PROVIDING SECURITY SERVICES VIA FEDERATION-BASED NETWORK DURING ROAMING

Aspects described herein include a method and related network device and computer program product. The method includes authenticating an identity of a user of a client device associated with an access network provider. Authenticating the identity of the user includes receiving, from an identity provider, a credential associated with the identity and information identifying a network-based security service to be provided to the client device. The method further includes establishing, using the credential and the received information, a secure connection between the access network provider and a security service provider that is capable of providing the network-based security service to the client device.

TECHNICAL FIELD

Embodiments presented in this disclosure generally relate to wireless networking, and more specifically, to techniques for providing network-based security services to client devices when roaming.

BACKGROUND

Consumers increasingly expect their computing devices to remain connected to network-based services, regardless of their location. However, cellular services such as 4G LTE and 5G may provide less than optimal connections for certain locations that are indoors, far from cell towers, and/or otherwise obstructed. Technologies such as the Wireless Broadband Alliance's (WBA) OpenRoaming™ use a federation-based framework to allow consumers to seamlessly roam onto Wi-Fi networks.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Overview

One embodiment presented in this disclosure is a method comprising authenticating an identity of a user of a client device associated with an access network provider. Authenticating the identity of the user comprises receiving, from an identity provider, a credential associated with the identity, and receiving, from the identity provider, information identifying a network-based security service to be provided to the client device. The method further comprises establishing, using the credential and the received information, a secure connection between the access network provider and a security service provider that is capable of providing the network-based security service to the client device.

Another embodiment presented in this disclosure is a network device comprising one or more computer processors configured to perform an operation. The operation comprises authenticating an identity of a user of a client device associated with an access network provider. Authenticating the identity of the user comprises receiving, from an identity provider, a credential associated with the identity, and receiving, from the identity provider, information identifying a network-based security service to be provided to the client device. The operation further comprises establishing, using the credential and the received information, a secure connection between the access network provider and a security service provider that is capable of providing the network-based security service to the client device.

Another embodiment presented in this disclosure is a computer program product comprising a computer-readable storage medium having computer-readable program code embodied therewith. The computer-readable program code is executable by one or more computer processors to perform an operation comprising authenticating an identity of a user of a client device associated with an access network provider. Authenticating the identity of the user comprises receiving, from an identity provider, a credential associated with the identity, and receiving, from the identity provider, information identifying a network-based security service to be provided to the client device. The operation further comprises establishing, using the credential and the received information, a secure connection between the access network provider and a security service provider that is capable of providing the network-based security service to the client device.

Example Embodiments

Technologies such as OpenRoaming™ permit client devices to roam to different access network providers without requiring repeated logins or authentications. Identity providers may seek to offer additional services beyond roaming, such as providing network-based (e.g., cloud-based) security services to the client devices.

In embodiments described herein, a method comprises authenticating an identity of a user of a client device associated with an access network provider. Authenticating the identity of the user comprises receiving, from an identity provider, a credential associated with the identity, as well as information identifying a network-based security service to be provided to the client device. The method further comprises establishing, using the credential and the received information, a secure connection between the access network provider and a security service provider that is capable of providing the network-based security service to the client device.

Beneficially, the method allows users to enable and/or configure network-based security services at an identity provider. The method also enables the automatic, secure connectivity of client devices to third-party security service providers. The method also enables the security service providers to deliver security services that are tailored to the users by accessing the users' security policies configured at the identity provider.

FIG. 1is a diagram100illustrating connections of a client device105to a federation-based network115while roaming, according to one or more embodiments. The diagram100represents an example sequence of usage of a client device105by a user. For example, the sequence may represent a work trip of the user.

The client device105may be implemented in any form suitable for wireless networking. In some embodiments, the client device105is implemented as a mobile computing device, such as a laptop computer, a tablet, a smartphone, or a smart wearable device. In other embodiments, the client device105may be a computing device integrated into a vehicle.

At the beginning of the sequence, the user is at home110-1and the client device105is wirelessly connected to a home network (e.g., a Wi-Fi network) providing accessibility to an external network, such as a local area or local access network (LAN), a general wide area network (WAN), and/or a public network (e.g., the Internet). While the user is driving110-2a car, the client device105is wirelessly connected to a cellular network, such as a 4G LTE or 5G cellular network. When the user arrives at a corporate office110-3, the client device105roams from the cellular network to a Wi-Fi network operated by the corporate office110-3. The user returns to the car to conduct a customer call110-4, and the client device105reconnects to the cellular network when out of range of the Wi-Fi network. The client device105later roams to different Wi-Fi networks when the user visits a branch office110-5, a coffee shop110-6, and a hotel110-7.

