Activation, initialization, authentication, and authorization for a multi-services gateway device at user premises

• US 8,205,240 B2
• Filed: 12/28/2007
• Issued: 06/19/2012
• Est. Priority Date: 12/29/2006
• Status: Active Grant

• Current Assignee: Tyson King
• Original Assignee: Prodea Systems, Inc.
• Inventors: Ansari, Amir, Cowgill, George A., Masina, Ramprakash, Ramayya, Jude P., McQuarters, Alvin R., Raissyan, Atousa, Nicholls, Leon E., Erhart, Wesley R., Cooper, Michael P.
• Primary Examiner(s): Truong, Thanhnga B
• Assistant Examiner(s): Jeudy, Josnel
• Application Number:
  US11/966,884
• Publication Number:
  US 20080189774A1
• Time in Patent Office: 1,635 Days
• Field of Search: 726 1- 8, 726 27- 30, 709/229, 713168-172
• US Class Current: 726/1
• CPC Class Codes: G05B 15/02 electric
• CPC Class Codes: G05B 19/042 using digital processors G05B19/05 takes precedence
• CPC Class Codes: G05B 2219/2642 Domotique, domestic, home control, automation, smart house
• CPC Class Codes: G06F 16/64 Browsing; Visualisation therefor generation of a list or set of audio data G06F16/638
• CPC Class Codes: G06F 16/68 Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G08B 13/19656 Network used to communicate with a camera, e.g. WAN, LAN, Internet
• CPC Class Codes: G10L 15/22 Procedures used during a speech recognition process, e.g. man-machine dialogue
• CPC Class Codes: G10L 2015/223 Execution procedure of a spoken command
• CPC Class Codes: H04L 12/2803 Home automation networks
• CPC Class Codes: H04L 12/2807 Exchanging configuration information on appliance services in a home automation network arrangements for maintenance or administration involving network analysis for automatically determining the actual topology of a network H04L41/12; hardware or software tools for network management using graphical user interfaces H04L41/22; address allocation H04L61/50
• CPC Class Codes: H04L 12/2812 describing content present in a home automation network, e.g. audio video content retrieval from the Internet G06F16/95
• CPC Class Codes: H04L 12/2814 Exchanging control software or macros for controlling appliance services in a home automation network arrangements for maintenance or administration involving configuration of the network and network elements H04L41/08
• CPC Class Codes: H04L 12/2816 Controlling appliance services of a home automation network by calling their functionalities arrangements in telecontrol or telemetry systems for selectively calling a substation from a main station; in which substation desired apparatus is selected for applying a control signal thereto or for obtaining measured values therefrom H04Q9/00
• CPC Class Codes: H04L 12/2818 from a device located outside both the home and the home network access arrangements H04L12/2856; for remote control or remote monitoring of applications H04L67/025; arrangements for transmitting signals characterised by the use of a wireless eletrical link G08C17/00; telephonic communication systems adapted for combination with remote control systems H04M11/007
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 2012/2849 Audio/video appliances
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 47/80 : Actions related to the user profile or the type of traffic
• CPC Class Codes: H04L 47/83 : based on usage prediction
• CPC Class Codes: H04L 49/25 : Routing or path finding in a switch fabric
• CPC Class Codes: H04L 61/4552 : Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 63/02 : for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 : based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/102 : Gateways arrangements for connecting between networks having differing types of switching systems, e.g. gateways, H04L12/66
• CPC Class Codes: H04L 65/1101 : Session protocols
• CPC Class Codes: H04L 65/1108 : Web based protocols, e.g. webRTC
• CPC Class Codes: H04L 67/01 : Protocols
• CPC Class Codes: H04L 67/104 : Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/125 : involving control of end-device applications over a network
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/53 : using third party service providers
• CPC Class Codes: H04L 69/325 : in the network layer [OSI layer 3], e.g. X.25 H04L69/16 takes precedence
• CPC Class Codes: H04N 21/00 : Selective content distribution, e.g. interactive television or video on demand [VOD] real-time bi-directional transmission of motion video data H04N7/14 ; broadcast or conference over packet switching networks H04L12/18
• CPC Class Codes: H04N 21/40 : Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
• CPC Class Codes: H04N 7/181 : for receiving images from a plurality of remote sources
• CPC Class Codes: H04W 12/00 : Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/033 : of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/0431 : Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/065 : Continuous authentication
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 12/35 : Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 4/80 : Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: Y10S 370/911 : Bridge, e.g. brouter, bus extender

