Patent Description:
Furthermore, the present invention relates to a system comprising a customer premises equipment and a broadband access network for operating the customer premises equipment with the broadband access network, wherein the broadband access network comprises at least one access node, wherein a specific access node of the broadband access network is enabled to operatively connect the customer premises equipment to a telecommunications network in view of providing communication services and/or communication access services to a user related or connected to the customer premises equipment, wherein the broadband access network comprises a service edge entity or functionality and a policy controller entity or functionality as well as a business support system entity or functionality.

Furthermore, the present invention relates to a program and to a computer-readable medium for operating a customer premises equipment with a broadband access network of a telecommunications network.

The demand for packetized information exchange in broadband communication systems or telecommunications networks, both in fixed-line as in wireless communication systems (or fixed-line communication networks and mobile communication networks) has already grown dramatically and probably will also grow in the future due to the rapid spread of different data services in such communication networks.

In conventionally known telecommunications networks, providing a customer or subscriber with operational communication services typically requires a contractual relationship between such customer or subscriber and a network operator or service provider, i.e. especially being provided with fixed line connectivity implies such a contractual relationship to be established first and before the customer receives such connectivity.

Typically, in conventionally known telecommunications networks, the customer receives a username and password or is provided with a line ID information (especially in case a broadband network gateway platform, BNG platform, is used) assigned to the connection. Such pieces of information are then transmitted to the broadband network gateway or other controlling instance (e.g. PFS), especially via PADI (IA) or DHCP discovery in TLV2.

Customers can therefore only begin to be provided with communication services, or put their connection into operation, after conclusion of the contract and reception of the network key from the network operator or service provider for identification. This assignment of the network key and the connection to the customer is also called federation.

Typically regarding conventionally known telecommunications networks, such conclusion of a contract and reception of pieces of information in order to identify the user or customer or in order to be able to actually put a specific subscription into operation requires an in person contact or operation, e.g. at a point of sale, or presupposes an existing contractual relationship between the same customer or user and the respective network operator or service provider, e.g. relating to a contract relating to the provision of mobile communication services.

Such a requirement of an in person visit, e.g. to a point of sale or other authorized instance, or the requirement of another, already existing contractual relationship with a considered customer, either unnecessarily delays to actually put a specific considered subscription into operation, or it unnecessarily restricts the number of possible customers or clients regarding such communication services.

In the general context of providing network access to customer premises equipments, <CIT> describes device identification based on a device identifier, device authentication, and subsequent allocation of an IP address to the device. Furthermore, <CIT> describes an identification process based on a line ID and <CIT> describes a method in which a network access related ID such as a line ID is used to activate IP connectivity towards a walled garden environment, and where full access to the network is unlocked after the access related ID is federated with contract information.

An object of the present invention is to provide a technically simple, effective and cost effective solution for operating a customer premises equipment with a broadband access network of a telecommunications network, wherein an access node of the broadband access network is enabled to operatively connect the customer premises equipment to the telecommunications network in view of providing communication services and/or communication access services to a user related or connected to the customer premises equipment in case that the user and/or customer premises equipment is unknown to the telecommunications network or has previously not been connected to the telecommunications network. A further object of the present invention is to provide a corresponding system comprising a customer premises equipment and a broadband access network, and a corresponding program or computer-readable medium.

The object of the present invention is achieved by a method according to claim <NUM>.

It is thereby advantageously possible according to the present invention to realize an architecture of the broadband access network such that a fully automatic and customer-triggered possibility to bring the operational network connectivity into service, especially by means of using a customer identifier information or a personal and/or commercial identifier information, and without requiring an in person visit to a point of sale or other physical instance, and furthermore without the requirement of a video ident procedure. Hence, it is advantageously possible to immediately use products and services, and especially to realize and operatively use network connectivity to the broadband access network.

According to the present invention, it is advantageously possible that a contractual relationship (in order to operatively use network connectivity and be provided with communication services) is able to be realized (or to be put into operation) in real time (and in a convenient and cost-effective manner, especially using in-band communication) and, especially, it is possible to operatively use such network connectivity using a client device that is especially locally connected to a customer premises equipment, and, especially, such a contractual relationship is able to be realized or concluded by means of only using the customer premises equipment or the customer premises equipment together with the client device, especially based on using personal and/or commercial unique identifier information such as of a (national or regional) identity card or of a credit card.

