Wireless LAN (WLAN) public identity federation trust architecture
The disclosed technology relates to a process of evaluating any number of different identity providers (IDPs) and their respective set of credentials that are used to authenticate corresponding users to assist with the onboarding of the different IDPs in connection with Wi-Fi identity federations. In particular, the process allows a person's electronic identity and attributes (stored across one or more IDPs) to be determined once using a standard. Once trust has been established for the user, that trust can then be utilized across a number of different systems (e.g., Single-sign on). The same trust determination can be used without the need for the authenticity of the user identity to be re-evaluated with each new access request.
1. A method for automatically authenticating a user device on a network, the method comprising:
receiving a request from the user device to access the network via an access point, wherein the request is transmitted from the user device to the access point using an identity provider service;
evaluating a credential strength of the user device based on a strength rating of each authentication method used by the user device, wherein a plurality of authentication methods are accepted by the access point and each authentication method of the plurality of authentication methods have a respective strength rating;
and
providing the user device access to the network based on the credential strength of the user device satisfying a pre-determined threshold.
2. The method of claim 1 , wherein the credential strength of the identity provider is calculated by:
retrieving pre-determined weights associated with each of the one or more authentication methods; and
outputting a value representative of the credential strength of the identity provider, wherein the value is based on aggregating the pre-determined weights associated with the open or more authentication methods the identity provider uses to authenticate its users using the identity provider service.
3. The method of claim 2 , wherein an identity federation generates the pre-determined weights associated with each of the one or more authentication methods.
4. The method of claim 1 , wherein the evaluating of the credential strength of the user device includes:
identifying a plurality of alternative authentication methods, wherein each alternative authentication method is assigned a pre-determined weight;
requesting additional information relating to one or more of the plurality of alternative authentication methods when an initial evaluation does not satisfy the pre-determined threshold; and
evaluating the credential strength of the user device based on the requested additional information across two or more different identity providers associated with the user device.
5. The method of claim 1 , wherein the credential strength assigned to the user device is used by the user device to access the network via different access points without the need to re-evaluate the credential strength of the user device.
6. The method of claim 1 , wherein the identity provider uses one or more of user name/password, authorization token, device certificate, or SIM to authenticate the identity of users using the identity provider service.
7. The method of claim 1 , wherein the identity provider uses one or more of email, mobile phone, government identification, physical identification, local verification, or biometrics to authenticate the identity of users using the identity provider service.
8. The method of claim 1 , wherein the credential strength of the user device decays after a pre-determined period of time based on decay weights.
9. A non-transitory computer-readable medium comprising instructions for automatically authenticating a user device on a network, the instructions, when executed by a computing system, cause the computing system to:
receive a request from the user device to access the network via an access point, wherein the request is transmitted from the user device to the access point using an identity provider service;
evaluate a credential strength of the user device based on a strength rating of each authentication method used by the user device, wherein a plurality of authentication methods are accepted by the access point and each authentication method of the plurality of authentication methods have a respective strength rating;
and
provide the user device access to the network based on the credential strength of the user device satisfying a pre-determined threshold.
10. The non-transitory computer-readable medium of claim 9 , further comprising instructions for calculating the credential strength, which when executed by the computing system, cause the computing system to:
retrieve pre-determined weights associated with each of the one or more authentication methods; and
output a value representative of the credential strength of the identity provider, wherein the value is based on aggregating the pre-determined weights associated with the open or more authentication methods the identity provider uses to authenticate its users using the identity provider service.
11. The non-transitory computer-readable medium of claim 10 , wherein an identity federation generates the pre-determined weights associated with each of the one or more authentication methods.
12. The non-transitory computer-readable medium of claim 9 , further comprising instructions for evaluating the credential strength, which when executed by the computing system, cause the computing system to:
identify a plurality of alternative authentication methods, wherein each alternative authentication method is assigned a pre-determined weight;
request additional information relating to one or more of the plurality of alternative authentication methods when an initial evaluation does not satisfy the pre-determined threshold; and
evaluate the credential strength of the user device based on the requested additional information across two or more different identity providers associated with the user device.
13. The non-transitory computer-readable medium of claim 9 , wherein the credential strength assigned to the user device is used by the user device to access the network via different access points without the need to re-evaluate the credential strength of the user device.
14. The non-transitory computer-readable medium of claim 9 , wherein the identity provider uses one or more of user name/password, authorization token, device certificate, or SIM to authenticate the identity of users using the identity provider service.
15. The non-transitory computer-readable medium of claim 9 , wherein the identity provider uses one or more of email, mobile phone, government identification, physical identification, local verification, or biometrics to authenticate the identity of users using the identity provider service.
16. The non-transitory computer-readable medium of claim 9 , wherein the credential strength of the user device decays after a pre-determined period of time based on decay weights.
17. A system for automatically authenticating a user device on a network, the system comprising:
a processor; and
a non-transitory computer-readable medium storing instructions that, when executed by the processor, cause the system to:
receive a request from the user device to access the network via an access point, wherein the request is transmitted from the user device to the access point using an identity provider service;
evaluate a credential strength of the user device based on a strength rating of each authentication method used by the user device, wherein a plurality of authentication methods accepted by the access point and each authentication method of the plurality of authentication methods have a respective strength rating;
and
provide the user device access to the network based on the credential strength of the user device satisfying a pre-determined threshold.
18. The system of claim 17 , further comprising instructions for calculating the credential strength, which when executed by the processor, cause the system to:
retrieve pre-determined weights associated with each of the one or more authentication methods; and
output a value representative of the credential strength of the identity provider, wherein the value is based on aggregating the pre-determined weights associated with the open or more authentication methods the identity provider uses to authenticate its users using the identity provider service.
19. The system of claim 18 , wherein an identity federation generates the pre-determined weights associated with each of the one or more authentication methods.
20. The system of claim 17 , further comprising instructions for evaluating the credential strength, which when executed by the processor, cause the system to:
identify a plurality of alternative authentication methods, wherein each alternative authentication method is assigned a pre-determined weight;
request additional information relating to one or more of the plurality of alternative authentication methods when an initial evaluation does not satisfy the pre-determined threshold; and
evaluate the credential strength of the user device based on the requested additional information across two or more different identity providers associated with the user device.