METHOD FOR SECURELY CONFIGURING CUSTOMER PREMISE EQUIPMENT

• US 20150237018A1
• Filed: 02/18/2014
• Published: 08/20/2015
• Est. Priority Date: 02/18/2014
• Status: Active Grant

• Current Assignee: Ciena Corporation
• Original Assignee: Ciena Corporation
• Inventors: PARRY, Simon Paul, HOLTOM, James Alexander Ivens
• Granted Patent: US 10,069,802 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 12/2898 Subscriber equipments DSL modems H04M11/062; cable modems H04L12/2801
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 2101/668 Internet protocol [IP] address subnets
• CPC Class Codes: H04L 61/2503 Translation of Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04W 12/71 Hardware identity

Abstract

A method for securely configuring a customer premise equipment in a network. The network including a configuration server, a DHCP server, and the customer premise equipment. The method includes receiving a request from the customer premise equipment for leasing an Internet Protocol (IP) address to the customer premise equipment. The method further includes embedding at least a portion of a Media Access Control (MAC) address of the customer premise equipment into the IP address leased to the customer premise equipment. The method includes leasing the IP address to the customer premise equipment. Further, the method enables authentication of customer premise equipment, before providing configuration to the customer premise equipment. The method includes use of characteristic attributes of the customer premise equipment to generate cryptographic keys for secure connection. Moreover, the method includes establishing a secure connection between the configuration server and the customer premise equipment for transfer of a configuration file and a set of encryption keys. The configuration file and the set of encryption keys are used to securely configure the customer premise equipment.

Claims

1. A method for securely configuring a customer premise equipment in a network, the network including a configuration server, a dynamic host configuration protocol (DHCP) server, and the customer premise equipment, the method comprising:

receiving a request from the customer premise equipment for leasing an Internet Protocol (IP) address to the customer premise equipment;

embedding at least a portion of a Media Access Control (MAC) address of the customer premise equipment into the IP address leased to the customer premise equipment;

leasing the IP address to the customer premise equipment; and

establishing a secure connection between the configuration server and the customer premise equipment for transfer of a configuration file and a permanent set of encryption keys, wherein the configuration file and the permanent set of encryption keys are used to securely configure the customer premise equipment.

2. The method as recited in claim 1 further comprising notifying the configuration server regarding the IP address leased to the customer premise equipment.

3. The method as recited in claim 1, wherein establishment of a secure connection between the configuration server and the customer premise equipment is triggered by the customer premise equipment.

4. The method as recited in claim 1, wherein embedding at least a portion of the MAC address of the customer premise equipment into the IP address leased to the customer premise equipment and leasing the IP address to the customer premise equipment is performed by the DHCP server.

5. The method as recited in claim 1, wherein in case the customer premise equipment supports Internet Protocol version 4 (IPv4), then last 24-bits of the 48-bits MAC address are embedded in the IP address leased to the customer premise equipment.

6. The method as recited in claim 1, wherein in case the customer premise equipment supports Internet Protocol version 6 (IPv6), then at least a portion of the MAC address is embedded in the IP address leased to the customer premise equipment.

7. The method as recited in claim 1, wherein the temporary set of encryption keys are based on the MAC address of the customer premise equipment.

8. The method as recited in claim 1, wherein the secure connection between the configuration server and the customer premise equipment is a Secure Shell (SSH) tunnel.

9. A method for establishing a secure connection between a configuration server and a customer premise equipment for securely configuring the customer premise equipment in a network, the method comprising:

receiving a communication from the customer premise equipment containing the identity of the customer premise equipment, wherein the IP address leased to the customer premise equipment is embedded with at least a portion of a Media Access Control (MAC) address of the customer premise equipment;

identifying the MAC address of the customer premise equipment from the IP address leased to the customer premise equipment;

receiving a request for transferring a configuration file to the customer premise equipment;

generating a pair of public and private keys for securely transferring the configuration file to the customer premise equipment, wherein the pair of public and private keys is generated based on the MAC address of the customer premise equipment; and

establishing the secure connection between the configuration server and the customer premise equipment for securely transferring the configuration file to the customer premise equipment, wherein the configuration file is used to configure the customer premise equipment.

10. The method as recited in claim 9, wherein the request for transferring the configuration file to the customer premise equipment is triggered by the customer premise equipment.

11. The method as recited in claim 9, wherein in case the customer premise equipment supports Internet Protocol version 4 (IPv4), then last 24-bits of the 48-bits MAC address are embedded in the IP address leased to the customer premise equipment.

12. The method as recited in claim 9, wherein in case the customer premise equipment supports Internet Protocol version 6 (IPv6), then the complete MAC address is embedded in the IP address leased to the customer premise equipment.

13. The method as recited in claim 9, wherein the secure connection between the configuration server and the customer premise equipment is a Secure Shell (SSH) tunnel.

14. The method as recited in claim 9, wherein the pair of public and private keys is generated by using a pseudo-random prime generator algorithm.

15. The method as recited in claim 9, wherein the pair of public and private keys is generated by using at least a portion of the MAC address or some characteristic of the customer premise equipment as a seed.

16. A non-transitory computer-readable medium comprising code for causing a computer to:

receive a request from a customer premise equipment for leasing an Internet Protocol (IP) address to the customer premise equipment;

embed at least a portion of a Media Access Control (MAC) address of the customer premise equipment into the IP address leased to the customer premise equipment;

lease the IP address to the customer premise equipment; and

establish a secure connection between a configuration server and the customer premise equipment for transfer of a configuration file and a permanent set of encryption keys, wherein the configuration file and the permanent set of encryption keys are used to securely configure the customer premise equipment.

17. The non-transitory computer-readable medium of claim 16, wherein the code further causes notification of the configuration server regarding the IP address leased to the customer premise equipment.

18. The non-transitory computer-readable medium of claim 16, wherein the code further causes establishment of a secure connection between the configuration server and the customer premise equipment is triggered by the customer premise equipment.

19. The non-transitory computer-readable medium of claim 16, wherein the code further causes embedding at least a portion of the MAC address of the customer premise equipment into the IP address leased to the customer premise equipment and leasing the IP address to the customer premise equipment is performed by the DHCP server.

20. The non-transitory computer-readable medium of claim 16, wherein the code further causes a last 24-bits of a 48-bits MAC address to be embedded in the IP address leased to the customer premise equipment.