AUTHENTICATION OF CONSUMER PREMISE EQUIPMENT

In one embodiment a distribution system includes customer premise equipment that is authenticated to a network that includes a cable modem termination system based upon a DOCSIS authentication. The customer premise equipment receives data from a supplicant device that is interconnected to the network through the customer premise equipment where the supplicant device is authenticated to the network based upon an 802.1X authentication.

BACKGROUND

The subject matter of this application relates to authentication techniques.

Cable Television (CATV) services provide content to large groups of customers (e.g., subscribers) from a central delivery unit, generally referred to as a “head end,” which distributes channels of content to its customers from this central delivery unit through an access network comprising a hybrid fiber coax (HFC) cable plant, including associated components (nodes, amplifiers and taps). Modern Cable Television (CATV) service networks, however, not only provide media content such as television channels and music channels to a customer, but also provide a host of digital communication services such as Internet Service, Video-on-Demand, telephone service such as VoIP, home automation/security, and so forth. These digital communication services, in turn, require not only communication in a downstream direction from the head end, through the HFC, typically forming a branch network and to a customer, but also require communication in an upstream direction from a customer to the head end typically through the HFC network.

To this end, CATV head ends have historically included a separate Cable Modem Termination System (CMTS), used to provide high speed data services, such as cable Internet, Voice over Internet Protocol, etc. to cable customers and a video headend system, used to provide video services, such as broadcast video and video on demand (VOD). Typically, a CMTS will include both Ethernet interfaces (or other more traditional high-speed data interfaces) as well as radio frequency (RF) interfaces so that traffic coming from the Internet can be routed (or bridged) through the Ethernet interface, through the CMTS, and then onto the RF interfaces that are connected to the cable company's hybrid fiber coax (HFC) system. Downstream traffic is delivered from the CMTS to a cable modem and/or set top box in a customer's home, while upstream traffic is delivered from a cable modem and/or set top box in a customer's home to the CMTS. The Video Headend System similarly provides video to either a set-top, TV with a video decryption card, or other device capable of demodulating and decrypting the incoming encrypted video services. Many modern CATV systems have combined the functionality of the CMTS with the video delivery system (e.g., EdgeQAM—quadrature amplitude modulation) in a single platform generally referred to an Integrated CMTS (e.g., Integrated Converged Cable Access Platform (CCAP))—video services are prepared and provided to the I-CCAP which then QAM modulates the video onto the appropriate frequencies. Still other modern CATV systems generally referred to as distributed CMTS (e.g., distributed Converged Cable Access Platform) may include a Remote PHY (or R-PHY) which relocates the physical layer (PHY) of a traditional Integrated CCAP by pushing it to the network's fiber nodes (R-MAC PHY relocates both the MAC and the PHY to the network's nodes). Thus, while the core in the CCAP performs the higher layer processing, the R-PHY device in the remote node converts the downstream data sent from the core from digital-to-analog to be transmitted on radio frequency to the cable modems and/or set top boxes, and converts the upstream radio frequency data sent from the cable modems and/or set top boxes from analog-to-digital format to be transmitted optically to the core.

DETAILED DESCRIPTION

Referring toFIG.1, an integrated CMTS (e.g., Integrated Converged Cable Access Platform (CCAP))100may include data110that is sent and received over the Internet (or other network) typically in the form of packetized data. The integrated CMTS100may also receive downstream video120, typically in the form of packetized data from an operator video aggregation system. By way of example, broadcast video is typically obtained from a satellite delivery system and pre-processed for delivery to the subscriber though the CCAP or video headend system. The integrated CMTS100receives and processes the received data110and downstream video120. The CMTS130may transmit downstream data140and downstream video150to a customer's cable modem and/or set top box160through a RF distribution network, which may include other devices, such as amplifiers and splitters. The CMTS130may receive upstream data170from a customer's cable modem and/or set top box160through a network, which may include other devices, such as amplifiers and splitters. The CMTS130may include multiple devices to achieve its desired capabilities.

