential is used to allow the UE to connect to an external network accessible via a target WLAN. Preferably, the external network is a wide area network (WAN).

[0025] Optionally, the source WLAN and / or the target WLAN may be insecure (public or unencrypted), therefore access credentials for the UE to connect to the WLAN may not be required, but access credentials may be necessary for the UE to connect to an external network via the WLAN. Optionally, the external network may only be accessible to the UE through a captive portal. Optionally, assigning access credentials to the target WLAN means assigning the access credentials to a captive portal accessible through the target WLAN. Preferably, the access credentials are used to allow the UE to connect to devices accessible via the target WLAN.

[0026] Preferably, after a connection is established between the UE and the target WLAN, the source network identifier and / or network device identifier are changed. Preferably, the source network device identifier and / or network device identifier are changed when the connection terminates. Alternatively, the source network device identifier and / or network device identifier may be changed after each communication between the UE and the target WLAN, and preferably, the access credentials for the target WLAN change in response to the change in the source network identifier and / or network device identifier.

[0027] According to another aspect of the present invention, a method is provided for operating a user equipment (UE) to access a telecommunications network, the telecommunications network comprising: a wireless access point (WAP) identifiable by means of a network device identifier; a source wireless local area network (WLAN) provided by means of the WAP and identifiable by means of a source network identifier; and a target WLAN; wherein an encrypted output is generated by performing encryption on both the source network identifier and the network device identifier, and an access credential including the encrypted output is assigned to the target WLAN; and the method comprises the steps of: identifying the source network identifier and the network device identifier; encrypting the identified source network identifier and the identified network device identifier to derive the encrypted output; and using the access credential derived by the UE from the encrypted output to request a connection to or via the target WLAN.

[0028] According to another aspect of the present invention, a method is provided for operating a set of wireless access points (WAPs), each WAP being identifiable by means of a network device identifier, to provide access to a telecommunications network accessible by a user equipment (UE). The method includes the steps of: providing a source wireless local area network (WLAN) identifiable by means of a source network identifier; providing a target WLAN; generating an encrypted output by performing encryption on both the source network identifier and the network device identifier of each (or the) WAP in the set of wireless access points (WAPs) providing the source WLAN; and assigning an access credential to the target WLAN, wherein the access credential includes the encrypted output. Optionally, the set of WAPs includes only one WAP. Optionally, the method further includes the step of: allowing access to the target WLAN when the UE requests access using the access credential.

[0029] According to another aspect of the present invention, a computer-readable carrier medium including a computer program is provided, which, when executed by a computer, causes the computer to perform the above-described steps.

[0030] According to another aspect of the present invention, a user equipment (UE) configured to access a telecommunications network is provided, the telecommunications network comprising: a wireless access point (WAP) identifiable by means of a network device identifier; a source wireless local area network (WLAN) provided by means of the WAP and identifiable by means of a source network identifier; and a target WLAN; wherein an encrypted output is generated by performing encryption on both the source network identifier and the network device identifier, and an access credential including the encrypted output is assigned to the target WLAN; and the UE comprises: a WLAN network interface for identifying the source network identifier and the network device identifier; a processor for encrypting the identified source network identifier and the identified network device identifier to derive the encrypted output, and configured to cause the WLAN network interface to request a connection to or via the target WLAN using the access credential derived by the UE from the encrypted output.

[0031] According to another aspect of the invention, a set of wireless access points (WAPs) is provided for providing a telecommunications network accessible by a user equipment (UE). The set of WAPs includes: a set of network device identifiers for identifying the WAPs in the set; a set of wireless local area network (WLAN) interfaces for providing a source WLAN identifiable by a source network identifier and for providing a target WLAN; and a processor configured to generate encrypted output by performing encryption on the source network identifier and the network device identifier of each(or more) WAPs in the set providing the source WLAN, and to distribute access credentials including the encrypted output to the target WLAN. Optionally, the set of WAPs may include only one WAP.

[0032] According to another aspect of the present invention, a telecommunications system is provided, comprising: a user equipment (UE) as described above; and a set of wireless access points (WAPs) as described above.