According to the present invention, the aim is to be able to operatively use a customer premises equipment (and, especially and typically, to use client devices being locally connected (at least mainly locally connected, even if not exclusively), e.g. in a small office or home office or private setting) in view of communication services provided to that customer premises equipment (and the associated client devices) using the broadband access network of the telecommunications network. According to the present invention, it is advantageously possible to achieve this aim without the effort of an in person visit to a physical location or point of sale (and neither a video ident procedure) and without a pre-existing contractual relationship with the chosen network operator or service provider using the broadband access network for providing their communication services, and especially without the need to use a specific type of hardware device as customer premises equipment. According to the present invention, the broadband access network comprises at least one access node (but typically a plurality of such access nodes), and a specific access node (of such at least one or plurality of access nodes) is enabled to operatively connect the customer premises equipment to the telecommunications network in view of providing communication services and/or communication access services to a user (i.e. a client device) related or connected to the customer premises equipment. According to the present invention, the broadband access network additionally comprises a service edge entity or functionality and a policy controller entity or functionality as well as a business support system entity or functionality. Furthermore according to the present invention, instead of requiring an established or pre-existing contractual relationship in order to provide operatively usable network connectivity and in case that the customer premises equipment is unknown to the telecommunications network or has previously not been connected to the telecommunications network, the customer premises equipment transmits (in a first step) a request to be connected to the broadband access network, via the specific access node, to the service edge entity or functionality and/or to the policy controller entity or functionality, thereby the specific access node also transmitting a line ID information related to the connection, or port, used by the customer premises equipment. In a second step, the customer premises equipment receives, from the service edge entity or functionality and/or from the policy controller entity or functionality the line ID information, and, in a third step, the customer premises equipment initiates a protected data transmission tunnel to the business support system entity or functionality, wherein the data transmission tunnel is specific to the customer premises equipment, and wherein the line ID information as well as an identifier information, especially a hardware identifier information, relating to the (hardware of the) customer premises equipment, is transmitted, using the data transmission tunnel, to the business support system entity or functionality.

According to the present invention, these are the prerequisites for a prospective customer or prospective client (or subscriber) of the broadband access network or the telecommunications network to be able to initiate an operatively usable network connectivity using the respective customer premises equipment, especially and preferably solely (or, at least predominantly) using in-band communication via the customer premises equipment. Especially, it is advantageously possible according to the present invention that conducting further required steps - in order to eventually operatively establish such connectivity, especially in a protected and secure manner - is possible to be performed based on or using the protected data transmission tunnel between the customer premises equipment and the business support system entity or functionality. Especially, such a protected data transmission tunnel is realized using data being unique to (or uniquely assigned to) the customer premises equipment (hardware), hence, by means of being specific to the customer premises equipment (hardware) used, providing an enhanced level of data security and/or confidentiality regarding the protected data transmission tunnel itself. Furthermore, by means of the protected data transmission tunnel between the customer premises equipment and the business support system entity or functionality, it is advantageously possible, according to the present invention - while conducting further steps in order to operatively provide network connectivity to the customer premises equipment and its connected client devices -, to also protect the transmission of additional identifier information, especially personal and/or commercial identity information and/or the line ID.

The situation of a customer premises equipment being unknown to the telecommunications network or having previously not been connected to the telecommunications network especially occurs in case of a new customer premises equipment device of a new prospective customer or user of the broadband access network. In this case, there is, obviously, no known association of a network port (or access node or port of such an access node) and such a user or customer, as such an association is typically based on, or relates to, an identifier information related to the hardware device of the customer premises equipment, e.g. the serial number or a MAC address of the customer premises equipment. Especially according to the present invention, a user plane communication channel is able to be established, carrying the protected data transmission tunnel, between the customer premises equipment and the business support system entity or functionality, especially used for conducting subsequent steps in order to operatively provide network connectivity to the customer premises equipment and its connected client devices.

The telecommunications network according to the present invention might be a fixed-line telecommunications network or a mobile communication network but could also have both aspects, i.e. parts of a fixed-line telecommunications network (or being a fixed-line telecommunications network in such parts) and parts of a mobile communication network (or being a mobile communication network in such parts); such networks are also known under the term fixed-mobile-convergence networks (FMC networks).

