# US 2025/0168633 A1 · Open roaming security enhancements > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0168633 A1 - Document ID: US20250168633A1 - Status: Published application - Kind: A1 - Application number: 18/517,309 - Filed: 2023-11-22 - Published: 2025-05-22 - Earliest claimed: 2023-11-22 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Robert E. BARTON; Jerome HENRY; Bhavik P. SHAH; Mark GRAYSON - Web page: https://patentgrep.com/patent/US20250168633A1 ## CPC - H04W 12/06: Authentication - H04W 12/40: Security arrangements using identity modules - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Techniques for enhancing the security of network access within an open roaming framework are provided. A first network device receives a request to authenticate connection of a user device to a network. The first network device retrieves security data associated with the network. Based on analyzing the security data associated with the network, the first network device determines that one or more security criteria are satisfied. The first network device transmits a response to the user device, where the response instructs the user device to establish a connection with the network and does not disclose the security data. ## Claims ### Claim 1 A method, comprising: receiving, at a first network device, a request to authenticate connection of a user device to a network; retrieving, by the first network device, security data associated with the network; determining, by the first network device, that one or more security criteria are satisfied based on analyzing the security data associated with the network; and transmitting, by the first network device, a response to the user device, wherein the response instructs the user device to establish a connection with the network and does not disclose the security data. ### Claim 2 (depends on 1) The method of claim 1, wherein: the first network device comprises an identify provider (IdP) that authenticates user devices based on one or more authentication protocols, and the request is received from an access network provider (ANP) that manages connections between user devices and the network. ### Claim 3 (depends on 2) The method of claim 2, wherein: the security data associated with the network is retrieved from a second network device, and the second network device is integrated into a federation-based system that comprises the IdP and the ANP, and periodically synchronizes the security data associated with the network within a database of the federation-based system. ### Claim 4 (depends on 2) The method of claim 2, wherein: the security data associated with the network is retrieved from a second network device, the second network device comprises an application programming interface (API) service, and retrieving, by the first network device, the security data associated with the network comprises transmitting, by the IdP, structured API calls to the second network device, in order to retrieve the security data associated with the network. ### Claim 5 (depends on 1) The method of claim 1, wherein the security data associated with the network comprises at least one of (i) a reputation score of the network, or (ii) a security profile of the network. ### Claim 6 (depends on 1) The method of claim 1, wherein determining, by the first network device, that the one or more security criteria are satisfied comprises determining, by the first network device, that a reputation score associated with the network exceeds a defined threshold. ### Claim 7 A method, comprising: receiving, at a first network device, a request to authenticate connection of a user device to a network; transmitting, by the first network device, a response to the user device, wherein the response comprises security data associated with the network; and upon receiving a confirmation from the user device to establish a connection with the network, proceeding to verify an identify of the user device. ### Claim 8 (depends on 7) The method of claim 7, wherein the first network device comprises an access network provider (ANP) that manages connections between user devices and the network. ### Claim 9 (depends on 8) The method of claim 8, wherein the security data associated with the network within the response comprises a reputation score that is cryptographically signed by a second network device. ### Claim 10 (depends on 9) The method of claim 9, wherein the user device, upon receiving the reputation score, verifies an integrity of the reputation score using a public key associated with the second network device. ### Claim 11 (depends on 9) The method of claim 9, wherein the user device compares the reputation score with a defined threshold, and upon determining that the reputation score exceeds the defined threshold, transmits the confirmation to the first network device, wherein the confirmation instructs the first network device to establish the connection with the network. ### Claim 12 (depends on 7) The method of claim 7, wherein: the first network device comprises an identify provider (IdP) that authenticates user devices based on one or more authentication protocols, and the request is received from an access network provider (ANP) that manages connections between user devices and the network. ### Claim 13 (depends on 12) The method of claim 12, further comprising, prior to transmitting the response to the user device, retrieving, by the first network device, the security data associated with the network from a second network device. ### Claim 14 (depends on 13) The method of claim 13, wherein the second network device is integrated into a federation-based system that comprises the IdP and the ANP, and periodically synchronizes the security data associated with the network within a database of the federation-based system. ### Claim 15 (depends on 13) The method of claim 13, wherein the second network device comprises an application programming interface (API) service, and wherein retrieving, by the first network device, the security data associated with the network from the second network device comprises transmitting, by the IdP, structured API calls to the second network device, in order to retrieve the security data associated with the network. ### Claim 16 (depends on 13) The method of claim 13, wherein the security data associated with the network comprises at least one of (i) a reputation score of the network, or (ii) a security profile of the network. ### Claim 17 (depends on 13) The method of claim 13, wherein: the user device, upon determining that one or more security criteria are satisfied, transmits the confirmation to the first network device, and the confirmation instructs the first network device to establish the connection with the network. ### Claim 18 A system comprising: one or more memories collectively storing computer-executable instructions; and one or more processors configured to collectively execute the computer-executable instructions and cause the system to: receive, at a first network device, a request to authenticate connection of a user device to a network; retrieve, by the first network device, security data associated with the network; determine, by the first network device, that one or more security criteria are satisfied based on analyzing the security data associated with the network; and transmit, by the first network device, a response to the user device, wherein the response instructs the user device to establish a connection with the network and does not disclose the security data. ### Claim 19 (depends on 18) The system of claim 18, wherein: the first network device comprises an identify provider (IdP) that authenticates user devices based on one or more authentication protocols, and the request is received from an access network provider (ANP) that manages connections between user devices and the network. ### Claim 20 (depends on 19) The system of claim 19, wherein: the security data associated with the network is retrieved from a second network device, and the second network device is integrated into a federation-based system that comprises the IdP and the ANP, and periodically synchronizes the security data associated with the network within a database of the federation-based system.