[0033] This invention includes any novel aspects described and / or illustrated herein. The invention also extends to methods and / or apparatus substantially as described herein and / or as shown with reference to the accompanying drawings. The invention is also provided as a computer program and / or computer program product for performing any of the methods described herein and / or for implementing any of the apparatus features described herein, and as a computer-readable medium having stored thereon a program for performing any of the methods described herein and / or for implementing any of the apparatus features described herein. Features described as being implemented in hardware are alternatively implemented in software, and vice versa.

[0034] The present invention also provides a method for transmitting signals, and a computer product having an operating system that supports computer programs for performing any of the methods described herein and / or for implementing any of the device features described herein.

[0035] Any device feature can also be provided as a corresponding step of the method, or vice versa. As used herein, device plus functional features can alternatively be expressed according to their respective structures, for example, as a suitably programmed processor.

[0036] Any feature in one aspect of the invention may be applied to other aspects of the invention in any suitable combination. Any, some, and / or all features in one aspect may be applied to any, some, and / or all features in any other aspect in any suitable combination. Specific combinations of the various features described and defined in any aspect of the invention may be independently implemented and / or provided and / or used.

[0037] As used throughout the text, the word "or" can be interpreted in an exclusive and / or inclusive sense, unless otherwise specified. Attached Figure Description

[0038] This invention extends to methods, user equipment, a set of wireless access points, and telecommunications systems as described herein and / or substantially as illustrated with reference to the accompanying drawings. The invention will now be described by way of example only with reference to the accompanying drawings, in which: Figure 1 This is a schematic diagram of an exemplary telecommunications network; and Figure 2 The procedure for operating a telecommunications network is illustrated. Detailed Implementation

[0039] Figure 1 An exemplary telecommunications network 100 is shown, which includes: a wireless communication device or user equipment (UE) 110; a wireless access point (WAP) 120; and a wide area network 125.

[0040] In one example, a WAP is a wireless router, extender, and / or repeater. A UE can be any electronic communication device with a WLAN interface, and in particular: personal computers (laptops or desktops); mobile telecommunications equipment; Internet of Things (IoT) devices; wireless repeaters; and / or wireless extenders.

[0041] WAP 120 is configured to generate a wireless local area network (WLAN) 130, to which UE 110 can connect. In this example, the WLAN can be used with IEEE... RTM Any one of the 802.11 standard families.

[0042] WAP 120 is configured to provide multiple WLANs, and Figure 1 In the example, WAP provides two separate WLANs – the first WLAN 130-1 and the second WLAN 130-2.

[0043] WAP 120 connects to WAN 125, for example, in the form of a fixed access broadband network (e.g., via Ethernet). As a result, UE 110 can be used to connect to WAN 125 via WLAN 130 provided by WAP 120, and in turn connect to, for example, the Internet.

[0044] WAP 120 is configured to broadcast a network device identifier identifying the WAP to UE 110; this network device identifier is in the form of a Basic Service Set Identifier (BSSID). By convention, the BSSID is or originates from the WAP's data link layer network address (specifically, the data link layer network address of the WAP's Network Interface Controller (NIC), such as a Media Access Control (MAC) address. Therefore, using the BSSID associated with WAP 120, UE 110 can identify WAP 120.

[0045] WAP 120 is also configured to broadcast a network identifier that identifies a specific WLAN to UE 110; this network identifier is in the form of a Service Set Identifier (SSID), which is a configurable text-based identifier. By using different SSIDs for the first WLAN 130-1 and the second WLAN 130-2, UE 110 can identify each WLAN separately.

[0046] UE 110 is located close enough to WAP 120 to be within WAP's wireless range, thus enabling it to communicate with WAP.

[0047] WAP 120 and UE 110 are configured for “zero-touch connectivity”, where, in this example, the UE identifies the WLAN, retrieves a new access credential for the WLAN, authenticates the UE to the WLAN using the new access credential, and then the process of connecting to the WLAN can be performed by the UE without user intervention.

[0048] To facilitate secure contactless connections, the WAP 120 is equipped with an encryption program that includes encryption functionality. Correspondingly, the UE 110 is equipped with a corresponding encryption routine that includes decryption functionality, configured to decrypt ciphertext generated according to the encryption function. For example, the encryption function may include symmetric or asymmetric algorithms, particularly based on the Advanced Encryption Standard (AES). The encryption routine also includes instructions indicating when, how, and on what data the encryption and decryption functions are performed.

