# US 2025/0097209 A1 · Wireless lan (wlan) public identity federation trust architecture > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0097209 A1 - Document ID: US20250097209A1 - Status: Published application - Kind: A1 - Application number: 18/966,765 - Filed: 2024-12-03 - Published: 2025-03-20 - Earliest claimed: 2020-01-14 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Malcolm Muir Smith; Bart Brinckman; Mark Grayson; Jerome Henry; Matthew Stephen MacPherson - Web page: https://patentgrep.com/patent/US20250097209A1 ## CPC - H04L 63/0815: {providing single-sign-on or federations} - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/0892: {by using authentication-authorization-accounting [AAA] servers or protocols} - H04L 63/102: {Entity profiles} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04W 12/06: Authentication - H04W 12/08: Access security - H04W 12/67: Risk-dependent, e.g. selecting a security level depending on risk profiles - H04L 63/10: {for controlling access to devices or network resources} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract The disclosed technology relates to a process of evaluating any number of different identity providers (IDPs) and their respective set of credentials that are used to authenticate corresponding users to assist with the onboarding of the different IDPs in connection with Wi-Fi identity federations. In particular, the process allows a person's electronic identity and attributes (stored across one or more IDPs) to be determined once using a standard. Once trust has been established for the user, that trust can then be utilized across a number of different systems (e.g., Single-sign on). The same trust determination can be used without the need for the authenticity of the user identity to be re-evaluated with each new access request. ## Claims ### Claim 1 A method for automatically authenticating a user device on a network, the method comprising: providing a request for the user device to access the network via an access point; receiving respective strength ratings of a plurality of authentication methods accepted by the access point and each authentication method of the plurality of authentication methods have respective strength ratings; evaluating a credential strength of the user device based on a strength rating of one or more authentication methods of the plurality of authentication methods used by the user device; and accessing the network based on the credential strength of the user device satisfying a pre-determined threshold. ### Claim 2 (depends on 1) The method of claim 1, wherein authentication methods include one or more of user name/password, authorization token, device certificate, SIM, email address, mobile phone, government identification, physical identification, local verification, biometrics, device certificate, authentication tokens, or location. ### Claim 3 (depends on 1) The method of claim 1, wherein the credential strength assigned to the user device is used by the user device to access the network via different access points without having to re-evaluate the credential strength of the user device. ### Claim 4 (depends on 1) The method of claim 1, further comprising: determining an identity provider; and retrieving the respective strength ratings of the plurality of authentication methods from the identity provider. ### Claim 5 (depends on 4) The method of claim 4, wherein the identity provider uses one or more of user name/password, authorization token, device certificate, or SIM to authenticate the user device. ### Claim 6 (depends on 4) The method of claim 4, wherein the identity provider uses one or more of email, mobile phone, government identification, physical identification, local verification, or biometrics to authenticate the user device. ### Claim 7 (depends on 1) The method of claim 1, wherein the credential strength of the user device decays after a pre-determined period of time. ### Claim 8 (depends on 7) The method of claim 7, wherein the decay is based on decay weights. ### Claim 9 (depends on 1) The method of claim 1, further comprising: identifying a plurality of alternative authentication methods, wherein each alternative authentication method is assigned a pre-determined weight; requesting additional information relating to one or more of the plurality of alternative authentication methods when an initial evaluation does not satisfy the pre-determined threshold; and evaluating the credential strength of the user device based on the requested additional information across two or more different identity providers associated with the user device. ### Claim 10 A system comprising: at least one processor; and a non-transitory computer-readable medium storing instructions that, when executed by the at least one processor, cause the system to: provide a request for a user device to access a network via an access point; receive respective strength ratings of a plurality of authentication methods accepted by the access point and each authentication method of the plurality of authentication methods have respective strength ratings; evaluate a credential strength of the user device based on a strength rating of one or more authentication methods of the plurality of authentication methods used by the user device; and access the network based on the credential strength of the user device satisfying a pre-determined threshold. ### Claim 11 (depends on 10) The system of claim 10, wherein authentication methods include one or more of user name/password, authorization token, device certificate, SIM, email address, mobile phone, government identification, physical identification, local verification, biometrics, device certificate, authentication tokens, or location. ### Claim 12 (depends on 10) The system of claim 10, wherein the credential strength assigned to the user device is used by the user device to access the network via different access points without having to re-evaluate the credential strength of the user device. ### Claim 13 (depends on 10) The system of claim 10, further comprising instructions which when executed causes the system to: determine an identity provider; and retrieve the respective strength ratings of the plurality of authentication methods from the identity provider. ### Claim 14 (depends on 13) The system of claim 13, wherein the identity provider uses one or more of user name/password, authorization token, device certificate, or SIM to authenticate the user device. ### Claim 15 (depends on 13) The system of claim 13, wherein the identity provider uses one or more of email, mobile phone, government identification, physical identification, local verification, or biometrics to authenticate the user device. ### Claim 16 (depends on 13) The system of claim 13, wherein the credential strength of the user device decays after a pre-determined period of time. ### Claim 17 (depends on 16) The system of claim 16, wherein the decay is based on decay weights. ### Claim 18 (depends on 10) The system of claim 10, further comprising instructions which when executed causes the system to: identify a plurality of alternative authentication methods, wherein each alternative authentication method is assigned a pre-determined weight; request additional information relating to one or more of the plurality of alternative authentication methods when an initial evaluation does not satisfy the pre-determined threshold; and evaluate the credential strength of the user device based on the requested additional information across two or more different identity providers associated with the user device. ### Claim 19 A device comprising: at least one processor; and a non-transitory computer-readable medium storing instructions that, when executed by the at least one processor, cause the device to: provide a request to access a network via an access point; receive respective strength ratings of a plurality of authentication methods accepted by the access point and each authentication method of the plurality of authentication methods have respective strength ratings; evaluate a credential strength of the device based on a strength rating of one or more authentication methods of the plurality of authentication methods used by the device; and access the network based on the credential strength of the device satisfying a pre-determined threshold. ### Claim 20 (depends on 19) The device of claim 19, wherein authentication methods include one or more of user name/password, authorization token, device certificate, SIM, email address, mobile phone, government identification, physical identification, local verification, biometrics, device certificate, authentication tokens, or location.