Activation, Initialization, Authentication, and Authorization for a Multi-Services Gateway Device at User Premises

• US 20080189774A1
• Filed: 12/28/2007
• Published: 08/07/2008
• Est. Priority Date: 12/29/2006
• Status: Active Grant

• Current Assignee: Prodea Automation LLC (f/k/a Kip Prod P1) (FIG LLC (d/b/a Fortress Investment Group LLC))
• Original Assignee: Prodea Systems, Inc.
• Inventors: Erhart, Wesley R., McQuarters, Alvin R., Ramayya, Jude P., Nicholls, Leon E., Masina, Ramprakash, Cowgill, George A., Ansari, Amir, Raissyan, Atousa, Cooper, Michael P.
• Granted Patent: US 8,205,240 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G05B 15/02 electric
• CPC Class Codes: G05B 19/042 using digital processors G05B19/05 takes precedence
• CPC Class Codes: G05B 2219/2642 Domotique, domestic, home control, automation, smart house
• CPC Class Codes: G06F 16/64 Browsing; Visualisation therefor generation of a list or set of audio data G06F16/638
• CPC Class Codes: G06F 16/68 Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G08B 13/19656 Network used to communicate with a camera, e.g. WAN, LAN, Internet
• CPC Class Codes: G10L 15/22 Procedures used during a speech recognition process, e.g. man-machine dialogue
• CPC Class Codes: G10L 2015/223 Execution procedure of a spoken command
• CPC Class Codes: H04L 12/2803 Home automation networks
• CPC Class Codes: H04L 12/2807 Exchanging configuration information on appliance services in a home automation network arrangements for maintenance or administration involving network analysis for automatically determining the actual topology of a network H04L41/12; hardware or software tools for network management using graphical user interfaces H04L41/22; address allocation H04L61/50
• CPC Class Codes: H04L 12/2812 describing content present in a home automation network, e.g. audio video content retrieval from the Internet G06F16/95
• CPC Class Codes: H04L 12/2814 Exchanging control software or macros for controlling appliance services in a home automation network arrangements for maintenance or administration involving configuration of the network and network elements H04L41/08
• CPC Class Codes: H04L 12/2816 Controlling appliance services of a home automation network by calling their functionalities arrangements in telecontrol or telemetry systems for selectively calling a substation from a main station; in which substation desired apparatus is selected for applying a control signal thereto or for obtaining measured values therefrom H04Q9/00
• CPC Class Codes: H04L 12/2818 from a device located outside both the home and the home network access arrangements H04L12/2856; for remote control or remote monitoring of applications H04L67/025; arrangements for transmitting signals characterised by the use of a wireless eletrical link G08C17/00; telephonic communication systems adapted for combination with remote control systems H04M11/007
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 2012/2849 Audio/video appliances
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 47/80 : Actions related to the user profile or the type of traffic
• CPC Class Codes: H04L 47/83 : based on usage prediction
• CPC Class Codes: H04L 49/25 : Routing or path finding in a switch fabric
• CPC Class Codes: H04L 51/04 : Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/046 : Interoperability with other network applications or services
• CPC Class Codes: H04L 61/4552 : Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 63/02 : for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/06 : for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 : based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/102 : Gateways arrangements for connecting between networks having differing types of switching systems, e.g. gateways, H04L12/66
• CPC Class Codes: H04L 65/1101 : Session protocols
• CPC Class Codes: H04L 65/1108 : Web based protocols, e.g. webRTC
• CPC Class Codes: H04L 67/01 : Protocols
• CPC Class Codes: H04L 67/104 : Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/125 : involving control of end-device applications over a network
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/53 : using third party service providers
• CPC Class Codes: H04L 69/325 : in the network layer [OSI layer 3], e.g. X.25 H04L69/16 takes precedence
• CPC Class Codes: H04N 21/00 : Selective content distribution, e.g. interactive television or video on demand [VOD] real-time bi-directional transmission of motion video data H04N7/14 ; broadcast or conference over packet switching networks H04L12/18
• CPC Class Codes: H04N 21/40 : Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
• CPC Class Codes: H04N 7/181 : for receiving images from a plurality of remote sources
• CPC Class Codes: H04W 12/00 : Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/033 : of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/0431 : Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/065 : Continuous authentication
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 12/35 : Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 4/80 : Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: Y10S 370/911 : Bridge, e.g. brouter, bus extender

Abstract

A method of putting a first gateway device into service, the first gateway device having an application service module and a network module enabling communications between the first gateway device and the activation manager, the application service module residing on a user premises side of a network service provider demarcation. The method comprises identifying, at the first gateway device disposed at a user premises, an activation manager in communication with the first gateway device, transmitting, from the first gateway device, an activation certificate to the activation manager for verification and authentication, generating a service authentication key associated with the first gateway device, storing the service authentication key and an indication that the associated gateway device status is activated in a database, determining the services available to the first gateway device, and transmitting the service authentication key and an identification of the available services to the first gateway device.

