System and Method for Secure Configuration of Network Attached Devices

• US 20090132682A1
• Filed: 11/19/2007
• Published: 05/21/2009
• Est. Priority Date: 11/19/2007
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Services Organization Incorporated (Verizon Communications Inc.)
• Inventors: Counterman, Raymond C.
• Granted Patent: US 9,178,857 B2
• Time in Patent Office: Days
• US Class Current: 709/220
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0886 Fully automatic configuration
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 8/265 for initial activation of new user

Abstract

A system and method for supplying, to a provider of the device, requirements for information to be stored on a device, obtaining device data for provisioning the device on a network, storing device configuration information on storage associated with the network, receiving a service request from a user of the device, detecting attachment of the device to the network, authenticating the device utilizing a device identifier and shared credentials to enable the device to be configured without storing a network address for configuration in the device, providing network information to the device, and providing configuration information to the device.

Claims

1. A method, comprising:

supplying, to a provider of a device, requirements for information to be stored on the device, wherein the requirements include a unique device identifier and shared credentials;

obtaining device data for provisioning the device on a network;

receiving a service request from a user of the device;

storing device configuration information in storage associated with the network, wherein the device configuration information includes at least one of;

configuration information based on the device data obtained and configuration information based on the service request received;

detecting attachment of the device to the network;

authenticating the device utilizing the unique device identifier and the shared credentials, wherein the unique device identifier and shared credentials enable the device to be associated with the device configuration information stored in storage associated with the network; and

providing the device configuration information to the device.

2. The method of claim 1 wherein the association enables the device to be configured without storing a network address for configuration in the device.

3. The method of claim 1, wherein the unique device identifier is based at least in part on a medium access control address associated with the device.

4. The method of claim 1, wherein the requirements for information to be stored on a device comprise requirements for at least one of:

a cryptographic key, an encryption key, a public key, a shared secret, a digital certificate, and a unique device identifier.

5. The method of claim 1, wherein the device data obtained for provisioning the device on a network includes at least one of:

device manufacturer, device model number, device class, device identifier, hardware capabilities of the device, software capabilities of the device, dynamic host configuration protocol support enabled by the device, authentication protocol requirements of the device, and a shared cryptographic secret.

6. The method of claim 1, wherein authenticating the device utilizes at least one of:

secure sockets layer, transport secure layer, and a protocol utilizing extensible authentication.

7. The method of claim 1, wherein receiving a service request from a user of the device includes obtaining information about the type of service and service options ordered by the user from a service provider associated with the network.

8. The method of claim 1, wherein authenticating the device includes scanning the device for at least one of:

antivirus information, operating system version, operating system patch level, and a device status.

9. The method of claim 1, wherein authenticating the device includes managing one or more transmission characteristics permitted for the device on the network.

10. The method of claim 1, wherein authenticating the device stores device information on the storage associated with the network utilizing at least one of:

Remote Authentication Dial In User Service, DIAMETER, and hypertext transfer protocol.

11. The method of claim 1, wherein device configuration information is provided to the device utilizing dynamic host configuration protocol.

12. The method of claim 1, wherein the device data for provisioning the device on a network includes dynamic host configuration protocol information.

13. The method of claim 1, wherein providing network information to the device includes providing at least one of:

a host name, an IP address, a lease time, a subnet mask, a default gateway, a Network Time Protocol Server address, a Domain Name Server address, a broadcast address, and a Domain Name.

14. A computer readable medium comprising code to perform the acts of the method of claim 1.

15. A system, comprising:

one or more databases for storing device configuration data, service network data and user service request data wherein the one or more databases are communicatively coupled to a network; and

a network element communicatively coupled to the network wherein the network element is configured to;

obtain device data for provisioning the device on the network, wherein the device data includes a unique device identifier and a shared secret;

receive a service request from a user of the device;

store device configuration information on the one or more databases communicatively coupled to the network, wherein the device configuration information includes at least one of;

configuration information based on the device data obtained and configuration information based on the service request received;

detect attachment of the device to the network;

authenticate the device, wherein authentication of the device utilizes the unique device identifier and the shared secret to enable the device to be associated with the device configuration information stored on the one or more databases; and

provide configuration information to the device.

16. The system of claim 15, wherein the association between the device and the stored device configuration information eliminates a need for network address information to be contained on the device prior to configuration.

17. The system of claim 15, wherein the device identifier is based at least in part on a medium access control address associated with the device.

18. The system of claim 15, wherein the device data obtained for provisioning the device on a network includes at least one of:

device manufacturer, device model number, device class, device identifier, hardware capabilities of the device, software capabilities of the device, dynamic host configuration protocol support enabled by the device, and authentication protocol requirements of the device.

19. The system of claim 15, wherein authenticating the device utilizes at least one of:

a secure sockets layer protocol, a transport secure layer protocol, and a protocol utilizing extensible authentication.

20. The system of claim 15, wherein network information is provided to the device utilizing dynamic host configuration protocol.

21. The system of claim 15, wherein the device data for provisioning the device on a network includes dynamic host configuration protocol information.

22. The system of claim 15, wherein providing network information to the device includes providing at least one of:

a host name, an IP address, a lease time, a subnet mask, a default gateway, a Network Time Protocol Server address, a Domain Name Server address, a broadcast address, and a Domain Name.