Extending secondary authentication for fast roaming between service provider and enterprise network

A method comprising:

• obtaining, by a network device, via a first access network, a request to authenticate a user device to establish another session with an enterprise network, the request including an identifier of an enterprise authentication device, wherein the enterprise authentication device stores an enterprise key for an established session of the user device with the enterprise network and wherein the established session is provided to the user device via a second access network;
• obtaining, by the network device from the enterprise authentication device, the enterprise key based on the enterprise authentication device correlating an identity of the first access network with an identifier of the established session of the user device with the enterprise network via the second access network;
• establishing, by the network device, the another session with the enterprise network based on the enterprise key, via the first access network, provided by a first service provider, that is configured to connect the user device to a communication network based on the user device performing a first primary authentication and further based on determining whether to connect the user device to the enterprise network based on a subscription policy that includes information indicating that a secondary authentication is to be made to connect the user device to the enterprise network, a current location of the user device, and an identity of the enterprise network, wherein:
• the second access network, provided by a second service provider different than the first service provider, is configured to connect the user device to the communication network based on the user device performing a second primary authentication different from the first primary authentication,
• the enterprise network is a private data network that involves the secondary authentication with the enterprise authentication device and a connection with the communication network, and
• the enterprise key is a master session key generated while performing an extensible authentication protocol (EAP) or an authentication and key agreement authentication (AKA) to authenticate the user device to access the enterprise network via the first access network;
• and
• skipping, by the network device, at least a portion of the EAP or the AKA for authenticating the user device to access the enterprise network via the first access network for establishing a connection to the enterprise network via the first access network, based on obtaining the enterprise key.

An apparatus comprising:

• a communication interface configured to enable network communications on a mobile network;
• a memory configured to store executable instructions;
• and
• a processor coupled to the communication interface and the memory and configured to perform operations including:
• obtaining, via a first access network, a request to authenticate a user device onto an enterprise network that is a private data network, wherein the user device is connected to the first access network by performing a primary authentication;
• determining, based on the performing the primary authentication, whether to connect the user device to the enterprise network, wherein the determining is further based on a subscription policy of the user device that includes information indicating that a secondary authentication is to be made to connect the user device to the enterprise network, a current location of the user device, and an identity of the enterprise network;
• in response to the determining, authenticating the user device to connect the user device with the enterprise network via the first access network by performing the secondary authentication;
• generating an enterprise key for the user device that enables the user device to access the enterprise network using a second access network that is different from the first access network and requires a separate primary authentication;
• providing, to the user device, the enterprise key for accessing the enterprise network via the second access network, wherein the enterprise key is a master session key generated while performing an extensible authentication protocol (EAP) or an authentication and key agreement authentication (AKA) to authenticate the user device to access the enterprise network via the first access network;
• and
• establishing a connection between the user device and the enterprise network via the second access network instead of the first access network by using the enterprise key and skipping at least a portion of the EAP or the AKA for authenticating the user device to access the enterprise network via the second access network.