[0049] Figure 2An exemplary process 200 is shown, in which a telecommunications network 100 is configured to cause a UE 110 to request a new WLAN connection using access credentials for that WLAN that have been secretly transmitted to the UE.

[0050] In the first step 210, WAP 120 generates a first WLAN 130-1 and a second WLAN 130-2, which can be identified by the UE through the first SSID and the second SSID, respectively.

[0051] The first WLAN 130-1 is publicly visible because WAP broadcasts the first SSID and the BSSID of WAP 120.

[0052] In the next step, configure the second WLAN 130-2. According to the encryption routine, encryption is performed on the first SSID and BSSID of WAP 120 (in this example, performed by WAP 120), generating an encrypted output, which is then distributed to form part of the access credentials for the second WLAN 130-2.

[0053] For example, the first SSID is in the form of the text string "ZTCSSIDONE", and the BSSID of WAP 120 is in the form of the text string "ZTCBSSIDONE". The encryption function includes a shift (or "Caesar") cipher, which is configured to apply a one-way shift of English letters to the plaintext formed by the concatenation of the first SSID and BSSID (i.e., "ZTCSSIDONEZTCBSSIDONE"), and the encryption function thus generates the encrypted output "GAJZZPKVULGAJIZZPKVUL"; this ciphertext is then used as the access credential for the second WLAN130-2.

[0054] In this way, the access credentials for the second WLAN can be encryptedly derived from the broadcast identifier (i.e., the first SSID and BSSID of WAP 120) associated with the first WLAN (in this role, the first WLAN is also referred to as the "source WLAN"). Double-encoding the access credentials using the SSID and BSSID can help improve the security of the zero-touch connectivity system, especially since configuring the BSSID (and therefore electronic spoofing) is more difficult than modifying the SSID.

[0055] In the next step 230, UE 110 initiates a search for available WLANs, for example, by sending probe and / or listener beacons. Therefore, the UE detects the first WLAN 130-1 and the second WLAN 130-2. Consequently, the UE retrieves the first and second SSIDs and the BSSID of WAP 120.

[0056] In the next step 240, in response to the detection of the first SSID and BSSID, UE 110 performs an encryption routine on the first SSID and BSSID, and specifically performs a decryption function to derive encrypted output.

[0057] In one example, the UE is pre-configured to perform decryption functions on a first SSID and BSSID, for example, based on a given format of the identifier SSID and / or BSSID.

[0058] In the next step 250 after generating the encrypted output, UE 110 is instructed to use the encrypted output derived by UE in step 240 as the access credential for the second WLAN 130-2 to attempt a connection to the second WLAN 130-2 (therefore, the second WLAN may also be referred to as the "target WLAN"). Thus, the UE can be used to connect to the second WLAN 130-2.

[0059] In one example, the UE is pre-configured to attempt a connection to the second WLAN 130-2 by default.

[0060] It should be understood that the UE can only effectively export the access credentials of the second WLAN and thus connect to the second WLAN because the UE and WAP are applying the corresponding (or mirrored) encryption and decryption functions, and because of the association between the first SSID and the BSSID; and the access credentials of the second WLAN 130-2.

[0061] In one example, for enhanced security, after step 250 (and particularly after the termination of the connection between UE 110 or all UEs and the second WLAN 130-2), the WAP is configured to generate a new first SSID and / or BSSID, different from the first SSID and / or BSSID used by the WAP in process 200 (or any) previous steps (including any previous iterations). As a result, the access credentials for the second WLAN also change. Specifically, the BSSID can change as frequently as each message between the UE and the WAP. For enhanced security, the UE is configured to prevent any attempted connection to the second WLAN based on an encrypted output of the previously used first SSID and / or BSSID.

[0062] Alternative and Modified Solutions

[0063] In an alternative example, a first SSID is generated such that the UE's target WLAN (e.g., a second SSID) can be derived from the first SSID. In one example, the target WLAN is provided only as part of the first SSID without encryption. In another alternative example, the target WLAN is also (in addition to access credentials) encoded into the first SSID and / or BSSID, such that when the UE performs encryption routines, the UE derives (and distinguishes) the target WLAN from the access credentials used for that target WLAN.

[0064] It should be understood that any form of encryption can be performed on the first SSID and / or BSSID, which have been processed in any way. For example, in an alternative, the first SSID and / or BSSID are first processed to generate a string for encryption (e.g., concatenation; combination; interlocking; reversal; conversion to another representation, such as binary or hexadecimal; and / or truncation), and the generated string is then encrypted to produce an encrypted output.

