US 12,267,314 B2
Service assurance via federation-based network during roaming
Nagendra Kumar Nainar, Morrisville, NC (US); Robert E. Barton, Richmond (CA); Carlos M. Pignataro, Cary, NC (US); Jerome Henry, Pittsboro, NC (US); and Bart A. Brinckman, Nevele (BE)
Assigned to Cisco Technology, Inc., San Jose, CA (US)
Filed by Cisco Technology, Inc., San Jose, CA (US)
Filed on Jan. 16, 2024, as Appl. No. 18/414,137.
Application 18/414,137 is a continuation of application No. 17/445,295, filed on Aug. 17, 2021, granted, now 11,924,190.
Prior Publication US 2024/0154947 A1, May 9, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 29/06 (2006.01); H04L 9/40 (2022.01); H04W 12/06 (2021.01); H04W 36/00 (2009.01)
CPC H04L 63/0815 (2013.01) [H04L 63/04 (2013.01); H04L 63/20 (2013.01); H04W 12/06 (2013.01); H04W 36/0038 (2013.01)] 19 Claims
OG exemplary drawing
 
1. A method comprising:
authenticating an identity of a user of a client device after the client device is associated with an access network provider separate from the client device, wherein authenticating the identity of the user comprises:
receiving, by the access network provider and from an identity provider separate from the client device and the access network provider, a credential associated with the identity; and
receiving, from the identity provider, information identifying a network-based service to be applied to network traffic with the client device;
establishing, using the credential and the received information, a secure connection between the access network provider and a service provider that is capable of providing the network-based service, wherein the access network provider is separate from the service provider;
receiving, at the access network provider and over the secure connection, network traffic from the service provider, wherein packets of the network traffic include assurance information that enables the client device to determine that the network-based service is being provided by the service provider, and wherein the assurance information is determined using a function based on a first token communicated by the identity provider to the service provider and the client device; and
communicating, by the access network provider, the network traffic to the client device, wherein characterization information of the network traffic is communicated from the client device to the service provider through a channel (i) between the client device and the service provider and (ii) separate from the secure connection, and wherein the service provider communicates to the client device a response indicating whether the characterization information is present in a cache table of the service provider.