Two-tiered authorization and authentication for a cable data delivery system

• US 7,296,283 B2
• Filed: 08/14/2001
• Issued: 11/13/2007
• Est. Priority Date: 01/17/1997
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Scientific-Atlanta Incorporated (Cisco Systems, Inc.)
• Inventors: Hrastar, Scott E., Bowcutt, Roy A.
• Primary Examiner(s): Salce; Jason P.
• Application Number:
  US09/929,760
• Publication Number:
  US 20010050979A1
• Time in Patent Office: 2,282 Days
• Field of Search: 379/93.02, 379/93.03, 379/102.02, 379/67.1, 379/68, 725/30, 725/25, 725/122, 725/110, 725/111, 725/114, 725115-117, 725/126, 455/410, 455/411, 348/14.01, 348/14.08, 348/14.09, 370/401
• US Class Current: 725/30
• CPC Class Codes: H04H 20/79 using downlink of the CATV systems, e.g. audio broadcast via CATV network
• CPC Class Codes: H04H 60/84 which are fixed telephone networks
• CPC Class Codes: H04L 12/2801 Broadband local area networks
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/2863 Arrangements for combining access network resources elements, e.g. channel bonding modem pooling H04L25/14; routing of packets H04L45/00; multichannel or multilink protocols H04L69/14
• CPC Class Codes: H04L 12/2872 Termination of subscriber connections
• CPC Class Codes: H04L 12/2874 Processing of data for distribution to the subscribers
• CPC Class Codes: H04L 12/5692 Selection among different networks
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0663 Performing the actions predefined by failover planning, e.g. switching to standby network elements
• CPC Class Codes: H04L 41/0677 Localisation of faults
• CPC Class Codes: H04L 61/50 Address allocation
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 61/5061 Pools of addresses
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04N 21/25816 : involving client authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04N 21/42676 : for modulating an analogue carrier signal to encode digital information or demodulating it to decode digital information, e.g. ADSL or cable modem
• CPC Class Codes: H04N 21/6118 : involving cable transmission, e.g. using a cable modem
• CPC Class Codes: H04N 21/6168 : involving cable transmission, e.g. using a cable modem
• CPC Class Codes: H04N 7/17309 : Transmission or handling of upstream communications

Abstract

Apparatus for a cable television subscriber to log onto a computer network with a modem over an upstream path using a USERID and password. The network validates the subscriber USERID and subscriber password with a stored database of valid USERIDs and associated passwords. After the USERID and password are validated, the modem then provides it electronic serial number to the network for validation against a stored database of authorized serial numbers. Upon additional validation of the modem'"'"'s serial number, the subscriber is authorized to use the network.

Claims

1. In a cable data delivery network for delivering digital data to a host location upon a subscriber initiated request, an apparatus for authenticating that the subscriber is authorized to use said network, said apparatus comprising:

a network manager including at least one database of authorized users and authorized unique identifiers for each of a plurality of authorized data communication devices and a validation agent, said validation agent further comprising;

a logic to authorize the subscriber to access a first communications path by comparing first subscriber authentication information received from a data communication device associated with the host location with at least part of the at least one database comprising the authorized users,

the first communications path providing at least a portion of connectivity between the host location and a head end of the cable data delivery network; and

logic to authorize the subscriber to access a second communications path, responsive to the first communications path authorization, by comparing a unique identifier of the data communication device that is received from the data communication device with at least part of the at least one database comprising the authorized unique identifiers for each of the plurality of data communication devices,

the second communications path providing at least a portion of connectivity between the host location and the head end of the cable data delivery network, wherein the second communications oath is uni-directional.

2. The apparatus of claim 1, wherein said first subscriber authentication information includes a subscriber USERID.

3. The apparatus of claim 2, wherein said first subscriber authentication information further includes a subscriber password.

4. The apparatus of claim 3, wherein said at least one database includes an associated USERID and password for each of said authorized users.

5. The apparatus of claim 4, wherein said validation agent authorizes said subscriber to use said first communications path in accordance with a comparison of said subscriber USERID and said subscriber password to USERIDS and passwords stored in said at least one database.

6. The apparatus of claim 5, wherein said data communication device associated with the host location includes a dial up device that further includes a cable data receiver for receiving said digital data.

7. The apparatus of claim 6, wherein said dial up device is uniquely identified by the unique identifier that comprises an electronic identifying number, and wherein the unique identifier that is received from the data communication device includes the electronic identifying number.

8. The apparatus of claim 7, wherein said at least one database further includes authorized identifying numbers for each of a plurality of dial up devices including said dial up device.

