AUTHORIZING CUSTOMER PREMISE EQUIPMENT INTO A NETWORK

• US 20080301446A1
• Filed: 01/07/2008
• Published: 12/04/2008
• Est. Priority Date: 06/04/2007
• Status: Active Grant

• Current Assignee: Qualcomm Atheros Incorporated (Qualcomm, Inc.)
• Original Assignee: Intellon Corporation (Qualcomm, Inc.)
• Inventors: YONGE, LAWRENCE W. III, Krishnam, Manjunath, Katar, Srinivas
• Granted Patent: US 8,429,406 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04B 2203/5445 Local network
• CPC Class Codes: H04L 12/2801 Broadband local area networks
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/413 with random access, e.g. carrier-sense multiple-access with collision detection [CSMA-CD]
• CPC Class Codes: H04L 12/44 Star or tree networks
• CPC Class Codes: H04L 45/12 Shortest path evaluation
• CPC Class Codes: H04L 45/121 by minimising delays
• CPC Class Codes: H04L 45/122 by minimising distances, e.g. by selecting a route with minimum of number of hops
• CPC Class Codes: H04L 45/123 Evaluation of link metrics techniques for monitoring network metrics H04L43/08
• CPC Class Codes: H04L 45/125 based on throughput or bandwidth
• CPC Class Codes: H04L 45/16 Multipoint routing
• CPC Class Codes: H04L 47/787 Bandwidth trade among domains

Abstract

Systems and methods for authorizing customer premise equipment into a network. A publicly available network membership key can be provided to enable initial connection to the network. Unique network membership keys associated with various customer premise equipment can be provided to enable service level access to the network and/or authorization into a sub-cell associated with the network.

Claims

1. A computer implemented authorization method, comprising:

providing a public network membership key associated with a network;

receiving a connection request encrypted using the public network membership key from a device;

permitting limited access to the network from the device based on the connection request being encrypted using the public network membership key;

exchanging registration information from a user associated with the device; and

providing a unique network membership key based on receipt of the registration information.

2. The method of claim 1, wherein the network is a broadband over powerline network.

3. The method of claim 1, further comprising:

encrypting the unique network membership key prior to transmitting the unique network membership key.

4. The method of claim 3, wherein the unique network membership key is encrypted using a device access key.

5. The method of claim 4, further comprising receiving the device access key prior to the authorization server providing the unique network membership key.

6. The method of claim 5, further comprising using a secure mechanism to receive the device access key.

7. The method of claim 6, wherein the secure mechanism comprises a secure hypertext transfer protocol.

8. The method of claim 6, wherein the secure mechanism comprises an IP security protocol.

9. The method of claim 3, wherein the unique network membership key is provided to the device using a secure transmission mechanism.

10. The method of claim 9, wherein the secure transmission mechanism comprises a high layer protocol.

11. The method of claim 10, wherein the high layer protocol comprises a secure hypertext transfer protocol.

12. The method of claim 11, wherein the high layer protocol comprises an IP security protocol.

13. The method of claim 1, wherein the unique network membership key is a substantially unique network membership key.

14. The method of claim 1, wherein the limited access comprises limiting the content accessible by the user.

15. The method of claim 14, wherein the content accessible by the user comprises a registration site used to exchange registration information.

16. The method of claim 15, wherein the registration information comprises payment information.

17. The method of claim 15, wherein the registration information comprises service level information.

18. The method of claim 1, wherein the limited access comprises:

tagging the packets originating from the device; and

handling the tagged packets differently from packets that are not tagged.

19. The method of claim 1, wherein the limited access comprises limiting a duration of time during which the device can access the network.

20. The method of claim 1, wherein the limited access comprises limiting a bandwidth associated with the device accessing the network.

21. The method of claim 1, further comprising:

receiving a packet encrypted using the unique network membership key;

using at least a portion of a network to communicate the packet to a destination associated with the packet.

22. The method of claim 21, wherein the at least a portion of the network comprises a broadband over powerline network.

23. The method of claim 1, wherein the unique network membership key is associated with the device by an authorization system using a unique identifier associated with the device.

24. The method of claim 23, wherein the unique identifier comprises a media access control address.

25. The method of claim 1, further comprising periodically rotating the network membership key.

26. The method of claim 1, further comprising:

receiving a connection request encrypted using the unique network membership key; and

determining whether a media access control address associated with the connection request matches a known media access control address;

providing a service level based upon the determination and based upon the unique network membership key received.

27. The method of claim 1, further comprising binding a service level to the unique network membership key and a media access control address associated with the device.

28. The method of claim 1, wherein the public network membership key is publicly available.

29. The method of claim 1, wherein the public network membership key is available from a web site.

30. An authorization system comprising:

a network termination unit operable to receive a network connection request from a customer premise equipment device, the network termination unit being operable to provide limited access to the customer premise equipment device based upon the network connection request being encrypted using a public network membership key;

a registration system operable to exchange registration information with a user associated with the customer premise equipment device;

an authorization server operable provide a unique network membership key based upon receipt of customer registration information and to instruct the network termination unit and an associated headend station to provide limited access to the network based upon the public network membership key and to provide a service level access based upon the unique network membership key and a unique identifier associated with the customer premise equipment device.

31. The authorization system of claim 30, wherein the authorization server is operable to instruct the network termination unit and the associated headend station to provide different service levels based upon the unique network membership key and the unique identifier.

32. The authorization system of claim 31, wherein the provision of different service levels is based upon a combination of the unique network membership key and a media access control address associated with the customer premise equipment device.

33. The authorization system of claim 30, wherein the authorization server is operable to determine that the network connection request is encrypted using the publicly available network membership key based upon a media access control address associated with the network connection request.

34. The authorization system of claim 30, wherein the authorization server is operable to encrypt the unique network membership key using a device access key associated with the customer premise equipment device.

35. The authorization system of claim 34, wherein the device access key is received by the authorization server prior to the authorization server providing the public network membership key.

36. The authorization system of claim 30, wherein the registration information includes payment information associated with the user of the customer premise equipment device.

37. The authorization system of claim 30, wherein the authorization server provides the unique network membership key associated with the customer premise equipment device to the network termination unit in an encrypted format using a network termination unit network membership key.

38. The authorization system of claim 37, wherein the authorization server is operable to periodically rotate the unique network membership key.

39. The authorization system of claim 37, wherein the network termination unit uses the network membership key to authorize the customer premise equipment device into a sub-network associated with the network termination unit.

40. The authorization system of claim 30, wherein the headend station includes a gateway from a broadband over powerline network to a packet switched network.

41. An authorization method comprising:

receiving a connection request encrypted using the public network membership key from a device, the connection request comprising a unique identifier associated with the device;

determining that the device is authorized for service level access based upon the unique identifier;

retrieving a device access key associated with the unique identifier; and

providing a unique network membership key encrypted using the retrieved device access key.

42. The authorization method of claim 41, further comprising receiving the connection request at an authorization server via a network termination unit.

43. The authorization method of claim 41, wherein the device is a network termination unit sending the connection request on behalf of a customer premise equipment device, and the authorization server is operable to encrypt the unique network membership key using the device access key associated with the network termination unit.