Federated Network Service Verification for Seamless Roaming
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wireless networking technologies face challenges in providing seamless network-based services to client devices when roaming, particularly in areas with suboptimal cellular connections, and there is a risk of access network providers spoofing service support.
Innovation Solution
A federation-based network system that uses identity providers to authenticate users and establish secure connections with service providers, ensuring that network-based services are actively provided by embedding assurance values in network traffic packets to verify service delivery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cellular services (4G LTE, 5G) are used for network connectivity, then mobile access is enabled, but connection quality deteriorates in locations that are indoors, far from cell towers, or obstructed
Solution Approach 1:
The patent introduces a federation-based network as an intermediary system between the client device and service provider. This intermediary provides alternative routing through Wi-Fi access points and identity providers, enabling connectivity when direct cellular service is poor while maintaining service quality through verified connections.
2Adaptability or versatility
If access network providers are allowed to support multiple services, then service versatility is improved, but the risk of spoofing service support increases
Solution Approach 1:
The patent implements a feedback mechanism where the client device receives assurance values from the service provider and verifies them against expected values. This feedback loop confirms that the service is genuinely being provided, preventing spoofing while allowing multiple services to be supported through the federation network.
3Ease of operation
If seamless network-based services are provided during roaming, then user connectivity is improved, but verification of service delivery becomes more complex
Solution Approach 1:
The patent uses assurance values that are copied from the service provider to the network traffic packets. These copied values serve as verification tokens that the client device can check without complex verification procedures, maintaining seamless connectivity while simplifying service verification.
4Reliability
If identity providers authenticate users in federation-based networks, then security is improved, but authentication overhead increases
Solution Approach 1:
The patent implements preliminary authentication where the identity provider authenticates the user's device before the user needs to access services. This preliminary action stores authentication results that can be reused for subsequent service accesses, improving security while reducing authentication overhead for actual service usage.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Aspects of the disclosure include a method and associated network device. The method includes authenticating an identity of a user of a client device after the client device is associated with an access network provider. Authenticating the identity of the user comprises receiving, from an identity provider, a credential associated with the identity, and receiving, from the identity provider, information identifying a network- based service to be applied to network traffic with the client device. The method further includes establishing, using the credential and the received information, a secure connection between the access network provider and a service provider that is capable of providing the network-based service. The method further includes receiving network traffic from the service provider. Packets of the network traffic include an assurance value that enables the client device to determine that the network-based service is being provided by the service provider.