Embodiments of the present disclosure provide methods and apparatus for authentication and authorization. A method at a session management function entity comprises determining whether to initiate a secondary authentication and/or authorization of a session of a terminal device after the terminal device moves from a first network to a second network or from the second network to the first network. The method further comprises, in response to a positive determination, send a first message to an authentication, authorization, and accounting, AAA, server to initiate the secondary authentication and/or authorization of the session of the terminal device.

A method for an access network of a telecommunications network includes: in a first step, a first authentication, authorization and accounting (AAA)-related message is sent by an authentication server entity and received by an access orchestrator entity, the first AAA-related message comprising: at least one standardized message attribute according to an access protocol; and at least one vendor-specific message attribute; in a second step, subsequent to the first step, the access orchestrator entity sends a second AAA-related message to a service edge entity, the second AAA-related message solely comprising the at least one standardized message attribute according to the access protocol; and in a third step, subsequent to the first step and prior to, during or after the second step, the access orchestrator entity sends at least one third AAA-related message to the service edge entity, the at least one third AAA-related message corresponding to a message according to an application programming interface (API) or to a further access protocol.

This disclosure is related to devices, systems, and techniques for controlling access to network services based on a trust ledger. In some examples, a trust broker system enables a relying party to control network service access of client device, where the trust broker system comprises one or more computing devices configured to maintain a trust ledger including a trust account balance (TAB) associated with each user of a set of users, where the TAB associated with each user of the set of users represents a value used to determine whether the respective user is permitted to access a resource.

Apparatuses, methods, and systems are disclosed for user authentication using a connection information package provided by a blockchain network. One apparatus includes a processor and a memory coupled to the processor, the memory comprising instructions executable by the processor to cause the apparatus to receive, from a smart contract, a set of connection information packages and to receive, from a first function, a request to authenticate a roaming user. The instructions are further executable by the processor to cause the apparatus to determine whether the first function is associated with a valid connection information package and to accept the request to authenticate the roaming user in response to the first function being associated with the valid connection information package.

A method for carrier network integration through a user proxy interface includes receiving a request from a mobile device associated with a subscriber of a carrier provider to establish voice services with the carrier provider for a companion device linked to the mobile device. The request includes a subscriber identifier of the mobile device. The method also includes authenticating the companion device based on the subscriber identifier, obtaining session initiation protocol (SIP) credentials corresponding to the subscriber identifier, and registering the SIP credentials for the companion device at a network interface proxy. The network interface proxy is in communication with an internet protocol multimedia subsystem (IMS) of the carrier provider and the companion device. The method also includes establishing voice services between the companion device and the IMS through the network interface proxy using the SIP credentials.

The disclosed technology provides solutions for performing rapid authentication and authorization for distributed containerized microservices. In some aspects, a process of the technology can include steps for: associating a service type with a set of microservices or service pods, detecting deployment of a first microservice on a first host, and receiving an authentication and authorization state from a first virtual network edge (VNE) of the first host. In some aspects, the process can further include steps for distributing the authentication state to a second VNE on a second host, wherein the authentication state is configured to facilitate authentication of one or more subsequent microservices instantiated on the second host by the second VNE. Systems and machine readable media are also provided.

Methods, systems, apparatuses, and computer program products are provided for automatically determining a home realm. An authentication request receiver interface may receive a request to access a resource and a device identifier from a client device. An authenticator may be enacted in response to receiving the request to access the resource that includes a home realm discoverer and an authentication user interface (UI) provider. The home realm discoverer may determine, based at least on the device identifier, the home realm from a plurality of realms. The authentication UI provider may provide, to the client device, an authentication UI via which a flat-name username can be submitted. Based at least on a flat-name user name and the determined home realm, access to the resource may be granted. In this manner, a user may input a flat-name username during sign-in, rather than inputting a realm or an entire e-mail address.

A method may include receiving a digital certificate through a secure connection from a network access server, the secure connection passing through a network address translation device, validating the digital certificate with a policy management system, and establishing a secure tunnel between the network access server and the policy management system when the digital certificate is validated. Also, receiving, through the secure tunnel and from the network access server, a remote authentication dial-in user service access request having a network access server internet protocol address, validating the network access server with the network access server internet protocol address by the policy management system, and allowing a remote authentication dial-in user service traffic when the internet protocol address of the network access server is validated and closing the secure tunnel when the validating the network access server fails.

An access control apparatus and method for controlling a configuration of an automation apparatus. The method includes: reading authentication information from an electronic tag; transmitting the authentication information to a networked service; receiving access rights from the networked service; and controlling the configuration of the automation apparatus according to the access rights.

The techniques herein are directed generally to providing access control and persona validation for interactions. In one embodiment, a method for a first device comprises: interacting with a second device on a communication channel; determining, over a verification channel with a verification service, that an identity of a user communicating on the second device is a verified identity according to the verification service; determining a persona of the user; querying a third-party entity to make a determination whether the persona is validated and to correspondingly determine a current privilege level; and managing interaction with the second device according to the determination whether the persona is validated and the corresponding current privilege level. Another embodiment comprises a verification server's perspective of facilitating the interaction between the first and second devices, where the verification server queries the third-party entity to validate the persona.