Authorizing customer premise equipment on a sub-network

• US 8,112,358 B2
• Filed: 01/07/2008
• Issued: 02/07/2012
• Est. Priority Date: 06/04/2007
• Status: Expired due to Fees

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm Atheros Incorporated (Qualcomm, Inc.)
• Inventors: Yonge, Lawrence W. III, Katar, Srinivas, Krishnam, Manjunath
• Primary Examiner(s): Hewitt, II, Calvin L
• Assistant Examiner(s): MUHAMMAD, KHALIF R
• Application Number:
  US11/970,323
• Publication Number:
  US 20080301052A1
• Time in Patent Office: 1,492 Days
• Field of Search: 713/163, 705/59
• US Class Current: 705/50
• CPC Class Codes: H04B 2203/5445 Local network
• CPC Class Codes: H04L 12/2801 Broadband local area networks
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/413 with random access, e.g. carrier-sense multiple-access with collision detection [CSMA-CD]
• CPC Class Codes: H04L 12/44 Star or tree networks
• CPC Class Codes: H04L 45/12 Shortest path evaluation
• CPC Class Codes: H04L 45/121 by minimising delays
• CPC Class Codes: H04L 45/122 by minimising distances, e.g. by selecting a route with minimum of number of hops
• CPC Class Codes: H04L 45/123 Evaluation of link metrics techniques for monitoring network metrics H04L43/08
• CPC Class Codes: H04L 45/125 based on throughput or bandwidth
• CPC Class Codes: H04L 45/16 Multipoint routing
• CPC Class Codes: H04L 47/787 Bandwidth trade among domains

Abstract

Systems and methods for authorizing a customer premise equipment (CPE) device to join a network through a network termination unit (NTU). The CPE device can send an encrypted connection request, and an authorization server can decrypt the connection request and provide a network membership key (NMK) associated with the CPE device to the NTU. The authorization server can encrypt the NMK associated with the CPE device using a device access key (DAK) associated with the NTU.

Claims

1. A computer implemented method comprising:

receiving an encrypted connection request from a customer premise equipment device at

a network termination unit, the encrypted connection request being encrypted using a network membership key;

forwarding the encrypted connection request to an authorization server;

receiving, at a network termination unit, an encrypted network membership key from the authorization server, the encrypted network membership key being encrypted using a device access key associated with the network termination unit;

decrypting, by the network termination unit, the encrypted network membership key using the device access key; and

authorizing, by the network termination unit, the customer premise equipment device to join a subnet associated with the network termination unit.

2. The method of claim 1, wherein the encrypted connection request includes a first unique identifier associated with the network termination unit.

3. The method of claim 2, wherein the authorization server is operable to authorize the customer premise equipment based upon decryption of the encrypted connection request using a known network membership key associated with a second unique identifier associated with the customer premise equipment device.

4. The method of claim 3, wherein the authorization server is operable to determine whether the first unique identifier included in the encrypted connection request matches the network termination unit receiving the encrypted connection request.

5. The method of claim 1, wherein the network membership key comprises a unique network membership key.

6. The method of claim 1, further comprising providing by the network termination unit, a network encryption key to the customer premise equipment device.

12. The method of claim 6, wherein the network encryption key is encrypted using the network membership key obtained from the authorization server.

13. The method of claim 1, further comprising:

determining, by the authorization server, whether a second unique identifier associated with the network termination unit is encrypted within the forwarded connection request.

14. The method of claim 1, wherein the network membership key comprises a unique network membership key associated with the customer premise equipment device.

15. The method of claim 6, wherein the network encryption key is unique to the customer premise equipment.

7. A system comprising:

an authorization server computer; and

a network termination unit comprising;

A processor;

A computer readable storage media storing executable instructions that when executed by the processor causes the processor to perform the steps of;

receiving an encrypted connection request from a customer premise equipment device, the encrypted connection request being encrypted using a network membership key,

forwarding the encrypted connection request to the authorization server,

receiving an encrypted network membership key from the authorization server, the encrypted network membership key being encrypted using a device access key associated with the network termination unit;

decrypting the encrypted network membership key using the device access key, and authorizing the customer premise equipment device to join a subnet associated with the network termination unit.

8. The system of claim 7, wherein the authorization server is further operable to encrypt the network membership key prior to providing the network membership key to the network termination unit.

9. The system of claim 7, wherein the encrypted connection request includes a unique identifier, and the authorization server is operable to authorize the encrypted connection request based on whether an identifier associated with the network termination unit matches the unique identifier.

10. The system of claim 7, wherein the network termination unit is operable to provide a network encryption key to the customer premise equipment device based upon receipt of the network membership key.

11. The system of claim 10, wherein the network encryption key provided to the customer premise equipment device is encrypted using the network membership key obtained from the authorization server.