9. The apparatus of claim 8, wherein said validation agent authorizes said dial up device to receive said digital data over the second communications path in accordance with a comparison of said identifying number of said dial up device with said identifying numbers stored in said at least one database.

10. The apparatus of claim 1, wherein the first communications path is a public switched telephone network (PSTN) link.

11. The apparatus of claim 1, wherein the first communications path is bi-directional.

12. The apparatus of claim 1, wherein the second communications path is a radio frequency (RF) cable link.

13. The apparatus of claim 1, wherein the data delivery is restrained until authorization is completed.

14. The apparatus of claim 1, wherein the first subscriber authentication information comprises a password provided to the validation agent by the subscriber and the unique identifier of the data communication device is a number provided to the validation agent by the data communication device associated with the host.

15. A method of authorizing a subscriber to access a first communications path and a second communications path, the first communications path and the second communications path utilized in conveying data between a head end of a cable data delivery network and a data communication device associated with the subscriber of the cable data delivery network, the method comprising the steps of:

authorizing the subscriber to access the first communications path by comparing first subscriber authentication information received from the data communication device with at least part of at least one database of authorized users, the first communications path providing at least a portion of connectivity between the data communication device and the head end of the cable data delivery network; and

authorizing the subscriber to access the second communications path, responsive to the first communications path authorization, by a unique identifier of the data communication device that is received from the data communication device, with at least part of the at least one database that further includes authorized unique identifiers for each of a plurality of authorized data communication devices, the second communications path providing at least a portion of connectivity between the data communication device and the head end of the cable data delivery network, wherein the second communications path is uni-directional.

16. The method of claim 15, wherein the first subscriber authentication information comprises a USERID and a password.

17. The method of claim 15, wherein the unique identifier of the data communication device comprises an electronic identifying number.

18. The method of claim 15, wherein the first communications path is a public switched telephone network (PSTN) link.

19. The method of claim 15, wherein the first communications path is bi-directional.

20. The method of claim 15, wherein the second communications path is a radio frequency (RF) cable link.

21. The method of claim 15, wherein the data conveyance is restrained until authorization is completed.

22. The method of claim 15, wherein the first subscriber authentication information comprises a password provided to the head end by the subscriber and the unique identifier of the data communication device is a number provided to the head end by the data communication device associated with the subscriber.

23. The method of claim 15, wherein the data communications device of the subscriber of the cable data network includes a cable data receiver for receiving said digital data, wherein said data communications device is uniquely identified by the unique identifier.

24. In a cable data delivery network for delivering digital data to a host location upon a subscriber initiated request, an apparatus for authenticating that the subscriber is authorized to use said network, said apparatus comprising:

a network manager including at least one database of authorized users and authorized unique identifiers for each of a plurality of authorized data communication devices and a validation agent, said validation agent further comprising;

logic to authorize the subscriber to access a first communications path by comparing first subscriber authentication information received from a data communication device associated with the host location with at least part of the at least one database comprising the authorized users, wherein said first subscriber authentication information includes a subscriber USERID and a subscriber password, wherein said at least one database includes an associated USERID and password for each of said authorized users, wherein said validation agent authorizes said subscriber to use said first communications path in accordance with a comparison of said subscriber USERID and said subscriber password to USERIDS and passwords stored in said at least one database,

the first communications path providing at least a portion of connectivity between the host location and a head end of the cable data delivery network; and

logic to authorize the subscriber to access a second communications path, responsive to the first communications path authorization, by comparing a unique identifier of the data communication device that is received from the data communication device with at least part of the at least one database comprising the authorized unique identifiers for each of the plurality of data communication devices,

the second communications path providing at least a portion of connectivity between the host location and the head end of the cable data delivery network.

25. The apparatus of claim 24, wherein said at least one database further includes authorized identifying numbers for each of a plurality of dial up devices including said dial up device.

26. The apparatus of claim 25, wherein said validation agent authorizes said dial up device to receive said digital data over the second communications path in accordance with a comparison of said identifying number of said dial up device with said identifying numbers stored in said at least one database.

27. The apparatus of claim 24, wherein the first communications path is a public switched telephone network (PSTN) link.

28. The apparatus of claim 24, wherein the first communications path is bi-directional.

29. The apparatus of claim 24, wherein the second communications path is a radio frequency (RF) cable link.

30. The apparatus of claim 24, wherein the data delivery is restrained until authorization is completed.

31. The apparatus of claim 24, wherein the first subscriber authentication information comprises a password provided to the validation agent by the subscriber and the unique identifier of the data communication device is a number provided to the validation agent by the data communication device associated with the host.