Secure network access using credentials
Example embodiments include systems and methods for establishing secure wireless communications, including receive from a mobile user equipment (UE), via the access point (AP), a request to access the network, send, to the UE, a web page sign-in option of a third-party credential, receive an indication to use the third-party credential, redirect the UE to a corresponding third-party website login page and include an identifier, receive an authorization from the UE via the AP, the authorization having been sent to the UE from the third-party website after providing valid third-party credential to the third-party website, generate a proxy-credential, bind the authorization to the proxy-credential in the database, send the proxy-credential to the mobile user equipment via the access point, and authorize, via the access control server and the AP, the UE to establish a secure connection.
1. A system for establishing secure wireless communications, comprising,
a credential-provisioning server, with a processor and a memory, in communication with an access point, a database, an access control server, and a network, the credential-provisioning server configured to,
receive from a mobile user equipment, via the access point, a request to access the network;
send, to the mobile user equipment, via the access point, a web page sign-in option of a third-party credential;
receive, from the mobile user equipment, via the access point, an indication to use the third-party credential;
redirect the mobile user equipment to a corresponding third-party website login page via the network, and include an identifier;
receive an authorization from the mobile user equipment via the access point, the authorization having been sent to the mobile user equipment from the third-party website after providing valid third-party credential to the third-party website;
generate a proxy-credential;
bind the authorization to the proxy-credential in the database;
send the proxy-credential to the mobile user equipment via the access point; and
authorize, via the access control server and the access point, the mobile user equipment to establish a secure connection;
exchange the authorization from a mobile user device for an access token from the third-party website via the network; and
send the access control server the access token to bind, in the database, to the proxy credential that corresponds to the mobile user equipment;
wherein the access control server is configured to,
subsequent to the mobile user equipment previously accessing the network,
receive the proxy-credential from the mobile user equipment via the access point, the proxy-credential having previously been sent to the mobile user equipment after successfully logging into the third-party website;
validate the proxy-credential from the mobile user equipment via the access point;
retrieve the access token bound to the received proxy-credential;
send, via the network, the access token to the third-party website for validation;
receive, via the network, an updated access token from the social network website if the access token is valid; and
authorize the mobile user equipment to establish a secure connection via the access point.
2. The system of claim 1 wherein the credential-provisioning server is further configured to,
request, via the network,
permission to access user information from the third-party website; and
permission to update the third-party website with a location information of the mobile user equipment.
3. The system of claim 2 wherein the credential-provisioning server is further configured to,
request, via the network, the user information from the third-party website after receiving the authorization from the mobile user equipment; and
receive and save the user information from the third-party website in response to the request.
4. The system of claim 2 wherein the credential-provisioning server is further configured to,
send the location information of the mobile user equipment to the third-party website via the network.
5. The system of claim 1 wherein the proxy-credential is a username and password credential.
6. The system of claim 1 wherein the proxy-credential is a client-certificate credential.
7. The system of claim 1 wherein the proxy-credential is a dynamic pre-shared key.
8. The system of claim 1 wherein the third-party credential is a social network credential and the third-party website is a social network website.
9. The system of claim 1 wherein the identifier is an App-ID.
10. The system of claim 1 wherein the authorization is an authentication code.
11. The system of claim 1 , wherein the, receive an authorization, and exchange the authorization for an access token, is via OAuthv2 (RFC-6749) protocol.
12. A method for establishing secure wireless communications, comprising,
via a credential-provisioning server in communication with an access point, a database, an access control server, and a network,
receiving from a mobile user equipment, via the access point, a request to access the network;
sending, to the mobile user equipment, via the access point, a web page sign-in option of a third-party credential;
receiving, from the mobile user equipment, via the access point, an indication to use the third-party credential;
redirecting the mobile user equipment to a corresponding third-party website login page via the network, and include a App-ID;
receiving an authorization from the mobile user equipment via the access point, the authorization having been sent to the mobile user equipment from the third-party website after providing valid third-party credential to the third-party website;
generating a proxy-credential;
binding the authorization to the proxy-credential in the database;
sending the proxy-credential to the mobile user equipment via the access point; and
authorizing, via the access control server and the access point, the mobile user equipment to establish a secure connection;
exchanging the authorization from the mobile user device for an access token from the third-party website via the network; and
sending the access control server the access token to bind, in the database, to the proxy credential that corresponds to the mobile user equipment;
via the access control server,
subsequent to the mobile user equipment previously accessing the network,
receiving the proxy-credential from the mobile user equipment via the access point, the proxy-credential having previously been sent to the mobile user equipment after successfully logging into the third-party website;
validating the proxy-credential from the mobile user equipment via the access point;
retrieving the access token bound to the received proxy-credential;
sending, via the network, the access token to the third-party website for validation;
receiving, via the network, an updated access token from the social network website if the access token is valid; and
authorizing the mobile user equipment to establish a secure connection via the access point.
13. The method of claim 12 further comprising, via the credential-provisioning server,
requesting, via the network,
permission to access user information from the third-party site; and
permission to update the third-party site with a location information of the mobile user equipment.
14. The method of claim 13 further comprising, via the credential-provisioning server,
requesting, via the network, the user information from the third-party site after receiving the authorization from the mobile user equipment; and
receiving and save the user information from the third-party website in response to the request.
15. The method of claim 13 further comprising, via the credential-provisioning server,
sending the location information of the mobile user equipment to the third-party website via the network.
16. The method of claim 12 wherein the proxy-credential is a username and password credential.
17. The method of claim 12 wherein the proxy-credential is a client-certificate credential.
18. The method of claim 12 wherein the proxy-credential is a dynamic pre-shared key.
19. The method of claim 12 wherein the third-party credential is a social network credential and the third-party website is a social network website.
20. The method of claim 12 wherein the,
receive an authorization code, and exchange the authorization for an access token, is via OAuthv2 (RFC-6749) protocol.
21. The method of claim 12 wherein the authorization is an authentication code.
22. A method for establishing secure wireless communications, comprising,
via an access control server in communication with a credential-provisioning server, an access point, a database, and a network,
receiving a proxy-credential from a mobile user equipment via the access point, the proxy-credential having previously been sent to the mobile user equipment from the credential-provisioning server after successfully logging into a third-party website;
validating the proxy-credential from the mobile user equipment via the access point; and
authorizing the mobile user equipment to establish a secure connection via the access point;
binding an access token with the received proxy-credential;
sending, via the network, the access token to a third-party website for validation; and
receiving, via the network, an updated access token from the social network website if the access token is valid.
23. The method of claim 22 wherein the proxy-credential is a username and password credential.
24. The method of claim 22 wherein the proxy-credential is a client-certificate credential.
25. The method of claim 22 wherein the proxy-credential is a dynamic pre-shared key.
26. The method of claim 22 wherein the proxy-credential was generated by the credential-provisioning server in response to the credential-provisioning server,
receiving an authorization from the mobile user equipment via the access point, the authorization having been sent to the mobile user equipment from the third-party website after providing a valid third-party credential to the third-party website.
27. The method of claim 22 wherein the proxy-credential was generated by the credential-provisioning server in response to the credential-provisioning server,
exchanging the authorization from the mobile user device for an access token from the third-party website via the network.