Referring toFIG.2, as a result of increasing bandwidth demands, limited facility space for integrated CMTSs, and power consumption considerations, it is desirable to include a Distributed Cable Modem Termination System (D-CMTS)200(e.g., Distributed Converged Cable Access Platform (CCAP)). In general, the CMTS is focused on data services while the CCAP further includes broadcast video services. The D-CMTS200distributes a portion of the functionality of the I-CMTS100downstream to a remote location, such as a fiber node, using network packetized data. An exemplary D-CMTS200may include a remote PHY architecture, where a remote PHY (R-PHY) is preferably an optical node device that is located at the junction of the fiber and the coaxial. In general the R-PHY often includes the PHY layers of a portion of the system. The D-CMTS200may include a D-CMTS230(e.g., core) that includes data210that is sent and received over the Internet (or other network) typically in the form of packetized data. The D-CMTS200may also receive downstream video220, typically in the form of packetized data from an operator video aggregation system. The D-CMTS230receives and processes the received data210and downstream video220. A remote Fiber node280preferably include a remote PHY device290. The remote PHY device290may transmit downstream data240and downstream video250to a customer's cable modem and/or set top box260through a network, which may include other devices, such as amplifier and splitters. The remote PHY device290may receive upstream data270from a customer's cable modem and/or set top box260through a network, which may include other devices, such as amplifiers and splitters. The remote PHY device290may include multiple devices to achieve its desired capabilities. The remote PHY device290primarily includes PHY related circuitry, such as downstream QAM modulators, upstream QAM demodulators, together with psuedowire logic to connect to the D-CMTS230using network packetized data. The remote PHY device290and the D-CMTS230may include data and/or video interconnections, such as downstream data, downstream video, and upstream data295. It is noted that, in some embodiments, video traffic may go directly to the remote physical device thereby bypassing the D-CMTS230. In some cases, the remote PHY and/or remote MAC PHY functionality may be provided at the head end.

By way of example, the remote PHY device290may covert downstream DOCSIS (i.e., Data Over Cable Service Interface Specification) data (e.g., DOCSIS 1.0; 1.1; 2.0; 3.0; 3.1; and 4.0 each of which are incorporated herein by reference in their entirety), video data, out of band signals received from the D-CMTS230to analog for transmission over RF or analog optics. By way of example, the remote PHY device290may convert upstream DOCSIS, and out of band signals received from an analog medium, such as RF or linear optics, to digital for transmission to the D-CMTS230. As it may be observed, depending on the particular configuration, the R-PHY may move all or a portion of the DOCSIS MAC and/or PHY layers down to the fiber node.

Referring toFIG.3, customer premise equipment (e.g., cable modem/set top box/etc.)300may be authenticated by the CMTS310(e.g, D-CMTS/I-CMTS). By way of example, the customer premise equipment300may use a baseline privacy key management (BPKM) protocol to send an authorization request320that includes a customer premise equipment's identity attribute330. The identity attribute330may be based on an X.509 certificate and a concatenation of a Media Access Control (MAC) address, a serial number, a manufacturer identification, and an Rivest Shamir Adleman (RSA) public key for the customer premise equipment300. After receiving the authorization request320, the CMTS310authenticates the customer premise equipment300by validating the X.509 certificate in the identity attribute330using a certificate chain provisioned in the local memory of the CMTS310. When the customer premise equipment300is authorized for cable service the CMTS310uses the BPKM protocol to send back an Authorization Reply message340that includes a locally generated Authorization Key350. Lifetime information and ciphersuite information for the Authorization Key350are included in the Authorization Reply message340. Other techniques may be used to authenticate customer premise equipment to make use of the cable network. By way of example, different protocols may be used to authenticate the customer premise equipment. By way of example, an authentication server may be used to authenticate the customer premise equipment. Preferably, the authentication is based upon the DOCSIS 1.0,1.1; 2.0; 3.0; 3.1; and 4.0 protocols. In general, DOCSIS provisioning is based upon the use of back-office systems that are accessible through dynamic host configuration protocol (DHCP). DHCP is defined by RFC 1541 of October 1993 and/or RFC 2131 March 1997, each of which are incorporated by reference herein in their entirety.

