Services provided by companies or public sector departments often require people to register themselves, i.e. to create an account. Such registration usually involves the provisioning of users’ authentication credentials, usually a username and password. Centralized Identity Providers (IdPs) appeared to reduce the users’ burden regarding account management. They permitted to evolve from a so-called silo approach (where services do not share accounts) to accounts that can be shared by a set of federated services. Nowadays, popular Internet services such as Google and Facebook, which authenticate millions of people, and keep some relevant user identity attributes in their accounts, are often used as IdPs. These IdPs were conceived for web authentication, using HTTP-based protocols and standards such as SAML, and more recently OAuth2.0 and OpenID Connect, which offer powerful authentication and authorization capabilities. This work explores those capabilities and describes solutions that allow their combination with VPN and WiFi authentication mechanisms. Having the identity and access management functionalities of IdP web authentication available in network access control mechanisms can provide stronger authentication and authorization policies, improve the user experience and simplify management, which consequently aims for enhancing security.

As hotspot networks are increasingly present and used, the amount of sensitive information that is transmitted in this type of network and the fact that users might not be trustworthy leads to the need for existence of security mechanisms that can guarantee, at least, confidentiality and integrity of the users’ transmitted data, as well as the authentication of these networks in order to avoid malicious ones. The majority of public hotspots work based on captive portals and require "authentication", which is not always a secure one (through a captive portal) however, captive portals can be explored in order to be used in conjunction with different technology to provide more secure solutions. This works studies the 802.1X architecture and the way it is used, it also studies captive portals and the different ways that public hotspots provide Internet to its users. The goal of this work is to develop an application that will allow users to register themselves in a system, seamlessly provide them with asymmetric credentials and configure a Wi-Fi connection to a secure network. The registration in this system and the download of the application are done through a captive portal. The users can then authenticate in the secure Wi-Fi network that was configured in their devices, this network is an extension of the EAP method, namely TLS, to authenticate the users according to the credentials that were given to them. This network also allows for authentication, authorization and accounting of its users, it will also allow users that registered in a given captive portal to use the network in any place where it is provided.

In a scenario where hotspot wireless networks are increasingly being used, and given the amount of sensitive information exchanged on Internet interactions, there is the need to implement security mechanisms that guarantee data confdentiality and integrity in such networks, as well as the authenticity of the hotspot providers. However, many hotspots today use Captive Portals, which rely on authentication through Web pages (thus, an application-level authentication approach) instead of a link-layer approach. The consequence of this is that there is no security in the wireless link to the hotspot (it has to be provided at upper protocol layers), and is cumbersome to manage wireless access profles (we need special applications or browsers’ add-ons to do that). This work exposes the weaknesses of the Captive Portals’ paradigm, which does not follow a unique nor standard approach, and describes a solution that intends to suppress them, based on the 802.1X architecture. It relies on EAP-SH (extended authentication protocol for secure hotspots), a new EAPcompliant protocol that is able to integrate a Web-based registration or authentication with a Captive Portal within the 802.1X authentication framework. This work describes its design, implementation and prototype evaluation.