When roaming to the different Wi-Fi networks (e.g., at the corporate office110-3, the branch office110-5, the coffee shop110-6, and the hotel110-7), the client device105uses a federation-based network115to access the external network. The federation-based network115may be implemented using any standardized and/or proprietary techniques and protocols. For example, the federation-based network115may be compliant with OpenRoaming™.

The federation-based network115comprises a plurality of access providers120(also referred to as “access network providers”) providing wireless connectivity for the client device105using, e.g., access points, wireless LAN controllers, and so forth. Some non-limiting examples of the access providers120include enterprise access providers122(e.g., employers, manufacturing facilities), consumer access providers124(e.g., hotels, retailers), public access providers126(e.g., airports, universities, venues), and so forth.

The federation-based network115comprises a plurality of identity providers130that operate to create, maintain, and/or manage identity information for users and that provide authentication services within the federation-based network115. Some non-limiting examples of the identity providers130include cloud providers132(e.g., vendors providing scalable computing resources), service providers134(e.g., telecommunications companies, utilities), and device manufacturers136. By using the identity providers130to authenticate the user, the client device105may roam to the different access providers120without requiring repeated logins or authentications from the user.

FIG. 2is a diagram200illustrating a sequence for connection of a client device105to a federation-based network, according to one or more embodiments. The features illustrated in the diagram200may be used in conjunction with other embodiments, for example, illustrating connection of the client device105with an access provider120at any of the corporate office110-3, the branch office110-5, the coffee shop110-6, or the hotel110-7illustrated inFIG. 1.

In the diagram200, an access provider205(one example of the access providers120ofFIG. 1) transmits a beacon220announcing one or more requirements for connecting the client device105to the access provider205. The beacon220may be implemented in any suitable form, such as an IEEE 802.11u beacon. In some embodiments, the beacon220indicates that the client device105must provide a private identification for the user. In other embodiments, the beacon220indicates that the client device105must provide only a public identification.

The client device105attaches225to the access provider205responsive to the beacon220(that is, the client device105establishes a connection with the access provider205), and the access provider205begins authentication of the user, e.g., via the Extensible Authentication Protocol (EAP) process, by communicating one or more acceptable credential types230to the client device105. The client device105may search a list of profiles stored thereon and may automatically select an identity235corresponding to an acceptable credential type230(e.g., a token, certificate, username/password, SIM, etc.) and that best matches the one or more requirements that had been specified by the access provider205(e.g., via the beacon220). In some embodiments, the identity235comprises elements of a Uniform Resource Locator (URL), such as a domain name. The client device105may select a best match using any suitable techniques.

The client device105provides the selected identity235to the access provider205, and the access provider205contacts a Domain Name Service (DNS) server210using the identity235. As shown in the diagram200, the identity235selected by the client device105is “bob@newco.com”, which may be a public identity or a private identity responsive on the beacon220transmitted by the access provider205. The access provider205looks up240“newco.com” with the DNS server210. Using the result from the DNS server210, the access provider205sets up an encrypted and authenticated Transport Layer Security (TLS) tunnel245to an identity provider215(one example of the identity providers130ofFIG. 1) corresponding to the selected identity235. The identity provider215provides an EAP authorization250using Remote Authentication Dial In User Service (RADIUS) attributes to the access provider205, and the access provider205provides an EAP authorization255to the client device105using EAP over LANs (EAPoL).

FIG. 3is a diagram300illustrating accessing a network-based security service, according to one or more embodiments. The features illustrated in the diagram300may be used in conjunction with other embodiments. For example, the client device305, the access provider325, and the identity provider360ofFIG. 3may be respective examples of the client device105, the access providers120, and the identity providers130ofFIG. 1.

In the diagram300, the client device305, the access provider325, the identity provider360, and a security service provider345are connected to a network320via respective communicative links385-1,385-3,385-2,385-4. Each of the client device305, the access provider325, the identity provider360, and the security service provider345may be respectively implemented as one or more computing devices in any suitable form(s). For example, the client device305may be implemented as a mobile computing device of a user, while the access provider325, the identity provider360, and the security service provider345may be implemented as server computers.

Each of the client device305, the access provider325, the identity provider360, and the security service provider345comprises a respective one or more computer processors310,330,365,350and a respective memory315,335,370,355. The one or more computer processors310,330,365,350may be implemented in any suitable form, such as a general purpose microprocessor, a controller, an application-specific integrated circuit (ASIC), and so forth. The memory315,335,370,355may include a variety of computer-readable media selected for their size, relative performance, or other capabilities: volatile and/or non-volatile media, removable and/or non-removable media, etc.

The network320(one example of the federation-based network115ofFIG. 1) represents one or more networks of any suitable types, such as the Internet, a local area network (LAN), a wide area network (WAN), and/or a wireless network. The communicative links385-1,385-2,385-3,385-4to the network320may have any suitable implementation, such as copper transmission cable(s), optical transmission fiber(s), wireless transmission, router(s), firewall(s), switch(es), gateway computer(s), and/or edge server(s).

