System and method for providing security backup services to a home network

• US 20070250596A1
• Filed: 04/25/2006
• Published: 10/25/2007
• Est. Priority Date: 04/25/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Baugher, Mark
• Granted Patent: US 7,730,181 B2
• Time in Patent Office: Days
• US Class Current: 709/218
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/2898 Subscriber equipments DSL modems H04M11/062; cable modems H04L12/2801
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/303 Terminal profiles

Abstract

Methods and systems of providing security backup services to a home network are described. In one embodiment, the gateway for a home network is registered with a service provider. A network device is enrolled with the home network, and periodically reenrolls. The device detects whether the gateway has been replaced between enrolling and reenrolling, and if it has been replaced, determines whether the new network gateway has been endorsed by the service provider.

Claims

1. A method of providing security backup services to a home network comprising:

registering a network gateway for said home network with a service provider;

enrolling a network device with said home network;

reenrolling said network device with said home network;

detecting if said network gateway has been replaced between said enrolling and said reenrolling; and

if said network gateway has been replaced, determining if said network gateway has been endorsed by said service provider.

2. The method of claim 1, wherein said registering a network gateway comprises receiving a service provider credential uniquely identifying said service provider.

3. The method of claim 2, wherein said enrolling a network device comprises receiving said service provider credential from said network gateway into said network device, and storing said service provider credential as a stored service provider credential.

4. The method of claim 3, wherein said enrolling a network device further comprises receiving a network gateway credential from said network gateway into said network device, said network gateway credential uniquely identifying said network gateway, and storing said network gateway credential as a stored network gateway credential.

5. The method of claim 3, wherein said reenrolling comprises receiving a current service provider credential from said network gateway into said network device.

6. The method of claim 5, wherein said detecting comprises comparing said current service provider credential with said stored service provider credential.

7. A system for providing security backup services to a home network comprising:

means for enrolling a network device with a network gateway for said home network, said enrolling comprising receiving a first service provider certificate and a first gateway certificate;

means for reenrolling said network device with said network gateway, said reenrolling comprising receiving a second service provider certificate and a second gateway certificate;

means for comparing said first service provider certificate with said second service provider certificate, to determine whether a service provider for said home network has changed between said enrolling and said reenrolling; and

means for determining if said network gateway has endorsed the change.

8. The system of claim 7, further comprising:

means for comparing said first gateway certificate with said second gateway certificate, to determine whether said network gateway changed between said enrolling and said reenrolling.

9. The system of claim 8, further comprising:

means for determining if said service provider has endorsed the change.

10. The system of claim 7, wherein said enrolling further comprises exchanging secret data between said network device and said network gateway.

11. The system of claim 10, wherein said exchanging comprises transferring said secret data by inserting a physical device into said network device and said network gateway.

12. The system of claim 7, wherein said determining if said network gateway has endorsed the change comprises determining if said second service provider certificate has been endorsed by said network gateway.

13. The system of claim 9, wherein said determining if said service provider has endorsed the change comprises determining if said second network gateway certificate has been endorsed by said service provider.

14. A method of detecting a change in the structure of a network, comprising:

connecting a first co-registrar with a second co-registrar, said connecting comprising said first co-registrar validating a first credential identifying said second co-registrar, and said second co-registrar validating a second credential identifying said first co-registrar;

registering a device with said first co-registrar, said registering comprising exchanging secret information between said device and said co-registrar, said secret information uniquely identifying said device, said registering further comprising copying said first credential and said second credential to said device as a stored first credential and a stored second credential;

periodically transmitting a query from said device to said first co-registrar for said first credential and said second credential; and

comparing said first credential with said first stored credential, in order to detect a change in the identity of said second co-registrar.

15. The method of claim 14, further comprising:

if the identity of said second co-registrar has changed, determining whether said first co-registrar has validated said second credential.

16. The method of claim 14, further comprising:

comparing said second credential with said second stored credential, in order to detect the change in the identity of said first co-registrar.

17. The method of claim 16, further comprising:

if the identity of said first co-registrar has changed, determining whether said second co-registrar has validated said second credential.

18. The method of claim 16, further comprising:

receiving a transfer credential into said network device from a new first co-registrar, said transfer credential originating from a new second co-registrar, said transfer credential identifying said new second co-registrar and validated by said second co-registrar.

19. The method of claim 18, further comprising:

if the identity of both said first co-registrar and said second co-registrar have changed, determining whether said second co-registrar has validated said transfer credential.

20. The method of claim 14, wherein said secret data comprises a private key.