Abstract

A method of putting a first gateway device into service, the first gateway device having an application service module and a network module enabling communications between the first gateway device and the activation manager, the application service module residing on a user premises side of a network service provider demarcation. The method comprises identifying, at the first gateway device disposed at a user premises, an activation manager in communication with the first gateway device, transmitting, from the first gateway device, an activation certificate to the activation manager for verification and authentication, generating a service authentication key associated with the first gateway device, storing the service authentication key and an indication that the associated gateway device status is activated in a database, determining the services available to the first gateway device, and transmitting the service authentication key and an identification of the available services to the first gateway device.

Claims

1. A method of putting a first gateway device into service, the first gateway device having an application service module and a network module enabling communications between the first gateway device and an activation manager across a wide area network, the application service module controlled by an application services provider and residing on a user premises side of a network service provider demarcation, the method comprising:

providing the first gateway device in a non-activated state, wherein the first gateway device includes;

a service manager configured to control an activation and authentication process of the first gateway device, the service manager further configured to associate an endpoint device and a user of the endpoint device with the first gateway device;

a state manager configured to store a state status of the first gateway device that is utilized by the service manager in controlling the activation and authentication process of the first gateway device, wherein the state status is at least one of non-activated, activation pending, activated, and authenticated;

a connection client configured to form a secure communication channel between the first gateway device and the activation manager across the wide area network; and

a service interface module in communication with the connection client and configured to interface with the wide area network to form the secure communication channel between the first gateway device and the activation manager, the service interface module further configured to provide activation status indications to the endpoint device associated with the first gateway device;

assigning to the first gateway device a unique serial number, an activation certificate, a private key, and an activation code, wherein the unique serial number, the activation certificate, the private key, and the activation code are all different from each other, wherein the activation certificate certifies that the first gateway device is trusted by the activation manager;

initiating, by the service manager of the first gateway device, the activation and authentication process independent of the user of the endpoint device performing any user navigation steps on a user interface associated with either the endpoint device or the first gateway device;

forming, by the connection client of the first gateway device, the secure communication channel between the first gateway device and the activation manager across the wide area network by utilizing the service interface module;

sending, by the first gateway device, a first activation request to the activation manager via the secure communication channel for activation and authentication of the first gateway device, the first activation request including the unique serial number and the activation certificate;

determining by the activation manager, after the sending of the first activation request to the activation manager, that the user of the endpoint device was provided the activation code;

sending, by the activation manager, a request for the activation code to the first gateway device via the secure communication channel;

sending, by the endpoint device associated with the first gateway device, the activation code to the service interface module of the first gateway device;

sending, by the service manager of the first gateway device, a second activation request to the activation manager via the secure communication channel, the second activation request including the unique serial number, the activation certificate, and the activation code received from the endpoint device;

verifying, by the activation manager, the first gateway device using the unique serial number, the activation certificate, and the activation code from the second activation request;

sending, by the activation manager, the second activation request to an authentication manager after the first gateway device has been verified by the activation manager in order to activate and authenticate the first gateway device;

verifying, by the authentication manager, the first gateway device using the unique serial number, the activation certificate, and the activation code from the second activation request;

generating, by the authentication manager, a service authentication key associated with the first gateway device after the first gateway device has been verified by the authentication manager to confirm that the first gateway device is activated and authenticated;

storing the service authentication key and an indication that the associated gateway device status is activated in a database, the database being external to the user premises;

determining a subscription information of the first gateway device, the subscription information includes application services available to the first gateway device provided by the application service provider;

sending, by the activation manager, the service authentication key and an identification of the available services to the first gateway device;

after the first gateway device has received the service authentication key, sending, by the service manager of the first gateway device, a gateway authentication certificate request to the activation manager via the secure communication channel; and

sending, by the activation manager, a gateway authentication certificate to the first gateway device, the gateway authentication certificate representing transfer of the application service provider'"'"'s trust to the first gateway device such that whenever the endpoint device accesses the first gateway device the gateway authentication certificate assures the endpoint device that the first gateway device is trusted by the application service provider.

