Granted Patent B1

US 9,756,505 · App. 14/732,813 · Granted Sep 5, 2017

Abstract

Claims (78)

1. A computer-implemented method for utilizing authentication requests for on-demand provisioning of access-point accounts, at least a portion of the method being performed by a wireless access point comprising at least one processor, the method comprising:

receiving, from an unknown device of an unknown user at the wireless access point before the unknown user has an account with the wireless access point that allows the unknown user to access a secured network via the wireless access point, an authentication request from the unknown user to authenticate and connect to the secured network via the wireless access point, wherein:

the authentication request is the same type of authentication request used to authenticate and connect known users to the secured network via the wireless access point and comprises authentication information that was generated at the unknown device of the unknown user from at least one unknown credential provided by the unknown user; and

the unknown credential is of a type required by the wireless access point to authenticate known users; and

treating the authentication request from the unknown user as an account-provisioning request by:

transmitting, in response to the authentication request from the unknown user, a credential request to an administrator of the secured network for the unknown credential of the unknown user and permission to provision the account for the unknown user;

receiving, from an administering device of the administrator after the credential request is transmitted to the administrator, a provisioning request from the administrator to provision the account for the unknown user using the unknown credential, wherein the provisioning request comprises the unknown credential;

provisioning, in response to receiving the provisioning request, the account for the unknown user using the unknown credential received as part of the provisioning request; and

enabling the unknown user to access the secured network using the account for the unknown user.

2. The computer-implemented method of claim 1 , wherein:

the unknown credential comprises a password;

the authentication information comprises a hash value that was generated at the unknown device of the unknown user and transmitted, from the unknown device, as part of the authentication request;

the computer-implemented method further comprises:

receiving, as input at the administering device of the administrator, the password from the administrator; and

transmitting, from the administering device, the password as part of the provisioning request; and

provisioning the account for the unknown user comprises provisioning the account for the unknown user using the password transmitted from the administering device.

3. The computer-implemented method of claim 2 , wherein:

the administering device comprises a mobile device of the administrator;

the steps of receiving the password and transmitting the password are performed by a mobile application installed on the mobile device.

4. The computer-implemented method of claim 1 , wherein the authentication request comprises an authentication request of an authentication protocol.

5. The computer-implemented method of claim 1 , wherein the authentication request comprises an authentication request of an extensible authentication protocol.

6. The computer-implemented method of claim 1 , further comprising:

refraining from responding to the authentication request with a failed authentication response;

responding to the authentication request with a successful authentication response after the account for the unknown user is provisioned.

7. The computer-implemented method of claim 1 , wherein:

the provisioning request comprises information that indicates that an account policy should be applied to the account for the unknown user;

provisioning the account for the unknown user comprises applying the account policy to the account for the unknown user.

8. A system for utilizing authentication requests for on-demand provisioning of access-point accounts, the system comprising:

an authentication software engine, stored in memory, that:

receives, from an unknown device of an unknown user at a wireless access point before the unknown user has an account with the wireless access point that allows the unknown user to access a secured network via the wireless access point, an authentication request from the unknown user to authenticate and connect to the secured network via the wireless access point, wherein:

the authentication request is the same type of authentication request used to authenticate and connect known users to the secured network via the wireless access point and comprises authentication information that was generated at the unknown device of the unknown user from at least one unknown credential provided by the unknown user; and

the unknown credential is of a type required by the wireless access point to authenticate known users; and

treats the authentication request from the unknown user as an account-provisioning request by transmitting, in response to the authentication request from the unknown user, a credential request to an administrator of the secured network for the unknown credential of the unknown user and permission to provision the account for the unknown user;

a receiving software engine, stored in memory, that receives, from an administering device of the administrator after the credential request is transmitted to the administrator, a provisioning request from the administrator to provision the account for the unknown user using the unknown credential, wherein the provisioning request comprises the unknown credential;

a provisioning software engine, stored in memory, that provisions, in response to the provisioning request, the account for the unknown user using the unknown credential received as part of the provisioning request;

an access-enabling software engine, stored in memory, that enables the unknown user to access the secured network using the account for the unknown user; and

at least one processor that executes the authentication software engine, the receiving software engine, the provisioning software engine, and the access-enabling software engine.

