Implementing service level agreements in an identity federation

Patent metadata

Field	Value
Publication number	US-11627498-B2
Application number	US-202117148146-A
Country	US
Kind code	B2
Filing date	Jan 13, 2021
Priority date	Oct 29, 2020
Publication date	Apr 11, 2023
Grant date	Apr 11, 2023

Abstract

Embodiments herein describe techniques for dynamically negotiating an SLA between a roaming device and a VN in an identity federation. Instead of an IDP having to individually negotiate with a VN to decide on an SLA before a user device roams to the VN, the parties can dynamically negotiate the SLA after the user device has detected the VN (but before the device is permitted to connect or associate with the VN). In one embodiment, when a roaming user device comes within wireless range of a VN, the roaming device receives an advertisement from the VN that indicates the current SLA (or SLAs) offered by the VN. The roaming device can compare this offered SLA to a stored SLA in an identity profile the device received from the IDP to determine whether to accept the offer. In another embodiment, the SLA is instead negotiated between VN and the IDP.

First claim

We claim:

1. A method, comprising:
selecting a first service level agreement (SLA) criteria provided by an identity provider (IDP) for a user device;
receiving, at the user device, an advertisement from a visited network (VN) indicating an SLA supported by the VN, wherein the advertisement is received before the user device has associated with the VN, and wherein the IDP and the VN are part of a same identity federation; and
upon determining the SLA supported by the VN satisfies the first SLA criteria, transmitting an acceptance from the user device to the VN and associating the user device with the VN.

2. The method of claim 1 , further comprising, before transmitting the acceptance:
receiving, at the user device, the first SLA criteria from the IDP.

3. The method of claim 2 , wherein the first SLA criteria is stored in an identity profile in the user device that was received from the IDP, the identity profile further comprising identity information used by the VN to authenticate the user device with the IDP.

4. The method of claim 3 , wherein the user device attaches to the VN only after the VN has authenticated the user device with the IDP based on the identity information.

5. The method of claim 1 , wherein the VN comprises a Wi-Fi network and the user device is a wireless device.

6. The method of claim 1 , further comprising:
upon determining the SLA supported by the VN does not satisfy the first SLA, outputting at least one of a graphical user interface (GUI) or audio message to a user of the user device, the GUI or audio message indicating differences between the first SLA criteria and the SLA supported by the VN; and
receiving, after outputting the GUI or audio message, input from the user whether to agree to the SLA supported by the VN in order to attach the user device to the VN.

7. A non-transitory computer readable medium having program instructions embodied therewith, the program instructions executable by a processor to perform an operation, the operation comprising:
selecting a first SLA criteria provided by an IDP for a user device;
receiving, at the user device, an advertisement from a VN indicating an SLA supported by the VN, wherein the advertisement is received before the user device has associated with the VN, and wherein the IDP and the VN are part of a same identity federation; and
upon determining the SLA supported by the VN satisfies the first SLA criteria, transmitting an acceptance from the user device to the VN and associating the user device with the VN.

8. The non-transitory computer readable medium of claim 7 , wherein the operation further comprises, before transmitting the acceptance:
receiving, at the user device, the first SLA criteria from the IDP.

9. The non-transitory computer readable medium of claim 8 , wherein the first SLA criteria is stored in an identity profile in the user device that was received from the IDP, the identity profile further comprising identity information used by the VN to authenticate the user device with the IDP.

10. The non-transitory computer readable medium of claim 9 , wherein the user device attaches to the VN only after the VN has authenticated the user device with the IDP based on the identity information.

11. The non-transitory computer readable medium of claim 7 , wherein the operation further comprises:
upon determining the SLA supported by the VN does not satisfy the first SLA criteria, outputting at least one of a graphical user interface (GUI) or audio message to a user of the user device, the GUI or audio message indicating differences between the first SLA criteria and the SLA supported by the VN.

12. The non-transitory computer readable medium of claim 11 , wherein the operation further comprises:
receiving, after outputting the GUI or audio message, input from the user whether to agree to the SLA supported by the VN in order to attach the user device to the VN.

13. A method, comprising:
determining that a user device is attempting to attach to a VN, wherein the user device has previously been provisioned by an IDP, and wherein the IDP and the VN are part of a same identity federation;
negotiating, between the IDP and the VN, an SLA for the user device before the user device has attached to the VN; and
permitting the user device to attach to the VN after the VN has authenticated the user device using the IDP and the SLA has been agreed upon.

14. The method of claim 13 , wherein negotiating the SLA for the user device comprises:
receiving, at the VN, a first SLA criteria transmitted by the IDP, wherein the first SLA criteria was previously selected by the user device when being provisioned by the IDP; and
transmitting an indication from the VN to the IDP indicating whether the VN can meet a plurality of requirements of the first SLA criteria.

15. The method of claim 13 , wherein negotiating the SLA for the user device comprises:
receiving, at the VN, a first SLA criteria transmitted by the IDP, wherein the first SLA criteria was previously selected by the user device when being provisioned by the IDP; and
transmitting a counteroffer from the VN to the IDP after determining the VN cannot satisfy a plurality of SLA requirements in the first SLA criteria.

16. The method of claim 15 , wherein negotiating the SLA for the user device comprises:
transmitting, for user approval, a modified SLA from the IDP to the user device based on the counteroffer, wherein the modified SLA is different from the first SLA criteria.

17. The method of claim 13 , further comprising, before permitting the user device to attach to the VN:
transmitting the SLA to the user device for user approval.

18. The method of claim 13 , wherein authenticating the user device using the IDP comprises:
receiving identity information from the user device at the VN, wherein the identity information indicates the IDP associated with the user device; and
authenticating, based on the identity information, the user device by communicating between the VN and the IDP.

19. The method of claim 13 , wherein the VN comprises a Wi-Fi network and the user device is a wireless device.

20. The method of claim 13 , wherein negotiating the SLA for the user device comprises:
transmitting a first SLA criteria from the VN to the IDP; and
receiving an indication from the IDP whether the first SLA criteria satisfies a second SLA stored in the IDP that was previously selected by the user device when being provisioned by the IDP.

Assignees

• Cisco Tech Inc

Inventors

• Smith Malcolm M
• Henry Jerome
• Grayson Mark
• Barton Robert E
• Brinckman Bart A

Classifications

• H04W8/22

  Processing or transfer of terminal data, e.g. status or physical capabilities · CPC title

• H04W28/24 Primary

  Negotiating SLA [Service Level Agreement]; Negotiating QoS [Quality of Service] · CPC title

• H04W84/12

  WLAN [Wireless Local Area Networks] · CPC title

• H04W12/06

  Authentication · CPC title

• H04W48/18

  Selecting a network or a communication service · CPC title