Guest onboarding of devices onto 3GPP-based networks with use of realm-based discovery of identity providers and mutual authentication of identity federation peers

A computer program product comprising:

• a non-transitory computer readable medium;
• and
• instructions stored in the non-transitory computer readable medium;
• the instructions being executable by one or more processors for facilitating an authentication of a device by an identity provider to permit or deny guest access of the device in a Third Generation Partnership Project (3GPP) based network, by:
• receiving, from the device, a message which requests access to the 3GPP-based network;
• obtaining, from the message, an identity associated with the device;
• deriving a realm name of a realm from information in the identity, wherein the realm differs from a realm of the 3GPP-based network;
• obtaining, from a response to one or more queries to a domain name system (DNS) server, an address of a server that is mapped to the realm name and provides an authentication service for the authentication, the server being external to the 3GPP-based network and associated with the identity provider which is registered in an identity federation;
• subsequent to obtaining the address of the server, establishing a secure connection with the server using the address obtained from the DNS server;
• participating in an authentication procedure over the secure connection using the authentication service of the server, for authenticating the device based on credentials associated with the identity;
• and
• permitting or denying the guest access of the device in the 3GPP-based network based on a result of the authentication procedure and the identity, a permanent identity or other attributes received from the identity provider in the authentication procedure.

A Third Generation Partnership Project 3GPP-based network comprising:

• one or more 3GPP base stations for communication with a device;
• and
• a control plane function for mobility management and/or proxy thereof which is operative to facilitate an authentication of the device by an identity provider to permit guest access of the device in the 3GPP-based network, by being configured to:
• receive, from the device, a message which requests access to the 3GPP-based network;
• obtain, from the message, an identity associated with the device;
• derive a realm name of a realm from information in the identity, wherein the realm differs from a realm of the 3GPP-based network;
• obtain, from a response to one or more queries to a domain name system (DNS) server, an address of a server that is mapped to the realm name and provides an authentication service for the authentication, the server being external to the 3GPP-based network and associated with the identity provider which is registered in an identity federation;
• subsequent to obtaining the address of the server, establish a secure connection with the server using the address obtained from the DNS server;
• participate in an authentication procedure over the secure connection using the authentication service of the server for authenticating the device based on credentials associated with the identity, for permitting the guest access of the device in the 3GPP-based network;
• and
• apply one or more policies for the guest access or communications of the device in the 3GPP-based network based on the identity or a permanent identity or other attributes received from the identity provider in the authentication procedure.