Scalable public key identification model

A system comprising:

• a network access provider, which, in response to receipt of a request from a device for roaming access, connects to an identity entity at an address, wherein the request for roaming access identifies an authoritative identity provider host name;
• a device, which sends a request for roaming access;
• an identity entity, from which the network access provider receives a certificate and determines, using the certificate, whether the identity entity is an authoritative identity provider or a proxy for an authoritative identity provider;
• the network access provider, in response to determining that the identity entity is the authoritative identity provider, is programmed to:
• confirm that the authoritative identity provider host name matches data on the certificate;
• receive confirmation from the authoritative identity provider that the device can be properly identified by the authoritative entity provider;
• and
• grant the device roaming access to a network associated with the network access provider, in response to the network access provider accepting the certificate of the authoritative entity provider and the device identification confirmation from the authoritative entity provider;
• the network access provider, in response to determining that the identity entity is a proxy of the authoritative identity provider, is programmed to:
• receive confirmation from the proxy for the authoritative entity provider that the device can be properly identified by the proxy for the authoritative entity provider;
• and
• grant the device roaming access to a network associated with the network access provider, in response to the network access provider accepting the certificate of the proxy for the authoritative entity provider and the device identification confirmation from the proxy for the authoritative entity provider.

A method comprising:

• connecting to an identity entity at an address by a network access provider in response to receiving a request from a device for roaming access, wherein the request for roaming access identifies a host name of an authoritative identity;
• receiving a certificate from the identity entity;
• and
• determining, using the certificate, whether the identity entity is the authoritative identity provider or a proxy for the authoritative identity provider;
• in response to determining that the identity entity is the authoritative identity provider:
• confirm that the authoritative identity provider host name matches data on the certificate;
• receive confirmation from the authoritative identity provider that the device can be properly identified by the authoritative entity provider;
• and
• grant the device roaming access to a network associated with the network access provider, in response to the network access provider accepting the certificate of the authoritative entity provider and the device identification confirmation from the authoritative entity provider;
• in response to determining that the identity entity is a proxy of the authoritative identity provider:
• receive confirmation from the proxy for the authoritative entity provider that the device can be properly identified by the proxy for the authoritative entity provider;
• and
• grant the device roaming access to a network associated with the network access provider, in response to the network access provider accepting the certificate of the proxy for the authoritative entity provider and the device identification confirmation from the proxy for the authoritative entity provider.