Wireless LAN (WLAN) public identity federation trust architecture
The disclosed technology relates to a process of evaluating any number of different identity providers (IDPs) and their respective set of credentials that are used to authenticate corresponding users to assist with the onboarding of the different IDPs in connection with Wi-Fi identity federations. In particular, the process allows a person's electronic identity and attributes (stored across one or more IDPs) to be determined once using a standard. Once trust has been established for the user, that trust can then be utilized across a number of different systems (e.g., Single-sign on). The same trust determination can be used without the need for the authenticity of the user identity to be re-evaluated with each new access request.
1. A method for automatically authenticating a user device on a network, the method comprising:
receiving a request from the user device to access the network via an access point;
determining an identity provider associated with the user device;
retrieving, from the identity provider, respective strength ratings of a plurality of authentication methods accepted by the access point and each authentication method of the plurality of authentication methods have respective strength ratings;
evaluating a credential strength of the user device based on a strength rating of one or more authentication methods of the plurality of authentication methods used by the user device; and
providing the user device access to the network based on the credential strength of the user device satisfying a pre-determined threshold.
2. The method of claim 1 , wherein the evaluating of the credential strength of the user device further comprising:
identifying a plurality of alternative authentication methods, wherein each alternative authentication method is assigned a pre-determined weight;
requesting additional information relating to one or more of the plurality of alternative authentication methods when an initial evaluation does not satisfy the pre-determined threshold; and
evaluating the credential strength of the user device based on the requested additional information across two or more different identity providers associated with the user device.
3. The method of claim 1 , wherein the credential strength assigned to the user device is used by the user device to access the network via different access points without the need to re-evaluate the credential strength of the user device.
4. The method of claim 1 , wherein the identity provider uses one or more of user name/password, authorization token, device certificate, or SIM to authenticate the user device.
5. The method of claim 1 , wherein the identity provider uses one or more of email, mobile phone, government identification, physical identification, local verification, or biometrics to authenticate the user device.
6. The method of claim 1 , wherein the credential strength of the user device decays after a pre-determined period of time based on decay weights.
7. The method of claim 1 , wherein an identity federation generates the respective strength ratings associated with each of the plurality of authentication methods.
8. A non-transitory computer-readable medium comprising instructions for automatically authenticating a user device on a network, the instructions, when executed by a computing system, cause the computing system to:
receive a request from the user device to access the network via an access point;
determine an identity provider associated with the user device;
retrieve, from the identity provider, respective strength ratings of a plurality of authentication methods accepted by the access point and each authentication method of the plurality of authentication methods have respective strength ratings;
evaluate a credential strength of the user device based on a strength rating of one or more authentication methods of the plurality of authentication methods used by the user device; and
provide the user device access to the network based on the credential strength of the user device satisfying a pre-determined threshold.
9. The non-transitory computer-readable medium of claim 8 , wherein the evaluating of the credential strength of the user device further comprising instructions, which when executed by the computing system, cause the computing system to:
identify a plurality of alternative authentication methods, wherein each alternative authentication method is assigned a pre-determined weight;
request additional information relating to one or more of the plurality of alternative authentication methods when an initial evaluation does not satisfy the pre-determined threshold; and
evaluate the credential strength of the user device based on the requested additional information across two or more different identity providers associated with the user device.
10. The non-transitory computer-readable medium of claim 8 , wherein the credential strength assigned to the user device is used by the user device to access the network via different access points without the need to re-evaluate the credential strength of the user device.
11. The non-transitory computer-readable medium of claim 8 , wherein the identity provider uses one or more of user name/password, authorization token, device certificate, or SIM to authenticate the user device.
12. The non-transitory computer-readable medium of claim 8 , wherein the identity provider uses one or more of email, mobile phone, government identification, physical identification, local verification, or biometrics to authenticate the user device.
13. The non-transitory computer-readable medium of claim 8 , wherein the credential strength of the user device decays after a pre-determined period of time based on decay weights.
14. A system for automatically authenticating a user device on a network, the system comprising:
at least one processor; and
a non-transitory computer-readable medium storing instructions that, when executed by the at least one processor, cause the system to:
receive a request from the user device to access the network via an access point;
determine an identity provider associated with the user device;
retrieve, from the identity provider, respective strength ratings of a plurality of authentication methods accepted by the access point and each authentication method of the plurality of authentication methods have respective strength ratings;
evaluate a credential strength of the user device based on a strength rating of one or more authentication methods of the plurality of authentication methods used by the user device; and
provide the user device access to the network based on the credential strength of the user device satisfying a pre-determined threshold.
15. The system of claim 14 , wherein the evaluating of the credential strength of the user device further comprising instructions, which when executed by the at least one processor, causes the system to:
identify a plurality of alternative authentication methods, wherein each alternative authentication method is assigned a pre-determined weight;
request additional information relating to one or more of the plurality of alternative authentication methods when an initial evaluation does not satisfy the pre-determined threshold; and
evaluate the credential strength of the user device based on the requested additional information across two or more different identity providers associated with the user device.
16. The system of claim 14 , wherein the credential strength assigned to the user device is used by the user device to access the network via different access points without the need to re-evaluate the credential strength of the user device.
17. The system of claim 14 , wherein the identity provider uses one or more of user name/password, authorization token, device certificate, or SIM to authenticate the user device.
18. The system of claim 14 , wherein the identity provider uses one or more of email, mobile phone, government identification, physical identification, local verification, or biometrics to authenticate the user device.
19. The system of claim 14 , wherein the credential strength of the user device decays after a pre-determined period of time based on decay weights.
20. The system of claim 14 , wherein an identity federation generates the respective strength ratings associated with each of the plurality of authentication methods.