[0065] In an alternative approach, the first SSID and BSSID are encrypted separately and independently, generating two separate encrypted strings, which are then processed (e.g., as described above) to subsequently produce an encrypted output as a single string. In this example, the encryption key and / or encryption method used may differ from the encryption key and / or encryption method applied to the first SSID and BSSID.

[0066] In the foregoing, WAP 120 encodes the access credentials for the second WLAN. Alternatively, WAP may encode the access credentials for the first WLAN within the first SSID and BSSID. Thus, the first WLAN may be the target WLAN.

[0067] In the alternative, the first WLAN 130-1 and the second WLAN 130-2 are provided by two separate WAPs, each of which: the UE 110 can access; connect to the wide area network 125; and communicate with the other WAP.

[0068] In yet another example, the first WLAN 130-1 and / or the second WLAN 130-2 are public, and therefore no access certificate is required for the UE to establish a connection with them. However, forward connections from the UE to the WAN 125 require authentication of the UE 110; thus, access credentials are used instead, for example, to access the WAN 125 via a mandatory network portal.

[0069] In yet another example, access credentials are used to grant access to a device that can be accessed via the target WLAN. This device could be a network storage device or a network media center.

[0070] In one example, access credentials for the first WLAN 130-1 and / or the second WLAN 130-2 are generated by a server including encryption routines and are accessible via WAN 125 instead of at WAP 120. Therefore, WAP 120 communicates with the server to receive access credentials (thus configuring the target WLAN) and a first SSID and / or BSSID (thus configuring the first WLAN 130-1). In one example, the server takes the form of a cloud-based management system for WAP 120.

[0071] It should be understood that the above methods can be applied to other forms of WLAN and / or wireless personal area networks, such as Bluetooth-based ones. RTM Zigbee RTM and WiMAX RTM .

[0072] In an alternative example, the UE performs an encryption routine only in response to recognizing that the first SSID and / or BSSID is in a predefined format (i.e., step 240). For example, the predefined format means that the SSID and / or BSSID begins and / or ends with a predefined character set. Alternatively, the UE is configured to perform an encryption routine for each detected SSID and BSSID.

[0073] In an alternative example, the UE performs encryption routines only on a portion of the first SSID and / or BSSID, wherein the portion may be identified by the UE through a predefined prefix and / or suffix.

[0074] In one example, the UE can be pre-configured to attempt to connect to any WLAN from which the UE retrieves its SSID and BSSID.

[0075] In an alternative, steps 210 and 220 can be reversed to the following extent: first, an access credential for the second WLAN 130-2 is selected; then, a first SSID and / or BSSID for the WAP 120 is created based on the output of an encryption routine applied to the access credential; and then, these created SSIDs and BSSIDs are assigned to the first WLAN and / or WAP.

[0076] In the alternative, the first WLAN 130-1 is not configured to carry user services, but can only be used to transmit access credentials for the second WLAN 130-2.

[0077] In an alternative, once the UE has verified the authenticity of the WAP, the UE only attempts to connect to the first (or second) WLAN using the decrypted access credentials, particularly as disclosed in UK Patent Application No. GB2104045.6, the contents of which are incorporated herein by reference.

[0078] Each feature disclosed herein and (where appropriate) is provided independently or in any suitable combination as part of the claims and drawings.

[0079] Any reference numerals appearing in the claims are for illustrative purposes only and do not limit the scope of the claims.

Claims

1. A method of operating a telecommunications network, the telecommunications network comprising: User Equipment (UE); A wireless access point (WAP) that can be identified using a network device identifier; A source wireless local area network, i.e., a source WLAN, which is provided by the WAP and can be identified by a source network identifier; and a target WLAN; and the method includes the following steps: The encrypted output is generated by performing encryption on the following two: Source network identifier; and Network device identifier; Assigning access credentials to the target WLAN, wherein the access credentials include the encrypted output; and With the help of the UE: Identify the source network identifier and the network device identifier; The identified source network identifier and the identified network device identifier are encrypted to derive the encrypted output; and The UE uses access credentials derived from the encrypted output to request a connection to the target WLAN or to connect via the target WLAN.

