Apparatus, system, and method of federated authentication service (fas) for wireless communication roaming

An apparatus for a Federated Authentication Service (FAS) server, the apparatus comprising:

• one or more processors configured to cause the FAS server to:
• determine that authentication of a user of a mobile device is to be initiated according to an Extensible Authentication Protocol (EAP) over a Remote Authentication Dial-In User Service (RADIUS) over Transport Layer Security (RADSec) tunnel between the FAS server and an Access Network Provider (ANP) associated with the mobile device;
• identify at the FAS server an Identity Provider (IDP) for the user;
• based on identification of the IDP for the user, communicate with the IDP for the user via an authentication interface between the FAS server and the IDP for the user to trigger user authentication of the user with the IDP for the user;
• and
• based on a determination at the FAS server that the user is successfully authenticated with the IDP for the user, send an authentication success message to the ANP according to the EAP over the RADSec tunnel;
• and
• at least one memory to store information processed by the one or more processors.

One or more tangible computer-readable non-transitory storage media comprising instructions operable to, when executed by at least one processor, enable the at least one processor to cause a Federated Authentication Service (FAS) server to:

• determine that authentication of a user of a mobile device is to be initiated according to an Extensible Authentication Protocol (EAP) over a Remote Authentication Dial-In User Service (RADIUS) over Transport Layer Security (RADSec) tunnel between the FAS server and an Access Network Provider (ANP) associated with the mobile device;
• identify at the FAS server an Identity Provider (IDP) for the user;
• based on identification of the IDP for the user, communicate with the IDP for the user via an authentication interface between the FAS server and the IDP for the user to trigger user authentication of the user with the IDP for the user;
• and
• based on a determination at the FAS server that the user is successfully authenticated with the IDP for the user, send an authentication success message to the ANP according to the EAP over the RADSec tunnel.

An apparatus for a Federated Authentication Service (FAS) server, the apparatus comprising:

• means for determining that authentication of a user of a mobile device is to be initiated according to an Extensible Authentication Protocol (EAP) over a Remote Authentication Dial-In User Service (RADIUS) over Transport Layer Security (RADSec) tunnel between the FAS server and an Access Network Provider (ANP) associated with the mobile device;
• means for identifying at the FAS server an Identity Provider (IDP) for the user;
• means for causing the FAS sever to, based on identification of the IDP for the user, communicate with the IDP for the user via an authentication interface between the FAS server and the IDP for the user to trigger user authentication of the user with the IDP for the user;
• and
• means for causing the FAS sever to, based on a determination at the FAS server that the user is successfully authenticated with the IDP for the user, send an authentication success message to the ANP according to the EAP over the RADSec tunnel.