2. The method of claim 1, further comprising:

sending, by the activation manager, the gateway authentication certificate request to a certificate server;

issuing the gateway authentication certificate by the certificate server and sending the gateway authentication certificate to the activation manager, the gateway authentication certificate to be used to for peer-to-peer authentication of a second gateway device.

3. The method of claim 1, further comprising:

sending, from the activation manager, the gateway authentication certificate request for the gateway authentication certificate to a certificate server;

verifying, by the certificate server, the first gateway device and generating, once verified, the gateway authentication certificate for the first gateway device; and

sending, from the certificate server, the gateway authentication certificate to the activation manager;

sending, from the activation manager, the gateway authentication certificate to the first gateway device; and

presenting, by the first gateway device, the gateway authentication certificate to the endpoint device accessing one of the application services available to the first gateway device that is provided by the application service provider through the first gateway device to assure the endpoint device that the first gateway device has the trust of the application service provider.

4. The method of claim 1, further comprising:

issuing the activation code to the user of the endpoint device at a time of ordering the first gateway device by the user, the activation code associated with and unique to the user and the first gateway device;

receiving at the endpoint device, from the first gateway device, the request for the activation code; and

prompting, by the first gateway device, the user for the activation code independent of the user invoking any service or navigation requests on the user interface associated with either the endpoint device or the first gateway device.

5. The method of claim 1, wherein generating a service authentication key comprises generating the service authentication key at the authentication manager.

6. The method of claim 1, further comprising associating the first gateway device with the application service provider.

7. The method of claim 1, further comprising sending, from the activation manager, the gateway authentication certificate request to a certificate manager for issuance of the gateway authentication certificate.

8. The method of claim 1, further comprising directing the first gateway device to the application service provider in response to the identification of the available services to the first gateway device.

9. The method of claim 1, wherein the activation manager is external to the user premises and independent of any application service provider.

10. The method of claim 1, further comprising:

establishing a connection, at the first gateway device, to a remote service manager;

sending, from the first gateway device, an authentication request for an application service based on the identified available services to the remote service manager, the request including the service authentication key associated with the application service;

sending the authentication request, including the service authentication key, to the authentication manager;

verifying, by the authentication manager, the service authentication key and that the first gateway device status is activated; and

thereafter accessing the application service by the first gateway device using the verified service authentication key.

11. The method of claim 1, wherein generating a service authentication key further comprises generating a key for application services.

12. The method of claim 1, wherein generating a service authentication key further comprises generating at least one service key for at least one of web service, voice service, movie service, music service, file-sharing service, file-backup service, gaming service, advertising service, and food-ordering service.

13. The method of claim 1, wherein generating a service authentication key further comprises generating the service authentication key with a validation parameter, the validation parameter specifying a circumstance under which the service key is valid.

14. The method of claim 1, wherein generating a service authentication key further comprises generating a new service authentication key on a periodic basis.

15. The method of claim 1, further comprising sending a renewal request to renew the service authentication key.

16. The method of claim 1, further comprising sending a current service configuration to the first gateway device.

17. The method of claim 1, wherein generating a service authentication key comprises generating a plurality of service authentication keys for a plurality of gateway devices.

20. The method of claim 1, wherein assigning to the first gateway device the activation certificate includes assigning to the first gateway device the activation certificate during manufacturing of the first gateway device.

21. The method of claim 20, wherein assigning to the first gateway device the activation certificate during manufacturing of the first gateway device includes storing the activation certification in the first gateway device.

22. The method of claim 21, wherein the activation certificate includes a public key certificate that is cryptographically locked to the first gateway device.

