Multi-factor authentication for IoT devices

Patent metadata

Field	Value
Publication number	US-12309582-B2
Application number	US-202218052013-A
Country	US
Kind code	B2
Filing date	Nov 2, 2022
Priority date	Nov 2, 2022
Publication date	May 20, 2025
Grant date	May 20, 2025

Abstract

Disclosed herein are systems, methods, and computer-readable media for enabling multi-factor authentication (MFA) for an Internet Of Things (IoT) device. In one aspect, a method includes receiving a network connection request from the IoT device to connect to a network. In one aspect, the method includes fetching authentication information for the device in response to the request. In one aspect, the method includes authenticating the device to the network. In one aspect, the method includes in response to the authentication of the device to the network, establishing a network connection between the IoT device and the network. In one aspect, the method includes applying the MFA policy. In one aspect, the method includes after successful compliance with the MFA policy establishing a session between the device and the application over the network.

First claim

What is claimed is:

1. A method for enabling multi-factor authentication (MFA) for an Internet Of Things (IoT) device, the method comprising:
receiving a network connection request from the IoT device to connect to a network;
fetching authentication information for the IoT device in response to the request,
wherein the authentication information includes subscription credentials to authenticate the IoT device to the network, and an MFA policy that defines a user or location restriction to authentication of the IoT device to an application accessed over the network;
authenticating the device to the network;
in response to the authentication of the device to the network, establishing a network connection between the IoT device and the network;
after the device is authenticated and the network connection is established between the IoT device and network, determining if a location restriction is satisfied;
in response to the location restriction being satisfied, applying the MFA policy; and
after successful compliance with the MFA policy establishing a session between the IoT device and the application over the network.

2. The method of claim 1 , wherein the network is a cellular network that utilizes an authentication and key management for applications (AKMA) to authenticate the IoT device to the cellular network.

3. The method of claim 2 , wherein the network is a 4 G network, a LTE network, a 5 G network.

4. The method of claim 1 , wherein the MFA policy defines an activation period, wherein the activation period determines whether the MFA policy is applied when authenticating the IoT device to the network, or when the IoT device attempts to connect to the application.

5. The method of claim 4 , further comprising:
when the activation period defined by the MFA policy is a delayed activation policy that requires that the MFA policies should be applied with the IoT device attempts to establish the session with the application; and
determining that the IoT device has requested to establish the session with the application before the MFA policy is applied.

6. The method of claim 1 , wherein the MFA policy defines a time parameter, the method further comprising: determining that the time parameter is satisfied before the MFA policy is applied.

7. The method of claim 1 , wherein the MFA policy defines the user restriction, wherein the user restriction defines at least one user to provide the MFA.

8. The method of claim 7 , wherein the user restriction defines a first user to provide the MFA at a first time or a first location, and a second user to provide the MFA at a second time or a second location.

9. The method of claim 1 , wherein the application is a plurality of applications, and the MFA policy defines a first MFA procedure for a first application of the plurality of applications, and a second MFA procedure for a second application of the plurality of applications.

10. The method of claim 1 , further comprising:
enforcing the MFA policy upon successful MFA authentication and providing an application key and an expiration time for the application key to an application function associated with the application of the IoT device.

11. The method of claim 1 , wherein the MFA policy defines a single sign-on policy, wherein the MFA policy requires a single MFA to permit the IoT device to establish sessions with multiple applications.

12. A device for enabling multi-factor authentication (MFA) for an Internet Of Things (IoT) device comprising:
a processor; and a memory storing instructions that, when executed by the processor, configure the device to:
receive a network connection request from the IoT device to connect to a network;
fetch authentication information for the IoT device in response to the request, wherein the authentication information includes subscription credentials to authenticate the IoT device to the network, and a MFA policy that defines a user or location restriction to authentication of the IoT device to an application accessed over the network;
authenticate the device to the network;
in response to the authentication of the device to the network, establish a network connection between the IoT device and the network;
in response to the location restriction being satisfied, after the device is authenticated and the network connection is established between the IoT device and network, determining if a location restriction is satisfied;
in response to the location restriction being satisfied, apply the MFA policy; and
after successful compliance with the MFA policy establish a session between the IoT device and the application over the network.

13. The device of claim 12 , wherein the network is a cellular network that utilizes an authentication and key management for applications (AKMA) to authenticate the IoT device to the cellular network.

14. The device of claim 12 , wherein the MFA policy defines an activation period, wherein the activation period determines whether the MFA policy is applied when authenticate the device to the network, or when the IoT device attempts to connect to the application.

15. The device of claim 12 , wherein the MFA policy defines a time parameter, the IoT device further configured to:
determine that the time parameter is satisfied before the MFA policy is applied.

16. The device of claim 12 , wherein the application is a plurality of applications, and the MFA policy defines a first MFA procedure for a first application of the plurality of applications, and a second MFA procedure for a second application of the plurality of applications.

17. The device of claim 12 , wherein the instructions further configure the device to:
enforce the MFA policy upon successful MFA authentication and providing an application key and an expiration time for the application key to an application function associated with the application of the IoT device.

18. A non-transitory computer-readable storage medium, the computer-readable storage medium including instructions that when executed by a computer, cause the computer to:
receive a network connection request from an IoT device to connect to a network;
fetch authentication information for the IoT device in response to the request, wherein the authentication information includes subscription credentials to authenticate the IoT device to the network, and a MFA policy that defines a user or location restriction to authentication of the IoT device to an application accessed over the network;
authenticate the device to the network;
in response to the authentication of the device to the network, establish a network connection between the IoT device and the network;
after the device is authenticated and the network connection is established between the IoT device and network, determining if a location restriction is satisfied;
in response to the location restriction being satisfied, apply the MFA policy; and
after successful compliance with the MFA policy establish a session between the IoT device and the application over the network.

Assignees

• Cisco Tech Inc

Inventors

• Viswambharan Rajesh Indira
• Ravindranath Ram Mohan
• Patil Prashanth

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04W12/63

  Location-dependent; Proximity-dependent · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title

• H04W12/06 Primary

  Authentication · CPC title