Referring toFIG.4, other networks, such as when a device is attempting to connect to a LAN or WLAN, may require an authentication mechanism, such as IEEE 802.1X. IEEE 802.1X-2020, Feb. 28, 2020, incorporated by reference herein in its entirety. An 802.1X network includes an authentication serer called a RADIUS Server that checks a user's credentials to see if they are an active member of the organization and, depending on the network policies, grant users varying levels of access to the network. This permits unique credentials or certificates to be used per user, eliminating the reliance on a single network password that can be easily stolen.

The 802.1X is a network authentication protocol that opens ports for network access when an organization authenticates a user's identity and authorizes them for access to the network. The user's identity is determined based on their credentials or certificate, which is confirmed by the RADIUS server, which may communicate with an organization's directory, if desired. The standard authentication protocol used on encrypted networks is Extensible Authentication Protocol (EAP), which provides a secure method to send identifying information for network authentication. 802.1X is the standard that is used for passing EAP over wired and wireless local area networks.

The 802.1X authentication process is comprised of four principal steps, initialization, initiation, negotiation, and authentication. The initialization starts when the authenticator detects a new device and attempts to establish a connection. The authenticator port is set to an “unauthorized” state, meaning that only 802.1X traffic will be accepted and every other connection will be dropped. The initiation includes the authenticator starts transmitting EAP-Requests to the new device, which then sends EAP response back to the authenticator. The response usually contains a way to identify the new device. The authenticator receives the EAP response and relays it to the authentication server in a RADIUS access request packet. The negotiation includes the authentication server receiving the request packet, then it will respond with a RADIUS access challenge packet containing the approved EAP authentication method for the device. The authenticator will then pass on the challenge packet to the device to be authenticated. The authentication includes once the EAP method is configured on the device, the authentication server begins sending configuration profiles so the device will be authenticated. Once the process is complete, the port will be set to “authorized” and the device is configured to the 802.1X network.

The DOCSIS protocol does not include support for 801.1X authentication. Accordingly, a device that is configured to be authenticated based upon 802.1X, such as a voice based handheld phone that is interconnected to the customer premise equipment, is not suitable for being authenticated to the DOCSIS based cable network. It is desirable to facilitate the use of devices on a DOCSIS based network that are authenticated using other techniques, such as IEEE 802.1X, which is a port-based Network Access Control technique. In order to accommodate devices that include data transmitted using a DOCSIS based cable network which are authenticated based upon non-DOCSIS techniques, such as IEEE 802.1X, it is desirable to identify the network traffic that is not authenticated using DOCSIS.

Referring toFIG.5, the customer premise equipment500is interconnected to a DOCSIS based cable network that uses a DOCSIS authentication510. A supplicant client520, such as a user device, is interconnected to a port or other connection to the customer premise equipment500. The supplicant client520may be authenticated based upon 802.1X authentication. Other devices, such as laptops, tablets, and other computing devices540are likewise authenticated based upon DOCSIS authentication510. Accordingly, the supplicant client520needs to have its data traffic authenticated in a manner different than that which is done for DOCSIS authentication510. Then once the supplicant client520is authenticated, then it is desirable for its data traffic to be transmitted into the cable network in a typical manner. The manner in which the suppliant client520is authenticated to the DOCSIS network may be performed using an integrated Cable Modem Termination System and/or distributed Cable Modem Termination System. Also, the network system may be based upon DPoE, which is DOCSIS provisioning of Ethernet Passive Optical Network (EPON), which addresses the management and configuration of data transmission over an EPON system. In general, a DPoE network is comprised of an EPON Optical Line Terminal and Optical Network Units which, for the description herein, are considered to be a CMTS and corresponding cable modems. In general, for DOCSIS and/or DPoE based PON systems, dynamic host protocol servers (DHCP) provides the authorization for customer premise equipment by leasing Internet-Protocol addresses to the requesting consumer premise equipment.

Referring toFIG.6, an exemplary network architecture is illustrated where a remote controller (e.g., software entity installed on a remote server) performs 802.1X authentication function for supplicant clients that access the network via cable modems/optical network units registered to distributed access devices. The network architecture may include a customer premise equipment (e.g., a cable modem and/or an optical network unit)600, a distributed access device610, a multi-service operator network620, a remote controller630, an authentication server640, a DHCP server650, and/or a supplicant client660.

