Wireless multi-factor authentication with captive portals

• US 9,088,891 B2
• Filed: 08/13/2012
• Issued: 07/21/2015
• Est. Priority Date: 08/13/2012
• Status: Active Grant

• Current Assignee: Wells Fargo Bank NA (Wells Fargo & Company), Wells Fargo NA (Wells Fargo & Company)
• Original Assignee: Wells Fargo Bank NA (Wells Fargo & Company)
• Inventors: Belton, Lawrence T., Beaty, Brian, Morris, Timothy H., Rodgers, Douglas S., Smith, Lynn Allen
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): Ambaye, Samuel
• Application Number:
  US13/584,406
• Publication Number:
  US 20140047510A1
• Time in Patent Office: 1,072 Days
• Field of Search: 726 1- 10, 370/310, 370/329
• US Class Current: 1/1
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 Access security

Abstract

Systems and methods for device-agnostic, multi-factor network authentication are disclosed. In some embodiments, a wireless network connection can authenticate a device over secure authentication means with a certificate that confirms a device identity. After authenticating the device, a user can be prompted to provide credentials in a captive portal. The captive portal can be inaccessible to devices that have not already authenticated using a certificate. After providing approved credentials to the captive portal, the user can access the network. This embodiment and additional embodiments are readily integrated into private wireless networks and others.

Claims

1. A method for authenticating a device to a wireless network, comprising:

performing a first authentication to identify the device;

performing a second authentication to identify a user of the device based on a determination of the identity of the device;

re-performing the first authentication to identify the device based on a determination that a number of attempts to identify the user of the device has exceeded a maximum number of attempts; and

granting access to the wireless network based on a determination that the number of attempts to identify the user of the device has not exceeded the maximum number of attempts;

associating a subnetwork with the device, the subnetwork restricts transmission and reception by the device prior to completion of at least one of the first authentication or the second authentication;

wherein at least one of the performing the first authentication and the performing the second authentication is performed over the subnetwork.

2. The method of claim 1, wherein at least one of the performing the first authentication, the performing the second authentication, or the re-performing the first authentication comprises receiving a wireless security key.

3. The method of claim 1, wherein the performing the first authentication comprises receiving a certificate provisioned based at least in part on the device identity.

4. The method of claim 3, wherein the performing the first authentication comprises using the certificate to identify the device.

5. The method of claim 3, further comprising managing the certificate in accordance with a proprietary certificate manager resident on the device.

6. The method of claim 1, wherein the performing the second authentication comprises receiving a manual input from the user.

7. The method of claim 1, wherein the second authentication is inaccessible to the device until successful completion of the first authentication.

8. The method of claim 1, wherein the performing the first authentication comprises utilizing a version of at least one of 802.1X, WiFi Protected Access, or Extensible Authentication Protocol.

9. The method of claim 1, wherein the performing the first authentication and the performing the second authentication are accomplished using standardized, generic, or embedded modules.

10. A system for authenticating a device to a network, comprising:

a first authentication component that determines an identity of a device;

a captive portal that accepts at least one input, wherein the captive portal is automatically displayed based on a determination of the identity of the device; and

a second authentication component that identifies a user of the device within a determined number of attempts to identify the user, wherein the system rolls back to the first authentication component to identify the device based on a determination that the number of access attempts exceeds the determined number of attempts to identify the user;

wherein the captive portal is implemented with multiple versions, and wherein a version from the multiple versions is selected based at least in part on the device.

11. The system of claim 10, wherein the captive portal is inaccessible to an unidentified device.

12. The system of claim 10, wherein the captive portal transmits and receives utilizing encryption.

13. The system of claim 10, wherein an interface for the captive portal is launched through a web browser.

14. The system of claim 13, wherein the interface for the captive portal meets one or more non-proprietary standards.

15. The system of claim 10, wherein the first authentication component evaluates a certificate associated with the device.

16. A device-agnostic system for authenticating a client to a network, comprising:

means for associating a client machine to a first connection;

means for verifying an identity of the client machine via the first connection;

means for associating the client machine to a second connection;

means for verifying an identity of a user associated with the client machine via the second connection based on a determination that a number of attempts to verify the identity of the user is less than a determined number of attempts, wherein the device-agnostic system rolls back to the means for verifying the identity of the client machine based on another determination that the number of attempts to verify the identity of the user exceeds the determined number of attempts; and

means for associating the client machine to at least a third connection based on verification of the identity of the user;

means for associating a subnetwork with the device, the subnetwork restricts transmission and reception by the device prior to completion of at least one of the first authentication or the second authentication;

wherein at least one of the performing the first authentication and the performing the second authentication is performed over the subnetwork.

17. The system of claim 16, wherein the first connection is a WiFi connection, the second connection is a subnetwork, and the third connection is an organizational network.