Claims

1. A method of putting a first gateway device into service, the first gateway device having an application service module and a network module enabling communications between the first gateway device and the activation manager, the application service module residing on a user premises side of a network service provider demarcation, the method comprising:

identifying, at the first gateway device disposed at a user premises, an activation manager in communication with the first gateway device;

transmitting, from the first gateway device, an activation certificate to the activation manager for verification and authentication;

generating a service authentication key associated with the first gateway device;

storing the service authentication key and an indication that the associated gateway device status is activated in a database;

determining the services available to the first gateway device; and

transmitting the service authentication key and an identification of the available services to the first gateway device.

2. The method of claim 1, further comprising:

transmitting, from the first gateway device, a request for a gateway authentication certificate to the activation manager; and

issuing a gateway authentication certificate and transmitting the gateway authentication certificate to the first gateway device, the gateway authentication certificate to be used to for peer-to-peer authentication of a second gateway device.

3. The method of claim 1, further comprising:

transmitting, from the first gateway device, a request for a gateway authentication certificate to the activation manager; and

issuing a gateway authentication certificate and presenting the gateway authentication certificate to an endpoint device.

4. The method of claim 1, further comprising:

transmitting, from the first gateway device, a request for a gateway authentication certificate to the activation manager; and

issuing a gateway authentication certificate and presenting the gateway authentication certificate to a remote endpoint device external to the user premises.

5. The method of claim 1, further comprising:

receiving, from the activation manager, a request for an activation code;

prompting a user for the activation code and transmitting the activation code to the activation manager;

transmitting, from the activation manager, the unique identifier, the set of security codes, and the activation code to an authentication manager; and

verifying, at the authentication manager, the received activation certificate, and the activation code.

6. The method of claim 1, wherein generating a service authentication key comprises generating the service authentication key at the authentication manager.

7. The method of claim 1, wherein transmitting, from the first gateway device, the activation certificate comprises transmitting a set of data encryption codes.

8. The method of claim 1, wherein transmitting the activation certificate comprises transmitting a public key certificate and a private key.

9. The method of claim 1, wherein transmitting the activation certificate comprises transmitting a user identifier.

10. The method of claim 1, wherein transmitting the activation certificate comprises transmitting a serial identifier uniquely associated with the first gateway device.

11. The method of claim 1, further comprising transmitting an activation code.

12. The method of claim 1, further comprising associating the first gateway device with a particular user.

13. The method of claim 1, further comprising associating the first gateway device with an application service provider.

14. The method of claim 1, further comprising transmitting, from the activation manager, the request to a certificate manager for issuance of the gateway authentication certificate.

15. The method of claim 1, further comprising directing the first gateway device to an assigned application service provider in response to the identification of the available services to the first gateway device.

16. The method of claim 1, wherein the first gateway device and the activation manager communicate via a secure network link.

17. The method of claim 1, wherein the first gateway device and the activation manager communicate via a non-secure network link.

18. The method of claim 1, wherein the activation manager is external to the user premises and independent of any application service provider.

19. The method of claim 1, further comprising:

establishing a connection, at the first gateway device, to a remote service manager;

sending an authentication request to the remote service manager;

transmitting the authentication request to the authentication manager;

verifying, by the authentication manager, the service authentication key and that the first gateway device status is activated; and

confirm the established connection to the first gateway device.

20. The method of claim 1, wherein generating a service authentication key further comprises generating a key for application services.

21. The method of claim 1, wherein generating a service authentication key further comprises generating at least one service key for at least one of web service, voice service, movie service, music service, file-sharing service, file-backup service, gaming service, advertising service, and food-ordering service.

22. The method of claim 1, wherein generating a service authentication key further comprises generating the service authentication key with a validation parameter.

23. The method of claim 1, wherein generating a service authentication key further comprises generating a new service authentication key on a periodic basis.