2. The method according to claim 1, wherein, The target WLAN can be identified by means of a target network identifier, and the method further includes the step of providing the target network identifier to the UE by means of the source network identifier and / or the device network identifier.

3. The method according to claim 2, wherein, The target network identifier is provided as part of the encrypted output.

4. The method according to any one of claims 1 to 3, wherein, The target WLAN is different from the source WLAN.

5. The method according to claim 4, wherein, The target WLAN is provided by another WAP instead of the WAP itself.

6. The method according to claim 1, wherein, The target WLAN is provided by the WAP.

7. The method according to claim 1, wherein, The encryption function includes multiple encryption functions, wherein a single encryption function is performed on each of the source network identifier and the network device identifier.

8. The method according to claim 1, wherein, The access credentials are used to allow the UE to connect to an external network that can be accessed via the target WLAN.

9. The method according to claim 1, wherein, The access credentials are used to allow the UE to connect to devices that can be accessed via the target WLAN.

10. The method according to claim 1, wherein, After a connection is established between the UE and the target WLAN, the source network identifier and / or the network device identifier are changed.

11. A method for operating a user equipment (UE) to access a telecommunications network, the telecommunications network comprising: A wireless access point (WAP) that can be identified using a network device identifier; A source wireless local area network, i.e., a source WLAN, which is provided by the WAP and can be identified by a source network identifier; and a target WLAN; wherein an encrypted output is generated by applying encryption to both the source network identifier and the network device identifier, and an access credential including the encrypted output is assigned to the target WLAN; and the method includes the following steps by the UE: Identify the source network identifier and the network device identifier; The identified source network identifier and the identified network device identifier are encrypted to derive the encrypted output; and The UE uses access credentials derived from the encrypted output to request a connection to the target WLAN or to connect via the target WLAN.

12. A method of operating a group of wireless access points (WAPs), each of which can be identified by means of a network device identifier, in order to provide access to a telecommunications network via a user equipment (UE), wherein, The UE is configured to identify a source network identifier and a network device identifier, encrypt the identified source network identifier and the identified network device identifier to derive an encrypted output, and use the access credentials derived from the encrypted output to request a connection to or via the target WLAN. The method includes the following steps: Provides a source wireless LAN, i.e., a source WLAN, which can be identified using a source network identifier; Provide target WLAN; An encrypted output is generated by performing encryption on the source network identifier and the network device identifier of each of the set of wireless access points (WAPs) providing the source WLAN; Assign access credentials to the target WLAN, wherein the access credentials include the encrypted output.

13. A computer-readable carrier medium comprising a computer program, wherein when the computer program is executed by a computer, the computer program causes the computer to perform the method according to any one of claims 1 to 12.

14. A user equipment (UE) configured to access a telecommunications network, the telecommunications network comprising: A wireless access point (WAP) that can be identified using a network device identifier; A source wireless local area network, i.e., a source WLAN, which is provided by the WAP and can be identified by a source network identifier; and a target WLAN; wherein an encrypted output is generated by applying encryption to both the source network identifier and the network device identifier, and an access credential including the encrypted output is assigned to the target WLAN; and the UE includes: A WLAN network interface used to identify the source network identifier and the network device identifier; A processor is configured to encrypt the identified source network identifier and the identified network device identifier to derive the encrypted output, and to enable the WLAN network interface to request a connection to or via the target WLAN using access credentials derived by the UE from the encrypted output.

15. A set of wireless access points (WAPs) for providing access to a telecommunications network by a user equipment (UE), wherein, The UE is configured to identify a source network identifier and a network device identifier, encrypt the identified source network identifier and the identified network device identifier to derive an encrypted output, and use the access credentials derived from the encrypted output to request a connection to or via the target WLAN. This set of wireless access points (WAPs) includes: A set of Wireless Local Area Network (WLAN) interfaces is used to provide: a source WLAN, which can be identified by a source network identifier; a target WLAN; and a set of network device identifiers for identifying the WAP in the set of Wireless Access Points (WAPs); and A processor configured to generate encrypted output by performing encryption on the source network identifier and the network device identifier of each of the set of wireless access points (WAPs) providing the source WLAN, and to distribute access credentials including the encrypted output to the target WLAN.

16. A telecommunications system comprising: User equipment (UE) according to claim 14; as well as The set of wireless access points (WAPs) as described in claim 15.

Images