18. A system comprising:

a remote service manager coupled to a network;

an activation manager coupled to the network, the activation manager being independent of the remote service manager, the activation manager operable to;

determine whether a user of an endpoint device was provided an activation code;

send a request for the activation code to a gateway device;

verify the gateway device using a unique serial number of the gateway device, an activation certificate, and the activation code sent to the activation manager from the gateway device;

communicate with an authentication manager after the gateway device has been verified by the activation manager in order to activate and authenticate the gateway device and receive a service authentication key; and

send the service authentication key and an identification of the available services to the gateway device;

the authentication manager in communication with the activation manager and operable to;

verify the gateway device using the unique serial number, the activation certificate, and the activation code sent from the activation manager to the authentication manager;

generate the service authentication key associated with the gateway device after the gateway device has been verified by the activation manager to confirm that the gateway device is activated and authenticated; and

send a gateway authentication certificate to the activation manager, the gateway authentication certificate representing transfer of an application service provider'"'"'s trust to the gateway device;

the gateway device disposed at a user premises and in communication with the activation manager via the network, the gateway device comprises;

an application service module residing on a user premises side of a network service provider demarcation of the network;

a network module having a connection to the network that enables bi-directional communications with the activation manager;

a connection client configured to form a secure communication channel between the gateway device and the activation manager across the network; and

a service interface module in communication with the connection client and configured to interface with the network to form the secure communication channel between the gateway device and the activation manager, the service interface module further configured to provide activation status indications to the endpoint device associated with the gateway device;

a storage operable to store the unique serial number, the activation certificate, a private key, and the activation code assigned to the gateway device, wherein the unique serial number, the activation certificate, the private key, and the activation code are all different from each other, wherein the activation certificate certifies that the gateway device is trusted by the activation manager;

a service manager operable to;

control an activation and authentication process of the gateway device;

associate an endpoint device and a user of the endpoint device with the gateway device;

initiate the activation and authentication process independent of the user of the endpoint device performing any user navigation steps on a user interface associated with either the endpoint device or the gateway device;

send a first activation request to the activation manager via the secure communication channel for activation and authentication of the gateway device, the first activation request including the unique serial number and the activation certificate;

send the request for the activation code to the endpoint device of the gateway device such that the endpoint device prompts the user for the activation code independent of the user invoking any service or navigation requests on a user interface associated with either the endpoint device or the gateway device;

send a second activation request to the activation manager via the secure communication channel in response to receiving the request for the activation code from the activation manager, the second activation request including the unique serial number, the activation certificate, and the activation code received from the endpoint device;

receive the service authentication key and the identification of available services to the gateway device from the activation manager using the network module;

send the gateway authentication certificate request to the activation manager via the secure communication channel after the gateway device has received the service authentication key, and

receive the gateway authentication certificate from the authentication manger, the gateway authentication certificate representing transfer of the application service provider'"'"'s trust to the gateway device such that whenever the endpoint device accesses the gateway device the gateway authentication certificate assures the endpoint device that the gateway device is trusted by the application service provider;

a state manager configured to store a state status of the gateway device that is utilized by the service manager in controlling the activation and authentication process of the gateway, wherein the state status is at least one of non-activated, activation pending, activated, and authenticated,

wherein the gateway device is unassociated with and non-managed by the remote service manager until the activation manager assigns the gateway device to the remote service manager.

19. A system comprising:

a remote service manager coupled to a network;

an application service provider coupled to the network;

an activation manager coupled to the network, the activation manager operable to;

verify a gateway device using a unique serial number of the gateway device and an activation certificate sent to the activation manager from the gateway device;

communicate with an authentication manager after the gateway device has been verified by the activation manager in order to activate and authenticate the gateway device and receive a service authentication key; and

send the service authentication key and an identification of the available services to the gateway device;

the authentication manager in communication with the activation manager and operable to;

verify the gateway device using the unique serial number and the activation certificate sent from the activation manager to the authentication manager;

generate the service authentication key associated with the gateway device after the gateway device has been verified by the activation manager to confirm that the gateway device is activated and authenticated; and

send a gateway authentication certificate to the activation manager, the gateway authentication certificate representing transfer of the application service provider'"'"'s trust to the gateway device;

a gateway device disposed at a user premises and in communication with the activation manager via the network, the gateway device being agnostic to the remote service manager and the application service provider, the gateway device comprises;

an application service module residing on a user premises side of a network service provider demarcation of the network;

a network module having a connection to the network that enables bi-directional communications with the activation manager; and

a connection client configured to form a secure communication channel between the first gateway device and the activation manager across the network; and

a service interface module in communication with the connection client and configured to interface with the network to form the secure communication channel between the gateway device and the activation manager, the service interface module further configured to provide activation status indications to the endpoint device associated with the gateway device;