24. The method of claim 1, further comprising sending a renewal request to renew the service authentication key.

25. The method of claim 1, further comprising sending a current service configuration to the first gateway device.

26. The method of claim 1, wherein generating a service authentication key comprises generating a plurality of service authentication keys for a plurality of gateway devices.

27. A gateway device for operation at a user premises having at least one endpoint device associated with the gateway device, the gateway device being in communication with a remote service manager, the gateway device comprising:

a user module providing bi-directional communications with the at least one endpoint device;

a network module having the connection that enables bi-directional communications with the remote service manager;

a service manager disposed on the network module side of an interface boundary between the application service module and the network module forming a network service provider demarcation, and operable to;

transmit an activation certificate to a remote activation manager for verification and authentication; and

receive a service authentication key and an identification of available services to the gateway device from the activation manager.

28. The gateway device of claim 27, wherein the service manager is further operable to:

receive, from the activation manager, a request for an activation code;

prompt a user for the activation code and transmitting the activation code to the activation manager.

29. The gateway device of claim 27, wherein the service manager is operable to transmit a set of data encryption codes.

30. The gateway device of claim 27, wherein the service manager is operable to transmit a public key certificate and a private key.

31. The gateway device of claim 27, wherein the service manager is operable to transmit a serial identifier uniquely associated with the gateway device.

32. The gateway device of claim 27, wherein the service manager is operable to receive an identification of an assigned application service provider in response to the identification of the available services to the first gateway device.

33. The gateway device of claim 27, wherein the service manager is further operable to:

establish a connection to the remote service manager;

sending an authentication request to the remote service manager; and

receive a confirmation of the established connection to the remote service manager.

34. The gateway device of claim 27, wherein the service manager is operable to further receive a service key.

35. The gateway device of claim 27, wherein the service manager is operable to receive at least one service key for at least one of web service, voice service, movie service, music service, file-sharing service, file-backup service, gaming service, advertising service, and food-ordering service.

36. The gateway device of claim 27, wherein the service manager is operable to further receive the service authentication key with a validation parameter.

37. The gateway device of claim 27, wherein the service manager is operable to further receive a new service authentication key on a periodic basis.

38. The gateway device of claim 27, wherein the service manager is operable to further send a renewal request to renew the service authentication key.

39. The gateway device of claim 27, wherein the service manager is operable to further send a request for a service configuration update.

40. A system comprising:

at least one remote service manager coupled to a network;

at least one activation manager coupled to the network, the at least one activation manager being independent of the at least one remote service manager;

at least one gateway device disposed at a user premises and in communication with the at least one remote service manager and the at least one activation manager via the network, the at least one gateway device comprises;

an application service module residing on a user premises side of a network service provider demarcation;

a network module having the connection that enables bi-directional communications with the at least one remote service manager; and

a service manager operable to;

transmit an activation certificate to a remote activation manager for verification and authentication; and

receive a service authentication key and an identification of available services to the gateway device from the activation manager.

41. A system comprising:

at least one remote service manager coupled to a network;

at least one application service provider coupled to the network;

at least one activation manager coupled to the network;

at least one gateway device disposed at a user premises and in communication with the at least one remote service manager and the at least one activation manager via the network, the at least one gateway device being agnostic to the at least one remote service manager and the at least one application service provider, the at least one gateway device comprises;

an application service module residing on a user premises side of a network service provider demarcation;

a network module having the connection that enables bi-directional communications with the at least one remote service manager; and

a service manager operable to;

transmit an activation certificate to a remote activation manager for verification and authentication; and

transmit an activation certificate to a remote activation manager for verification and authentication; and

receive a service authentication key and an identification of available services to the gateway device from the activation manager.

42. A method of peer-to-peer gateway device authentication, comprising:

activating a first gateway device;

transmitting, from the first gateway device, a request for a gateway authentication certificate to an activation manager; and

issuing a gateway authentication certificate and transmitting the gateway authentication certificate to the first gateway device; and

transmitting the gateway authentication certificate from the first gateway device to a second gateway device to establish accessibility of resources associated with the second gateway device from the first gateway device.

43. A method of claim 42, wherein activating the first gateway device comprises:

receiving an activation certificate from the first gateway device;

verifying and validating the activation certificate;

assigning the first gateway device to a remote service manager;

verifying and validating the identity of the first gateway device;

verifying and validating the association of a user to the first gateway device; and

verifying and validating services authorized for the first gateway device.