System and method for providing security backup services to a home network

• US 7,730,181 B2
• Filed: 04/25/2006
• Issued: 06/01/2010
• Est. Priority Date: 04/25/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Baugher, Mark John
• Primary Examiner(s): Chan; Wing F
• Assistant Examiner(s): Zong; Ruolei
• Application Number:
  US11/411,491
• Publication Number:
  US 20070250596A1
• Time in Patent Office: 1,498 Days
• Field of Search: 709/218, 709/225, 713/155, 726/10
• US Class Current: 709/225
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/2898 Subscriber equipments DSL modems H04M11/062; cable modems H04L12/2801
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/303 Terminal profiles

Abstract

Methods and systems of providing security backup services to a home network are described. In one embodiment, the gateway for a home network is registered with a service provider. A network device is enrolled with the home network, and periodically reenrolls. The device detects whether the gateway has been replaced between enrolling and reenrolling, and if it has been replaced, determines whether the new network gateway has been endorsed by the service provider.

Claims

1. A method comprising:

receiving, with a network gateway of a home network, a first service provider credential indicating the network gateway is registered with a first service provider;

transmitting the first service provider credential and a network gateway credential to at least one network device, which enrolls the network device with the home network;

receiving with the network gateway, a second service provider credential indicating the network gateway is registered with a second service provider;

signing the second service provider credential with the network gateway;

receiving a request to reenroll the network device with the home network, wherein, in response to the request, the network device is expecting a response from the network gateway that includes the first service provider credential and the network gateway credential; and

transmitting the second service provider credential that is signed by the network gateway and the network gateway credential to the network device, wherein the network device is configured to reenroll with the home network based on the second service provider credential that is signed by the network gateway and the network gateway credential;

wherein the signing of the second service provider credential indicates that the network gateway endorses the second service provider;

wherein the network device is configured to determine the second service provider has replaced the first service provider, and is configured to reenroll with the home network based on the endorsement of the second service provider by the network gateway.

2. The method of claim 1, wherein the first service provider credential is configured to uniquely identify the first service provider, and the second service provider credential is configured to uniquely identify the second service provider.

3. The method of claim 1, wherein the signing of the second service provider credential with the network gateway is performed when the first service provider is replaced with the second service provider.

4. The method of claim 1, further comprises exchanging secret data between the network device and the network gateway.

5. The method of claim 1, wherein the exchanging comprises transferring the secret data after a physical device is inserted into the network device and the network gateway.

6. A system comprising:

means for receiving a first service provider credential indicating a network gateway of a home network is registered with a first service provider;

means for transmitting the first service provider credential and a network gateway credential to at least one network device, which enrolls the network device with the home network;

means for receiving a second service provider credential indicating the network gateway is registered with a second service provider;

means for signing the second service provider credential;

means for receiving a request to reenroll the network device with the home network; and

means for transmitting the signed second service provider credential and the network gateway credential to the network device, wherein the network device is configured to reenroll with the home network based on the signed second service provider credential and the network gateway credential;

wherein the signing of the second service provider credential indicates that the network gateway endorses the second service provider;

wherein the network device is configured to determine the second service provider has replaced the first service provider, and is configured to reenroll with the home network based on the endorsement of the second service provider by the network gateway.

7. The system of claim 6, further comprises means for exchanging secret data between the network device and the network gateway.

8. The system of claim 7, wherein said means for exchanging comprises means for transferring the secret data by inserting a physical device into the network device and the network gateway.

9. The system of claim 6, wherein the means for signing is configured to sign the second service provider credential when the first service provider is replaced with the second service provider.

10. A method comprising:

receiving, with a network gateway of a home network, a first service provider credential indicating the network gateway is registered with a first service provider;

receiving, with the network gateway, a request to reenroll a network device with the home network, wherein the network device was previously enrolled with the home network through a different network gateway that was registered with the first service provider; and

transmitting the first service provider credential and a network gateway credential to the network device, wherein the network gateway credential uniquely identifies the network gateway, wherein at least one of the first service provider credential or the network gateway credential indicates to the network device that the first service provider endorses the network gateway, and wherein the network device is configured to reenroll with the home network through the network gateway based on the first service provider credential and the network gateway credential;

registering the network gateway with a second service provider by receiving a second service provider credential indicating the network gateway is registered with the second service provider;

signing, with the network gateway, the second service provider credential corresponding to the second service provider;

receiving another request to reenroll the network device with the home network; and

transmitting the signed second service provider credential and the network gateway credential to the network device, wherein the network device is configured to reenroll with the home network based on the signed second service provider credential and the network gateway credential;

wherein the second service provider credential corresponding to the second service provider is a transfer certificate that indicates the first service provider endorses the second service provider, and wherein the network device is configured to reenroll with the home network based on the transfer certificate endorsed by the first service provider and the network gateway credential.

11. The method of claim 10, wherein the signing of the second service provider credential with the network gateway is performed when the first service provider is replaced with the second service provider.

12. The method of claim 10, further comprises exchanging secret data between the network device and the network gateway.

13. The method of claim 10, wherein the exchanging comprises transferring the secret data after a physical device is inserted into the network device and the network gateway.

14. The method of claim 10, wherein the signing of the second service provider credential indicates that the network gateway endorses the second service provider.

15. The method of claim 10, wherein the signing of the second service provider credential indicates that the network gateway endorses the second service provider.