a storage operable to store the unique serial number, the activation certificate, and a private key, wherein the unique serial number, the activation certificate, and the private key are all different from each other, wherein the activation certificate certifies that the gateway device is trusted by the activation manager;

a service manager operable to;

control an activation and authentication process of the gateway device;

associate an endpoint device and a user of the endpoint device with the gateway device;

initiate the activation and authentication process independent of the user of the endpoint device performing any user navigation steps on a user interface associated with either the endpoint device or the gateway device;

send an activation request to the activation manager via the secure communication channel for activation and authentication of the gateway device, the activation request including the unique serial number and the activation certificate;

receive the service authentication key and the identification of available services to the gateway device from the activation manager using the network module;

send the gateway authentication certificate request to the activation manager via the secure communication channel after the gateway device has received the service authentication key, and

receive the gateway authentication certificate from the authentication manger, the gateway authentication certificate representing transfer of the application service provider'"'"'s trust to the gateway device such that whenever the endpoint device accesses the gateway device the gateway authentication certificate assures the endpoint device that the gateway device is trusted by the application service provider,

a state manager configured to store a state status of the gateway device that is utilized by a service manager in controlling the activation and authentication of the gateway, wherein the state status is at least one of non-activated, activation pending, activated, and authenticated.

23. The system of claim 19, wherein the remote service manager stores the gateway device'"'"'s activation state, the activation state of the gateway device providing information relevant to whether a gateway is activated and able to be managed by the remote service manager,

wherein the remote service manager stores configuration information of the gateway device, the configuration information representing a current configuration of the gateway device with respect to various application services and hardware resources associated with the gateway device,

wherein the remote service manager stores location information of the gateway device, the location information represents a location of the gateway device within the network such that the gateway device can be accessed by using the location information;

wherein the remote service manager stores a service provider ID of the gateway device, the service provider ID identifies the application service provider that the gateway device has been associated with to provide application services to the gateway device, and

wherein the remote service manager stores subscription information of the gateway device, the subscription information identifies application services provided by the application service provider that a user has subscribed to and thereby accessible by the gateway device.

24. A method comprising:

providing a gateway device in a non-activated state, wherein the gateway device includes;

a service manager configured to control an activation and authentication process of the gateway device, the service manager further configured to associate an endpoint device and a user of the endpoint device with the gateway device;

a state manager configured to store a state status of the gateway device that is utilized by the service manager in controlling the activation and authentication process of the gateway device, wherein the state status is at least one of non-activated, activation pending, activated, and authenticated;

a connection client configured to form a secure communication channel between the gateway device and an activation manager across a wide area network; and

a service interface module in communication with the connection client and configured to interface with a wide area network to form the secure communication channel between the gateway device and the activation manager, the service interface module further configured to provide activation status indications to the endpoint device associated with the gateway device;

assigning to the gateway device a unique serial number, an activation certificate, and a private key, wherein the unique serial number, the activation certificate, and the private key are all being different from each other, wherein the activation certificate certifies that the gateway device is trusted by the activation manager;

initiating, by the service manager of the gateway device, the activation and authentication process independent of the user of the endpoint device performing any user navigation steps on a user interface associated with either the endpoint device or the gateway device;

forming, by the connection client of the gateway device, the secure communication channel between the gateway device and the activation manager across the wide area network by utilizing the service interface module;

sending, by the gateway device, an activation request to the activation manager via the secure communication channel for activation and authentication of the gateway device, the activation request including the unique serial number and the activation certificate;

verifying, by the activation manager, the gateway device using the unique serial number and the activation certificate from the activation request;

sending, by the activation manager, the activation request to an authentication manager after the gateway device has been verified by the activation manager in order to activate and authenticate the gateway device;

verifying, by the authentication manager, the gateway device using the unique serial number and the activation certificate from the activation request;

generating, by the authentication manager, a service authentication key associated with the gateway device after the gateway device has been verified by the activation manager to confirm that the gateway device is activated and authenticated;

determining a subscription information of the gateway device, the subscription information includes an identification of application services available to the gateway device provided by an application service provider;

sending, by the activation manager, the service authentication key and the identification of the application services available to the gateway device;

after the gateway device has received the service authentication key, sending, by the service manager of the gateway device, a gateway authentication certificate request to the activation manager via the secure communication channel; and

sending, by the activation manager, a gateway authentication certificate to the gateway device, the gateway authentication certificate representing transfer of the application service provider'"'"'s trust to the gateway device such that whenever the endpoint device accesses the gateway device the gateway authentication certificate assures the endpoint device that the gateway device is trusted by the application service provider.