9. The system of claim 8 , wherein:

the unknown credential comprises a password;

the authentication information comprises a hash value that was generated at the unknown device of the unknown user and transmitted, from the unknown device, as part of the authentication request;

the system further comprises an administering software engine that:

receives, as input at the administering device of the administrator, the password from the administrator; and

transmits, from the administering device, the password as part of the provisioning request;

the provisioning software engine provisions the account for the unknown user by provisioning the account for the unknown user using the password transmitted from the administering device.

10. The system of claim 9 , wherein:

the administering device comprises a mobile device of the administrator;

the administering software engine comprises a mobile application installed on the mobile device.

11. The system of claim 8 , wherein the authentication request comprises an authentication request of an authentication protocol.

12. The system of claim 8 , wherein the authentication request comprises an authentication request of an extensible authentication protocol.

13. The system of claim 8 , the authentication software engine further:

refrains from responding to the authentication request with a failed authentication response;

responds to the authentication request with a successful authentication response after the account for the unknown user is provisioned.

14. The system of claim 8 , wherein:

the provisioning request comprises information that indicates that an account policy should be applied to the account for the unknown user;

the provisioning software engine provisions the account for the unknown user by applying the account policy to the account for the unknown user.

15. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

receive, from an unknown device of an unknown user at a wireless access point before the unknown user has an account with the wireless access point that allows the unknown user to access a secured network via the wireless access point, an authentication request from the unknown user to authenticate and connect to the secured network via the wireless access point, wherein:

the authentication request is the same type of authentication request used to authenticate and connect known users to the secured network via the wireless access point and comprises authentication information that was generated at the unknown device of the unknown user from at least one unknown credential provided by the unknown user; and

the unknown credential is of a type required by the wireless access point to authenticate known users; and

treat the authentication request from the unknown user as an account-provisioning request by:

transmitting, in response to the authentication request from the unknown user, a credential request to an administrator of the secured network for the unknown credential of the unknown user and permission to provision the account for the unknown user;

receiving, from an administering device of the administrator after the credential request is transmitted to the administrator, a provisioning request from the administrator to provision the account for the unknown user using the unknown credential, wherein the provisioning request comprises the unknown credential;

provisioning, in response to receiving the provisioning request, the account for the unknown user using the unknown credential received as part of the provisioning request; and

enabling the unknown user to access the secured network using the account for the unknown user.

16. The non-transitory computer-readable medium of claim 15 , wherein:

the unknown credential comprises a password;

the authentication information comprises a hash value that was generated at the unknown device of the unknown user and transmitted, from the unknown device, as part of the authentication request;

the one or more computer-readable instructions further cause the computing device to

receive, from the administering device of the administrator, the password as part of the provisioning request, wherein the password was received from the administrator as input at the administering device; and

the one or more computer-readable instructions cause the computing device to provision the account for the unknown user by causing the computing device to provision the account for the unknown user using the password transmitted from the administering device.

17. The non-transitory computer-readable medium of claim 16 , wherein:

the administering device comprises a mobile device of the administrator;

the password was received from the administrator as input at the administering device via a mobile application installed on the mobile device.

18. The non-transitory computer-readable medium of claim 15 , wherein the authentication request comprises an authentication request of an authentication protocol.

19. The non-transitory computer-readable medium of claim 15 , wherein the authentication request comprises an authentication request of an extensible authentication protocol.

20. The non-transitory computer-readable medium of claim 15 , wherein the one or more computer-readable instructions further cause the computing device to:

refrain from responding to the authentication request with a failed authentication response;

respond to the authentication request with a successful authentication response after the account for the unknown user is provisioned.

Assignments (6)