The memory315,335,355,370may include one or more modules for performing various functions described herein. In one embodiment, each module includes program code that is executable by the one or more computer processors310,330,350,365. In another embodiment, each module is partially or fully implemented in hardware (i.e., circuitry) or firmware of the client device305, the access provider325, the identity provider360, and the security service provider345(e.g., as circuitry within the one or more computer processors310,330,365,350). However, other embodiments of the diagram300may include modules that are partially or fully implemented in other hardware or firmware, such as hardware or firmware included in one or more other computing devices connected with the network320, and so forth. Stated another way, the overall functionality of the one or more modules may be distributed among other devices of the diagram300.

As shown, the memory335of the access provider325comprises a security module340, the memory355of the security service provider345comprises a security services module356, and the memory370of the identity provider360comprises an identity services module372.

The security module340generally communicates with the client device305, the identity provider360, and the security service provider345to establish a secure connection with the security service provider345to provide one or more network-based security services for network traffic of the client device305.

The security services module356generally provides the one or more network-based security services for network traffic. In some embodiments, the security services module356provides cloud-based security services using distributed and/or scalable computing resources that may be provisioned and/or released on-demand. The security services module356may be implemented in any suitable form, such as a secure internet or web gateway. The one or more network-based security services may be of any suitable type(s), such as a firewall, a content filter, anti-malware, protection against known malicious sites, and so forth.

The identity services module372generally operates to create, maintain, and/or manage identity information for users. The identity services module372may further provide authentication services using the network320. In some embodiments, the identity services module372issues a credential375used for authenticating a user. The credential375may be implemented in any suitable form, such as a secure token that is unique for a particular session with the user. In some embodiments, the secure token comprises (i) a value provided by the identity provider360, (ii) an identifier of the identity provider360, and/or (iii) a value provided by the security service provider345. For example, the secure token may be implemented as a concatenation of (i), (ii), and (iii).

Each user is associated with one or more identities316. In some embodiments, the user configures one or more security policies380corresponding to the one or more identities316, and the one or more security policies380are stored with the identity provider360. Thus, the one or more security policies380may be predefined relative to when the client device305roams. Each security policy380specifies one or more security services (or security capabilities or features) to be applied when the corresponding identity316is selected. In some embodiments, the security policies380may specify a particular security service provider345to use, may specify a preferred order for selecting the security service provider345, and so forth. Each security policy380may be stored in any suitable format, such as YAML, XML, and so forth.

Thus, the identity provider360may be capable of offering cloud-based security services when the user roams to a capable access provider325. For example, the identity provider360may have a revenue sharing agreement with one or more security service providers345. In some embodiments, the identity provider360may offer multiple levels or tiers of security that are selectable by the user.

Each of the identities316associated with the user may be associated with a set of one or more cloud-based security services. The identities316may be sorted or prioritized based on user preferences. Further, the cloud-based security services may be selected and/or purchased directly by the user, or may be offered directly by the access provider325.

FIG. 4is a method400of accessing a network-based security service, according to one or more embodiments. The method400may be used in conjunction with other embodiments. For example, the method400may be performed by the security module340ofFIG. 3. Further, the method400will be described in conjunction with diagrams500,510,530,545,560,575ofFIGS. 5A-5F.

The method400begins at block405, where a user configures a security policy. In some embodiments, the security policy specifies one or more security services to be applied when a particular identity associated with the user is selected. The security policy may be stored with the identity provider.

In the diagram500ofFIG. 5A, the user operates the client device305to configure the security policy. In some alternate implementations, the user may use another computing device to configure the security policy. As shown, the client device305communicates with the identity provider360through the network320(that is, communications505) to specify the one or more security services for the security policy. The security policy is associated with the identity316and is stored with the identity provider360.

In other embodiments, the user may associate the security services to roaming connections generally. This may be applicable where the identity provider does not offer security service(s), where the user purchases the security service(s) directly, or where the access provider offers the security service(s) directly. In other embodiments, the identity provider may be an enterprise and associates the security service(s) for the employees.

At block415, a client device associates with an access network provider. In the diagram510ofFIG. 5B, the client device305communicates with the access provider325through the network320(that is, communications515) to determine whether the access network provider supports network-based security services.

In some embodiments, associating the client device comprises receiving a query from the client device at block420, and responding with information indicating that the access network provider supports a network-based security service at block425. In the diagram510, the communications515comprise a query520and a response525, which in some cases may be compliant with Access Network Query Protocol (ANQP).

In some embodiments, the client device305may preferentially connect to access network providers (e.g., the access provider325) that support the security service for the security policy. In some embodiments, the access network provider may provide further information (e.g., advertising) that the access network provider supports the security service through the particular security service provider345. The client device305may preferentially connect to access network providers (e.g., the access provider325) based on the particular security service provider345.

