Device-independent authentication based on a passphrase and a policy
An electronic device that selectively approves secure access of a second electronic device to a network is described. This electronic device receives an access request associated with a computer, where the access request includes passphrase parameters associated with a user, and the passphrase parameters include inputs to and an output of a cryptographic calculation. In response, the electronic device calculates one or more second outputs of the cryptographic calculation based at least in part on the inputs and one or more stored passphrases. Moreover, when there is a match between one of the one or more second outputs and the output, the electronic device accesses a policy associated with the user. Then, when one or more criteria associated with the policy are met, the electronic device selectively provides an access acceptance message to the computer, which includes information for establishing the secure access of the second electronic device.
1 . An electronic device, comprising:
an interface circuit configured to communicate with a computer;
a processor coupled to the interface circuit; and
memory, coupled to the processor, configured to store program instructions, wherein, when executed by the processor, the program instructions cause the electronic device to perform operations comprising:
receiving an access request associated with the computer, wherein the access request comprises passphrase parameters corresponding to a passphrase associated with a user, the passphrase parameters comprise inputs to a cryptographic calculation and an output of the cryptographic calculation, and the cryptographic calculation is associated with a pre-shared key (PSK) of the user;
calculating one or more second outputs of the cryptographic calculation based at least in part on the inputs, a passphrase and an identifier of the computer, which is included in the passphrase parameters;
when there is a match between one of the one or more second outputs and the output, accessing a policy associated with the user, wherein the policy is different from an authentication credential associated with the user, the policy specifies spatial validity temporal validity, or both, of the passphrase, and wherein accessing the policy comprises receiving the policy from a second computer associated with property management of different hotels in a hotel brand or chain and the different hotels are located at different geographic locations; and
when one or more criteria associated with the policy are met, selectively providing an access acceptance message addressed to the computer, wherein the access acceptance message is intended for a second electronic device associated with the user and comprises information for establishing secure access of the second electronic device to a network.
2 . The electronic device of claim 1 , wherein the electronic device comprises an authentication, authorization, and accounting (AAA) server.
3 . The electronic device of claim 1 , wherein the passphrase parameters comprises: a random number associated with the second electronic device, a random number associated with a computer network device, the output of the cryptographic calculation, an identifier of the second electronic device, and an identifier of the computer network device.
4 . The electronic device of claim 3 , wherein the stored passphrase is included in stored passphrases, which are organized based at least in part on identifiers of different networks.
5 . The electronic device of claim 1 , wherein the policy comprises a time interval when the passphrase is valid.
6 . The electronic device of claim 1 , wherein the policy comprises a physical location where the passphrase is valid or the network that the user is allowed to access.
7 . The electronic device of claim 6 , wherein the interface circuit is configured to communicate with a third computer;
wherein the operations comprise communicating with the third computer to determine whether the second electronic device is associated with the location; and
wherein, when the second electronic device is associated with the location, the access acceptance message is selectively provided.
8 . The electronic device of claim 1 , wherein the network comprises a virtual network associated with a location, and the information in the access acceptance message allows the second electronic device to establish secure communication with the virtual network.
9 . The electronic device of claim 8 , wherein the virtual network comprises: a virtual local area network (VLAN) or a virtual extensible local area network (VXLAN).
10 . The electronic device of claim 8 , wherein the access acceptance message comprises an identifier of the virtual network; and
wherein the identifier comprises a virtual local area network identifier (VLANID) or a virtual network identifier (VNI).
11 . The electronic device of claim 10 , wherein the identifier comprises information that specifies one of more than 4,096 virtual networks.
12 . The electronic device of claim 1 , wherein the secure communication is independent of traffic associated with other users of the network.
13 . The electronic device of claim 1 , wherein the access request comprises a remote authentication dial-in user service (RADIUS) access request and the access acceptance message comprises a RADIUS access acceptance message.
14 . The electronic device of claim 1 , wherein the policy allows the user to access multiple networks at different locations.
15 . The electronic device of claim 14 , wherein the inputs used in the calculation of the one or more second outputs comprise a given identifier of a given network.
16 . The electronic device of claim 1 , wherein the passphrase is independent of an identifier associated with the second electronic device.
17 . The electronic device of claim 1 , wherein the passphrase is independent of the second electronic device or hardware in the second electronic device.
18 . A non-transitory computer-readable storage medium for use in conjunction with an electronic device, the computer-readable storage medium storing program instructions that, when executed by the electronic device, cause the electronic device to perform operations comprising:
receiving an access request associated with a computer, wherein the access request comprises passphrase parameters corresponding to a passphrase associated with a user, the passphrase parameters comprise inputs to a cryptographic calculation and an output of the cryptographic calculation, and the cryptographic calculation is associated with a pre-shared key (PSK) of the user;
calculating one or more second outputs of the cryptographic calculation based at least in part on the inputs, a passphrase and an identifier of the computer, which is included in the passphrase parameters;
when there is a match between one of the one or more second outputs and the output, accessing a policy associated with the user, wherein the policy is different from an authentication credential associated with the user, the policy specifies spatial validity temporal validity, or both, of the passphrase, and wherein accessing the policy comprises receiving the policy from a second computer associated with property management of different hotels in a hotel brand or chain and the different hotels are located at different geographic locations; and
when one or more criteria associated with the policy are met, selectively providing an access acceptance message addressed to the computer, wherein the access acceptance message is intended for a second electronic device associated with the user and comprises information for establishing secure access of the second electronic device to a network.
19 . A method for selectively approving secure access to a network, comprising:
by an electronic device:
receiving an access request associated with a computer, wherein the access request comprises passphrase parameters corresponding to a passphrase associated with a user, the passphrase parameters comprise inputs to a cryptographic calculation and an output of the cryptographic calculation, and the cryptographic calculation is associated with a pre-shared key (PSK) of the user;
calculating one or more second outputs of the cryptographic calculation based at least in part on the inputs, a stored passphrase and an identifier of the computer, which is included in the passphrase parameters;
when there is a match between one of the one or more second outputs and the output, accessing a policy associated with the user, wherein the policy is different from an authentication credential associated with the user, the policy specifies spatial validity temporal validity, or both, of the passphrase, and wherein accessing the policy comprises receiving the policy from a second computer associated with property management of different hotels in a hotel brand or chain and the different hotels are located at different geographic locations; and
when one or more criteria associated with the policy are met, selectively providing an access acceptance message addressed to the computer, wherein the access acceptance message is intended for a second electronic device associated with the user and comprises information for establishing secure access of the second electronic device to the network.
20 . The method of claim 19 , wherein the policy comprises a time interval when the passphrase is valid, a physical location where the passphrase is valid, or the network that the user is allowed to access.