Referring toFIG.7, the customer premise equipment600registers with the MSO network620and/or DAA device610(e.g., I-CMTS/D-CMTS/OLT) and configuration settings from customer premise equipment configuration files are applied to, the customer premise equipment600and the MSO network620and/or DAA device610, to support service flows from the customer premise equipment600. Configuration settings on the MSO network620and/or DAA device610indicate whether traffic for each service flow from the customer premise equipment600is subject to 802.1X authentication. In particular, in addition to quality-of-service settings, a service class name definition referenced from the customer premise equipment configuration file for each service flow provides a setting (or a pointer to a setting) to enable 802.1X authentication of customer premise equipment600. This setting (or pointer to the setting) may also be used to specify a unique S-VLAN or Q-VLAN for traffic on that service flow.

The customer premise equipment600will forward all upstream traffic700from the supplicant client660, including EAPoL (extensible authentication protocol over LAN) from the customer premise equipment600, to the service flow710configured for 802.1X authentication. The MSO network620and/or DAA device610will discard720all non-EAPol traffic received from the service flow710.

The MSO network620and/or DAA device610will process730all EAPoL traffic received from the service flow710. In one approach, the DAA device610will tunnel740the EAPoL packets to the remote controller630for processing. The remote controller630performs the 802.1X authenticator role. The remote controller630may use a protocol, such as RADIUS, to consult the authentication server640to approve the media access control (MAC) address of the supplicant client660. By way of example, the authentication process may involve, (1) an EAPoL-request identity750, (2) an EAPoL-response identity752, (3) a request754, (4) a challenge756, (5) an EAPoL-request challenge758, (6) an EAPoL-response challenge760, (7) a request762, (8) an accept764, and (9) an EAPoL-success766. As a result, the authentication server640may successfully authenticate768a supplicant device660MAC address.

An 802.1X authenticator (e.g., the remote controller630and/or DAA device610) updates a forwarding table770to bind772the supplicant client660MAC address to the customer premise equipment600MAC address, and permit forwarding to and from the supplicant client660. In this manner, the MAC address of the supplicant device is added to the forwarding table. The supplicant client660DHCP traffic774(discover/offer/request/acknowledge) is permitted on the network and the supplicant client660may obtain an IP address lease from the DHCP server 650. Periodically, the 802.1X authenticator (e.g., the remote controller630and/or DAA device610) may re-authenticate the MAC of the supplicant device660. The IP address776of the suppliant device is added to the forwarding table. The suppliant device660is permitted to access the network780to send and receive data782, with its MAC address and IP address of the supplicant client660added to the forwarding table.

When the MAC address of the supplicant device660is not successfully re-authenticated, the 802.1X authenticator updates the DAA device610forwarding table to remove the MAC address binding to the supplicant device660and/or to reject forwarding to/from the MAC address of the supplicant device660.

Referring toFIG.8and toFIG.9, another exemplary network architecture is illustrated together with a process description. In the approach shown inFIG.8andFIG.9, the CMTS/OLT may directly process the EAPoL packets and perform the 802.1X authenticator process, by using a protocol, such as RADIUS, to consult the authentication server to approve the media access control (MAC) address of the supplicant client.

It will be appreciated that the invention is not restricted to the particular embodiment that has been described, and that variations may be made therein without departing from the scope of the invention as defined in the appended claims, as interpreted in accordance with principles of prevailing law, including the doctrine of equivalents or any other principle that enlarges the enforceable scope of a claim beyond its literal scope. Unless the context indicates otherwise, a reference in a claim to the number of instances of an element, be it a reference to one instance or more than one instance, requires at least the stated number of instances of the element but is not intended to exclude from the scope of the claim a structure or method having more instances of that element than stated. The word “comprise” or a derivative thereof, when used in a claim, is used in a nonexclusive sense that is not intended to exclude the presence of other elements or steps in a claimed structure or method.