At block435, the access provider authenticates an identity of a user of the client device. In some embodiments, authenticating the identity of the user comprises at block440receiving a credential associated with the identity from the identity provider, and at block445receiving information identifying a network-based security service to be provided to the client device from the identity provider.

In some embodiments, during the association process the access provider relays EAP traffic to the identity provider to permit the identity provider to verify the credential of the user. If the authentication by the access provider is successful, the identity provider returns instructions to the access provider, e.g., by RADIUS attributes in RadSec. The instructions inform the access provider that the user has subscribed to the security service.

In the diagram530ofFIG. 5C, the access provider325communicates with the identity provider360through the network320(that is, communications535). In the diagram530, the communications535comprise the access provider325receiving the credential375for the user and service information540identifying a network-based security service to be provided to the client device305. In some embodiments, the service information540further comprises specifying the security service provider345to be used to provide the network-based security service. For example, the service information540may include a network address (e.g., an anycast address) that identifies the security service provider345, e.g., where the identity provider360and the security service provider345have a pre-existing and trusted relationship. In some embodiments, a plurality of security service providers345may be available to provide the network-based security service, and a RADIUS option dialog may be used to determine the security service provider345that is both accepted by the client device305and supported by the access provider325.

At block455, the access provider establishes, using the credential and the received information, a secure connection between the access provider and the security service provider that is capable of providing the network-based security service to the client device. In some embodiments, the secure connection comprises a virtual private network (VPN). In some embodiments, establishing the secure connection comprises (at block460) transmitting (i) information identifying the identity provider and (ii) the credential to the security service provider. The method400ends following completion of the block455.

In the diagram545ofFIG. 5D, the access provider325communicates with the security service provider345through the network320(that is, communications550). In the diagram545, the communications550comprise the security service provider345receiving the credential375and identity provider information555. The identity provider information555identifies the identity provider360, and the credential375and the identity provider information555configure the security service provider345to retrieve, from the identity provider360, a security policy for the identity.

In some embodiments, the access provider325receives a RADIUS Access-Accept response from the identity provider360. The access provider325uses the service information540(e.g., the RADIUS attributes) to establish a secure connection to the security service provider345. In some embodiments, the access provider325provides the security service provider345with the credential375, and the identity provider information555indicates which identity provider360realm or domain that the user belongs to.

In the diagram560ofFIG. 5E, a VPN connection565is established between the access provider325and the security service provider345. In some embodiments, the security service provider345examines the request from the access provider325, and communicates with the identity provider360through the network320(that is, communications570).

The security service provider345contacts the identity provider360to retrieve the security policy380associated with the identity and/or the user. The identity provider360responds by challenging the security service provider345to provide the credential375. The identity provider360returns the security policy380responsive to receiving the credential375, which verifies the request from the access provider325.

In some embodiments, on the access provider325the proxy isolates the traffic from the client device305and redirects it through the VPN connection565, ensuring that all traffic originating from the client device305, e.g., is transmitted through the cloud firewall. In the diagram575ofFIG. 5F, the security service provider345receives the security policy380and applies the security service(s) specified by the security policy380to a connection580of the client device305. In the diagram575, the client device305connects to an external network590(e.g., the internet) via a connection585between the security service provider345and the external network590, and the security service provider345applies the security service(s) to the connection585.

In some embodiments, for future instances of the client device305roaming to the same access provider325, the information used to apply the security service(s) may be cached to accelerate the connection process.

In some alternate embodiments, the identity provider360may, responsive to the successful authentication of the user, contact the security service provider345and provide the credential375prior to an incoming request from the access provider325. In some embodiments, the credential375comprises a secure token implemented as a concatenation of a value provided by the identity provider360, an identifier of the identity provider360, and a value provided by the security service provider345. The access provider325uses the credential375to establish the secure connection with the security service provider345.

At the conclusion of the session, the access provider325and/or the security service provider345may collect logs of the transaction, which may be shared with the identity provider360.

In some alternate embodiments, the security service(s) may be provided directly by the access provider325, e.g., responsive to determining that none of the identities of the user support the security service(s). For example, following the query from the client device (e.g., block420of the method400) and successful authentication (without the identity provider360specifying the security service provider345), the access provider325uses the advice of charge ANQP message to suggest the security service(s) to the user, which in some cases may also specify different security service provider(s) and/or options. Responsive to receiving the user selection of a security service provider345and one or more security services, the access provider325establishes the secure tunnel as in block455of the method400.

In these embodiments, the access provider325is responsible to generate the VPN credentials for the user, which in some cases may be a token associated to the advice of charge communicated to the user over ANQP. The client device305stores the token matching the charge for that session, which can then be verified against the security service provider345and the accounting database for the access provider325.