Digital credentials for visitor network access
A system for credential authentication comprises an interface configured to receive a create indication to create a visitor network credential and receive a certify indication to certify an authentication device to use a network, and a processor configured to provide the visitor network credential to the authentication device in response to the certify indication, provide a proof request to the authentication device, receive a proof response, validate the proof response using a distributed ledger, generate a network certificate, and provide the network certificate to the authentication device.
1. A system for credential authentication, comprising:
an interface configured to:
receive an indication to connect to a guest wifi network from an authentication device; and
a processor configured to:
in response to receiving the connect indication:
provide a captive portal to the authentication device, wherein the captive portal comprises an application for authenticating access to the guest wifi network and wherein the captive portal redirects to a digital credentials application that receives, from a user of the authentication device, a create indication to create a visitor network credential comprising a selection of the visitor network credential from a list of credentials,
create the visitor network credential,
register the visitor network credential in a distributed ledger, and
provide the visitor network credential to the authentication device;
receive a certify indication to certify use of the guest wifi network from the authentication device, wherein the certify indication comprises a request for a proof request;
in response to receiving the certify indication, provide the proof request to the authentication device;
receive a proof response from the authentication device, wherein the proof response comprises the visitor network credential;
validate the proof response, comprising determining that a public key from the distributed ledger matches a decentralized identifier (DID) in the visitor network credential, wherein the public key corresponds to a private key stored on the authentication device;
in response to determining that the public key matches the DID, generate a network certificate; and
provide the network certificate to the authentication device, wherein the authentication device presents the network certificate to the captive portal, wherein the captive portal validates the network certificate, and wherein the captive portal creates a network session for the authentication device to access the guest wifi network in response to determining that the network certificate is valid.
2. The system of claim 1 , wherein the create indication to create the visitor network credential is associated with an email address.
3. The system of claim 1 , wherein the interface is further configured to receive a claim indication from the authentication device to claim the visitor network credential.
4. The system of claim 3 , wherein the claim indication from the authentication device to claim the visitor network credential comprises a one-time token being used that causes generation of a DID keypair, wherein the private key component is stored on the authentication device and the public key component is stored on the distributed ledger, and that causes providing the visitor network credential to the authentication device.
5. The system of claim 3 , wherein the claim indication from the authentication device to claim the visitor network credential is provided in response to an authentication device digital identification app setup.
6. The system of claim 5 , wherein the authentication device digital identification app setup is in response to an email sent as part of a human resources system guest setup process.
7. The system of claim 1 , wherein the processor is further configured to verify the visitor network credential is associated with the authentication device.
8. The system of claim 1 , wherein the certify indication to certify the authentication device to use the network is received from a digital credential app on the authentication device.
9. The system of claim 8 , wherein the authentication device provides the certify indication to certify the authentication device to use the network to the system for credential authentication in response to a user confirmation.
10. The system of claim 8 , wherein the digital credential app is initiated by the captive portal.
11. The system of claim 1 , wherein validating the proof response using the distributed ledger comprises determining that a credential associated with the proof response satisfies the proof request, determining that a proof response signature is valid, determining that the credential associated with the proof response is not expired, or determining that the credential associated with the proof response is not revoked by looking in the distributed ledger.
12. The system of claim 1 , wherein the network certificate comprises an X.509 certificate.
13. The system of claim 1 , wherein the network certificate comprises user identity data.
14. The system of claim 13 , wherein the user identity data is based at least in part on user identity data stored by the visitor network credential.
15. The system of claim 1 , wherein network session settings for the network session comprise at least one of available bandwidth, session time, available session connections, session speed, access to a sandboxed network, and access to a limited set of connections.
16. The system of claim 1 , wherein the create indication to create the visitor network credential is provided by a human resources system guest setup process.
17. The system of claim 1 , wherein the information included in the network certificate comprises visitor network credential data.
18. The system of claim 1 , wherein the information included in the network certificate comprises authentication device identifier data.
19. The system of claim 1 , wherein creating the network session for the authentication device comprises providing network access to the authentication device.
20. The system of claim 1 , wherein the application comprises a user interface element for a user to indicate to use a digital credential to authenticate access to the guest wifi network.
21. The system of claim 1 , wherein the certify indication is provided in response to a user indicating to use a digital credential to authenticate access to the guest wifi network.
22. A method for credential authentication, comprising:
receiving an indication to connect to a guest wifi network from an authentication device; and
in response to receiving the connect indication:
providing, using a processor, a captive portal to the authentication device, wherein the captive portal comprises an application for authenticating access to the guest wifi network and wherein the captive portal redirects to a digital credentials application that receives, from a user of the authentication device, a create indication to create a visitor network credential comprising a selection of the visitor network credential from a list of credentials,
creating the visitor network credential,
registering the visitor network credential in a distributed ledger, and
providing the visitor network credential to the authentication device;
receiving a certify indication to certify use of the guest wifi network from the authentication device, wherein the certify indication comprises a request for a proof request;
in response to receiving the certify indication, providing the proof request to the authentication device;
receiving a proof response from the authentication device, wherein the proof response comprises the visitor network credential;
validating the proof response, comprising determining that a public key from the distributed ledger matches a decentralized identifier (DID) in the visitor network credential, wherein the public key corresponds to a private key stored on the authentication device;
in response to determining that the public key matches the DID, generating a network certificate; and
providing the network certificate to the authentication device, wherein the authentication device presents the network certificate to the captive portal, wherein the captive portal validates the network certificate, and wherein the captive portal creates a network session for the authentication device to access the guest wifi network in response to determining that the network certificate is valid.
23. A computer program product for credential authentication, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving an indication to connect to a guest wifi network from an authentication device; and
in response to receiving the connect indication:
providing, using a processor, a captive portal to the authentication device, wherein the captive portal comprises an application for authenticating access to the guest wifi network and wherein the captive portal redirects to a digital credentials application that receives, from a user of the authentication device, a create indication to create a visitor network credential comprising a selection of the visitor network credential from a list of credentials,
creating the visitor network credential,
registering the visitor network credential in a distributed ledger, and
providing the visitor network credential to the authentication device;
receiving a certify indication to certify use of the guest wifi network from the authentication device, wherein the certify indication comprises a request for a proof request;
in response to receiving the certify indication, providing the proof request to the authentication device;
receiving a proof response from the authentication device, wherein the proof response comprises the visitor network credential;
validating the proof response, comprising determining that a public key from the distributed ledger matches a decentralized identifier (DID) in the visitor network credential, wherein the public key corresponds to a private key stored on the authentication device;
in response to determining that the public key matches the DID, generating a network certificate; and
providing the network certificate to the authentication device, wherein the authentication device presents the network certificate to the captive portal, wherein the captive portal validates the network certificate, and wherein the captive portal creates a network session for the authentication device to access the guest wifi network in response to determining that the network certificate is valid.