Wireless LAN (WLAN) public identity federation trust architecture
The disclosed technology relates to a process of evaluating any number of different identity providers (IDPs) and their respective set of credentials that are used to authenticate corresponding users to assist with the onboarding of the different IDPs in connection with Wi-Fi identity federations. In particular, the process allows a person's electronic identity and attributes (stored across one or more IDPs) to be determined once using a standard. Once trust has been established for the user, that trust can then be utilized across a number of different systems (e.g., Single-sign on). The same trust determination can be used without the need for the authenticity of the user identity to be re-evaluated with each new access request.
1. A method for automatically authenticating a user device on a network, the method comprising:
receiving a request from a user device to access the network via an access point, wherein the request is transmitted from the user device to the access point using an identity provider service;
evaluating a credential strength of the user device, wherein the credential strength of the user device is calculated based by:
identifying a plurality of authentication methods that are accepted by the access point,
retrieving pre-determined weights associated with each of the plurality of authentication methods, and
outputting a value representative of the credential strength of the identity provider, wherein the value is based on aggregating the pre-determined weights associated with the plurality of authentication methods the identity provider uses to authenticate its users using the identity provider service;
assigning the credential strength to the user device; and
providing the user device access to the network based on the credential strength assigned to the user device satisfying a pre-determined threshold.
2. The method of claim 1 , wherein the evaluating of the credential strength of the user device includes:
identifying a plurality of alternative authentication methods, wherein each alternative authentication method is assigned a pre-determined weight;
requesting additional information relating to one or more of the plurality of alternative authentication methods when an initial evaluation does not satisfy the pre-determined threshold; and
evaluating the credential strength of the user device based on the requested additional information across two or more different identity providers associated with the user device.
3. The method of claim 1 , wherein the credential strength assigned to the user device is used by the user device to access the network via different access points without the need to re-evaluate the credential strength of the user device.
4. The method of claim 1 , wherein the identity provider uses one or more of user name/password, authorization token, device certificate, or SIM to authenticate the identity of users using the identity provider service.
5. The method of claim 1 , wherein the identity provider uses one or more of email, mobile phone, government identification, physical identification, local verification, or biometrics to authenticate the identity of users using the identity provider service.
6. The method of claim 1 , wherein the credential strength of the user device decays after a pre-determined period of time based on decay weights.
7. The method of claim 1 , wherein an identity federation generates the pre-determined weights associated with each of the plurality of authentication methods.
8. A non-transitory computer-readable medium comprising instructions for automatically authenticating a user device on a network, the instructions, when executed by a computing system, cause the computing system to:
receive a request from a user device to access the network via an access point, wherein the request is transmitted from the user device to the access point using an identity provider service;
evaluate a credential strength of the user device, wherein the credential strength of the user device is calculated by:
identifying a plurality of authentication methods that are accepted by the access point,
retrieving pre-determined weights associated with each of the plurality of authentication methods, and
outputting a value representative of the credential strength of the identity provider, wherein the value is based on aggregating the pre-determined weights associated with the plurality of authentication methods the identity provider uses to authenticate its users using the identity provider service;
assign the credential strength to the user device; and
provide the user device access to the network based on the credential strength assigned to the user device satisfying a pre-determined threshold.
9. The non-transitory computer-readable medium of claim 8 , wherein the evaluating of the credential strength of the user device includes:
identifying a plurality of alternative authentication methods, wherein each alternative authentication method is assigned a pre-determined weight;
requesting additional information relating to one or more of the plurality of alternative authentication methods when an initial evaluation does not satisfy the pre-determined threshold; and
evaluating the credential strength of the user device based on the requested additional information across two or more different identity providers associated with the user device.
10. The non-transitory computer-readable medium of claim 8 , wherein an identity federation generates the pre-determined weights associated with each of the plurality of authentication methods.
11. The non-transitory computer-readable medium of claim 8 , wherein the credential strength assigned to the user device is used by the user device to access the network via different access points without the need to re-evaluate the credential strength of the user device.
12. The non-transitory computer-readable medium of claim 8 , wherein the identity provider uses one or more of user name/password, authorization token, device certificate, or SIM to authenticate the identity of users using the identity provider service.
13. The non-transitory computer-readable medium of claim 8 , wherein the identity provider uses one or more of email, mobile phone, government identification, physical identification, local verification, or biometrics to authenticate the identity of users using the identity provider service.
14. The non-transitory computer-readable medium of claim 8 , wherein the credential strength of the user device decays after a pre-determined period of time based on decay weights.
15. A system for automatically authenticating a user device on a network, the system comprising:
a processor; and
a non-transitory computer-readable medium storing instructions that, when executed by the system, cause the system to:
receive a request from a user device to access the network via an access point, wherein the request is transmitted from the user device to the access point using an identity provider service;
evaluate a credential strength of the user device, wherein the credential strength of the user device is calculated by:
identifying a plurality of authentication methods that are accepted by the access point,
retrieving pre-determined weights associated with each of the plurality of authentication methods, and
outputting a value representative of the credential strength of the identity provider, wherein the value is based on aggregating the pre-determined weights associated with the plurality of authentication methods the identity provider uses to authenticate its users using the identity provider service;
assign the credential strength to the user device; and
provide the user device access to the network based on the credential strength assigned to the user device satisfying a pre-determined threshold.
16. The system of claim 15 , wherein the evaluating of the credential strength of the user device includes:
identifying a plurality of alternative authentication methods, wherein each alternative authentication method is assigned a pre-determined weight;
requesting additional information relating to one or more of the plurality of alternative authentication methods when an initial evaluation does not satisfy the pre-determined threshold; and
evaluating the credential strength of the user device based on the requested additional information across two or more different identity providers associated with the user device.
17. The system of claim 15 , wherein an identity federation generates the pre-determined weights associated with each of the plurality of authentication methods.
18. The system of claim 15 , wherein the credential strength assigned to the user device is used by the user device to access the network via different access points without the need to re-evaluate the credential strength of the user device.
19. The system of claim 15 , wherein the identity provider uses one or more of user name/password, authorization token, device certificate, or SIM to authenticate the identity of users using the identity provider service.
20. The system of claim 15 , wherein the identity provider uses one or more of email, mobile phone, government identification, physical identification, local verification, or biometrics to authenticate the identity of users using the identity provider service.