DYNAMICALLY CONFIGURABLE ONLINE DATA UPDATE SYSTEM

• US 20140082701A1
• Filed: 09/16/2013
• Published: 03/20/2014
• Est. Priority Date: 09/17/2012
• Status: Active Grant

• Current Assignee: ARRIS Enterprises LLC (CommScope Holding Company, Inc.)
• Original Assignee: General Instrument Corporation (CommScope Holding Company, Inc.)
• Inventors: Pasion, Jason A., Qiu, Xin, Wang, Fan, Yao, Ting, Myint, Zeya, Yan, Joel
• Granted Patent: US 9,864,866 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A data object update system provides a flexible framework that can be used to upgrade, renew, replace or supplement data objects that are provisioned in a large base of network-enabled devices that been deployed in the field to end users. The system has the flexibility to configure, for example, the following items, based on different requirements received from network operators: which device key and/or certificate is to be used to authenticate request messages from network-enabled devices before a specific data object update request is accepted into the system; which device identifier is to be used to authorize data object update requests; which device identifier is to be used for generating device specific data objects; and which protection mechanism is to be used to secure the delivery of data objects to network-enabled devices.

Claims

1. A system for downloading data objects to network-enabled devices, comprising:

an identity data generator configured to generate a plurality of new downloadable data objects of different types;

a whitelist or blacklist manager configured to (i) receive one or more identifiers associated with each of a plurality of network-enabled devices deployed for use in association with a network and (ii) produce a whitelist or blacklist relating the one or more identifiers to each of the network-enabled devices that are respectively authorized or unauthorized to receive new downloadable data objects;

an update server configured to (i) receive the new downloadable data objects from the identity data generator, (ii) receive requests for new downloadable data objects from the plurality of network-enabled devices (iii) authenticate each of the network-enabled devices and (iv);

deliver a new downloadable data object to each one of the authenticated network-enabled devices that are authorized to receive a new downloadable data object in accordance with the whitelist or blacklist; and

a configuration manager providing a user interface (UI) through which a plurality of parameters associated with new downloadable data objects to be downloaded to a plurality of network-enabled devices are configurable, the plurality of parameters including a first parameter specifying a process configuration identifier identifying a group of configurable parameters included in the plurality of parameters which collectively specify one or more operations that are employed to process the request.

2. The system of claim 1 wherein the group of configuration parameters includes a second parameter specifying a download process identifier associating the process configuration identifier with a particular network operator.

3. The system of claim 1 wherein the group of configuration parameters further comprises:

a second parameter specifying a type of new downloadable data objects to be generated;

a third parameter specifying a device identity type to be used to authorize a request for downloadable data objects,

a fourth parameter specifying an authentication mechanism to be used to authenticate the request,

a fifth parameter specifying a device identity to be associated with a new downloadable data object,

a sixth parameter specifying a protection mechanism to be used for securely delivering new downloadable data objects to the network-enabled devices,

a seventh parameter specifying a number of times a network-enabled device is able to download a new downloadable data object of a particular type, and

an eighth parameter specifying a time after which a new downloadable data object of a particular type is no longer downloadable to a network-enabled device.

4. The system of claim 1 further comprising a second parameter specifying a network operator identifier identifying a network operator associated with a plurality of the network-enabled devices.

5. The system of claim 1 further comprising a second parameter specifying a manner in which new downloadable objects are associated with network-enabled devices.

6. The system of claim 5 wherein the second parameter specifies whether a particular downloadable data object is generated for a particular network-enabled device by associating the particular downloadable data object with a previously assigned identifier identifying the particular network-enabled device, or whether a particular downloadable data object generated without being associated with a particular network-enabled device is associated with a particular network-enabled device when a request is received from a particular network-enabled device.

7. The system of claim 6 further comprising a third parameter specifying whether the particular downloadable data object is permanently bound to the particular device when a particular downloadable data object is associated with a particular network-enabled device when a request is received.

8. The system of claim 6 further comprising a third parameter specifying whether the particular downloadable data object is associated with a particular network-enabled device without being permanently bound thereto.

9. The system of claim 6 further comprising a third parameter specifying whether the particular downloadable data object is unassociated with a particular network-enabled device.

10. The system of claim 2 wherein the configuration manager includes:

a session manager for communicating with the network-enabled devices and creating a new session for each new request that is received;

a request handler for parsing and validating the new requests;

a plurality of operational controllers each corresponding to a different download process identifier, the request handler being configured to select one of the operation controllers for each session that is created based on information included in the new requests respectively associated with each session, the operation controllers selecting methods for authentication, authorization and encryption to be used in processing each of the new requests based on values for parameters in the group of parameters that are specified for each new request.

11. A method for updating network-enabled devices with downloadable data objects, comprising:

specifying through a user interface (UI) values for a plurality of parameters associated with new downloadable data objects to be downloaded to a plurality of network-enabled devices, the plurality of parameters including a first parameter specifying a process configuration identifier identifying a group of configurable parameters included in the plurality of parameters which collectively specify one or more operations that are employed to process the request;

generating a plurality of new downloadable data objects of different types in accordance with the group of configurable parameters;

receiving requests for new downloadable data objects from the plurality of network-enabled devices;

authenticating each of the network-enabled devices requesting new downloadable data objects in accordance with the group of configurable parameters; and

delivering a new downloadable data object to each one of the authenticated network-enabled device that are authorized to receive a new downloadable data object in accordance with the group of configurable parameters.

12. The method of claim 11 wherein the group of configuration parameters includes a second parameter specifying a download process identifier associating the process configuration identifier with a particular network operator.

13. The method of claim 11 further comprising a second parameter specifying a network operator identifier identifying a network operator associated with a plurality of the network-enabled devices.

14. The method of claim 11 further comprising a second parameter specifying a manner in which new downloadable data objects are associated with network-enabled devices.

15. The method of claim 14 wherein the second parameter specifies whether a particular downloadable data object is generated for a particular network-enabled device by associating the particular downloadable data object with a previously assigned identifier identifying the particular network-enabled device, or whether a particular downloadable data object generated without being associated with a particular network-enabled device is associated with a particular network-enabled device when a request is received from a particular network-enabled device.

16. The method of claim 15 further comprising a third parameter specifying whether the particular downloadable data object is permanently bound to the particular device when a particular downloadable data object is associated with a particular network-enabled device when a request is received.

17. The method of claim 15 further comprising a third parameter specifying whether the particular downloadable data object is associated with a particular network-enabled device without being permanently bound thereto.

18. The method of claim 15 further comprising a third parameter specifying whether the particular downloadable data object is unassociated with a particular network-enabled device.