25. The method of claim 24, wherein the connection client is a representational state transfer (REST) client,

wherein the secure communication channel includes a Hyper-Text Transfer Protocol with Secure Socket Layer (HTTPS) connection, and

wherein the service interface module is a web service interface.

26. The method of claim 24, wherein the service interface module provides at least one of a web service interface, a television interface, and a session initiation protocol interface.

27. The method of claim 24, wherein the gateway device further includes a control channel module configured to form a control channel between the gateway device and a designated service management center across the wide area network.

28. The method of claim 27, further comprising

establishing the control channel between the gateway device and the designated service management center, the control channel being different than the secure communication channel;

sending, from the gateway device, an authentication request for an application service based on the identified available application services across the control channel to the designated service management center, the request including the service authentication key associated with the application service;

sending the authentication request, including the service authentication key, to the authentication manager;

verifying, by the authentication manager, the service authentication key and that the gateway device status is activated; and

thereafter accessing the application service by the gateway device using the verified service authentication key.

29. The method claim 28, further comprising sending, by the service manager of the gateway device, a renewal request across the control channel to the authentication manager to renew the service authentication key.

30. The method of claim 28, further comprising sending, by the service manager of the gateway device, a configuration request for a service configuration update to the designated service management center across the control channel;

receiving, at the gateway device, the service configuration update from the designated service management center across the control channel; and

updating a service configuration of the gateway device based on the received service configuration update.

31. The method of claim 28, sending, by the designated service management center, a new service authentication key on a predetermined periodic basis to the gateway device.

32. A method comprising:

providing a gateway device in a non-activated state, wherein the gateway device includes;

a service manager configured to control an activation and authentication process of the gateway device, the service manager further configured to associate an endpoint device and a user of the endpoint device with the gateway device;

a state manager configured to store a state status of the gateway device that is utilized by the service manager in controlling the activation and authentication of the gateway device, wherein the state status is at least one of non-activated, activation pending, activated, and authenticated;

a connection client configured to form a secure communication channel between the gateway device and an activation manager across the wide area network;

a control channel module configured to form a control channel between the gateway device and a designated service management center across the wide area network, the control channel being different than the secure communication channel and be configured for requesting service configuration updates for the gateway device from the designated service management center;

a service interface module in communication with the connection client and configured to interface with the wide area network to form the secure communication channel between the gateway device and the activation manager, the service interface module further configured to provide activation status indications to the endpoint device associated with the gateway device;

assigning to the gateway device a unique serial number, an activation certificate, a private key, and an activation code, wherein the unique serial number, the activation certificate, the private key, and the activation code are all different from each other, wherein the activation certificate is assigned to the gateway device at time of manufacturing and the activation certificate certifies that the gateway device is trusted by the activation manager;

initiating, by the service manager of the gateway device, the activation and authentication process independent of the user of the endpoint device performing any user navigation steps on a user interface associated with either the endpoint device or the gateway device;

sending, by the service manager of the gateway device, a first activation request to the connection client;

forming, by the connection client of the gateway device, the secure communication channel between the gateway device and the activation manager across the wide area network by utilizing the service interface module in response to the first activation request;

sending, by the gateway device, the first activation request to the activation manager via the secure communication channel for activation and authentication of the gateway device independent of the user of the endpoint device performing any user navigation steps on the user interface associated with either the endpoint device or the gateway device, the first activation request including the unique serial number and the activation certificate;

determining by the activation manager, after the sending of the first activation request to the activation manager, that the user of the endpoint device was provided the activation code;

sending, by the activation manager, a request for the activation code to the gateway device via the secure communication channel;

providing an activation status indication on the endpoint device requesting the activation code from the user of the endpoint device;

sending, by the endpoint device associated with the gateway device, the activation code to the service interface module of the gateway device;

sending, by the service manager of the gateway device, a second activation request to the activation manager via the secure communication channel, the second activation request including the unique serial number, the activation certificate, and the activation code received from the endpoint device;

verifying, by the activation manager, the gateway device using the unique serial number, the activation certificate, and the activation code from the second activation request;

sending, by the activation manager, the second activation request to an authentication manager after the gateway device has been verified by the activation manager in order to activate the gateway device;

verifying, by the authentication manager, the gateway device using the unique serial number, the activation certificate, and the activation code from the second activation request;

generating, by the authentication manager, a service authentication key associated with the gateway device after the gateway device has been verified by the activation manager to confirm that the gateway device is activated and authenticated;

storing the service authentication key and an indication that the associated gateway device status is activated in a database, the database being external to the user premises;

sending, by the authentication manager, the service authentication key to the activation manager;

determining a subscription information of the gateway device, the subscription information includes an application service available to the gateway device provided by an application service provider;

sending, by the activation manager, the service authentication key and an identification of the available services to the gateway device;

storing the service authentication key in a storage area on the gateway device, the service authentication key enables authorization for receiving services at the endpoint device being obtained through the gateway device without having to resort to the activation manager and the authentication manager;

updating, by the service manager of the gateway device, the state status of the gateway device to activated after receiving the service authentication key;

after updating the state status of the gateway device to activated, sending, by the service manager of the gateway device, a gateway authentication certificate request to the activation manager via the secure communication channel;

sending, by the activation manager, the gateway authentication certificate request to a certificate server;

verifying, by the certificate server, the gateway device and generating, once verified, a gateway authentication certificate for the gateway device;

sending, by the certificate server, the gateway authentication certificate to the activation manager; and

sending, by the activation manager, the gateway authentication certificate to the gateway device, the gateway authentication certificate representing transfer of the application service provider'"'"'s trust to the gateway device such that whenever the endpoint device accesses the gateway device the gateway authentication certificate assures the endpoint device that the gateway device is trusted by the application service provider.

33. The method of claim 32, wherein sending, by the activation manager, the service authentication key and an identification of the available services to the gateway device includes sending, by the activation manager, the subscription information, including data about the designated service management center, to the gateway device.

34. The method of claim 32, wherein providing the activation status indication on the endpoint device requesting the activation code from the user of the endpoint device occurs prior to the endpoint device sending the activation code to the gateway device, and

wherein providing the activation status on the endpoint device occurs independent of the user of the endpoint device invoking any service or navigation requests on the user interface associated with either the endpoint device or the gateway device.

35. The method of claim 32, wherein the connection client is a representational state transfer (REST) client,

wherein the secure communication channel includes a Hyper-Text Transfer Protocol with Secure Socket Layer (HTTPS) connection, and

wherein the service interface module is a web service interface module.

36. The method of claim 32, wherein the service interface module provides at least one of a web service interface, a television interface, and a session initiation protocol interface.

37. The method of claim 32, further comprising

establishing the control channel between the gateway device and the designated service management center, the control channel being different than the secure communication channel;

sending, from the gateway device, an authentication request for the application service across the control channel to the designated service management center, the request including the service authentication key associated with the application service;

sending the authentication request, including the service authentication key, to the authentication manager;

verifying, by the authentication manager, the service authentication key and that the gateway device status is activated; and

thereafter accessing the application service by the gateway device using the verified service authentication key.

38. The method claim 37, further comprising sending, by the service manager of the gateway device, a renewal request across the control channel to the authentication manager to renew the service authentication key.

39. The method of claim 37, further comprising sending, by the service manager of the gateway device, a configuration request for a service configuration update to the designated service management center across the control channel;

receiving, at the gateway device, the service configuration update from the designated service management center across the control channel; and

updating a service configuration of the gateway device based on the received service configuration update.

40. The method of claim 32, sending, by the designated service management center, a new service authentication key on a predetermined periodic basis to the gateway device.

41. The method of claim 32, wherein generating, by the authentication manager, the service authentication key further comprises generating at least one service key for at least one of web service, voice service, movie service, music service, file-sharing service, file-backup service, gaming service, advertising service, and food-ordering service.

42. The method of claim 32, wherein generating, by the authentication manager, the service authentication key further comprises generating the service authentication key with a validation parameter, the validation parameter specifying a circumstance under which the service key is valid.