According to an embodiment of the present invention, it is advantageously possible and preferred that the business support system entity or functionality comprises a legitimation gateway, wherein the protected data transmission tunnel is, in a first sub-step of the third step, initiated towards the legitimation gateway, wherein, in a second sub-step of the third step, the customer premises equipment transmits, using the protected data transmission tunnel, personal and/or commercial identity information as well as the line ID to the legitimation gateway.

It is thereby advantageously possible to easily and effectively implement the inventive method.

According to another embodiment of the present invention, it is furthermore advantageously possible and preferred that the customer premises equipment receives, prior to the second sub-step of the third step, the personal and/or commercial identity information using a data transmission interface, especially a near-field communication interface and/or a short-range communication interface, especially a Bluetooth interface, and/or a wireless local area network communication interface, wherein especially the personal and/or commercial identity information is received from an identity document device and/or a smartcard device and/or a mobile computing device or smart phone.

By means of such data transmission, it is advantageously possible, according to the present invention, to provide for a connectivity procedure based on in-band data transmission.

According to still another embodiment of the present invention, it is advantageously possible and preferred that, during the first and second steps, the customer premises equipment on the one hand, and the service edge entity or functionality and/or the policy controller entity or functionality on the other hand, communicate using at least one out of the following:.

Furthermore, according to a preferred embodiment of the present invention, it is advantageously possible and preferred that, during the first and second steps, the customer premises equipment transmits the identifier information, relating to the customer premises equipment,
wherein especially the identifier information relating to the customer premises equipment corresponds to a hardware address of the customer premises equipment, especially a medium access control, MAC, address.

According to another embodiment of the present invention, it is furthermore advantageously possible and preferred that, after the second step and prior to the third step, the customer premises equipment transmits a request, especially a DNS request, regarding the business support system entity or functionality and/or the legitimation gateway, and the customer premises equipment receives an information regarding the business support system entity or functionality and/or the legitimation gateway.

According to still another embodiment of the present invention, it is advantageously possible and preferred that the customer premises equipment is connected to the specific access node using one or a plurality out of the following.

According to another embodiment of the present invention, it is furthermore advantageously possible and preferred that, especially during the second step, the service edge entity or functionality and/or the policy controller entity or functionality provides an internet protocol connection to the customer premises equipment in view of realizing or providing to the customer premises equipment a walled garden functionality, especially connectivity to a domain name system entity or functionality.

Furthermore, the present invention relates to a system according to claim <NUM>.

Additionally, the present invention relates to a program according to claim <NUM> and to a computer-readable medium according to claim <NUM>.

The drawings described are only schematic and are nonlimiting.

Furthermore, the terms first, second, third and the like in the description and in the claims are used for distinguishing between similar elements and not necessarily for describing a sequential or chronological order; this is especially the case for the terms "first step", "second step", etc. It is to be understood that the terms so used are interchangeable under appropriate circumstances and that the embodiments of the invention described herein are capable of operation in other sequences than described or illustrated herein.

In <FIG>, a telecommunications network <NUM> according to the present invention is schematically shown, having - preferably - at least a fixed line part. A mobile (or cellular) part might be present as well, as part of the telecommunications network <NUM>, but is not specifically illustrated in <FIG>. User equipments or client devices <NUM>, <NUM>' are connected to the telecommunications network <NUM> by means of a (broadband) access network <NUM>. The telecommunications network <NUM> preferably comprises (but not necessarily), especially as part of the broadband access network <NUM>, at least one logical or physical central office point of delivery <NUM> that is preferably realized within a (mini) data center and that is especially handling different access requirements, especially different access possibilities, of the client devices <NUM>, <NUM>' to network functionalities provided by the telecommunications network <NUM> or via the telecommunications network <NUM>. In addition, the telecommunications network <NUM> typically also comprises - besides the broadband access network <NUM> - a core network <NUM>. The client devices <NUM>, <NUM>' are typically connected to the logical or physical central office point of delivery <NUM> by means of a customer premises equipment device <NUM> (e.g. located in a home or flat or building) or by means of a customer premises equipment entity or functionality that might be built into or realized by the client devices <NUM>, <NUM>'. Another customer premises equipment <NUM> (e.g. located in another home or flat or building) might be used for serving or connecting other client devices (not specifically represented in <FIG>). Preferably (but not necessarily), the central office point of delivery <NUM> comprises a switching fabric <NUM> comprising a plurality of spine network nodes and typically also a plurality of leaf network nodes which are not explicitly represented in <FIG>. The broadband access network <NUM> and/or the telecommunications network <NUM> furthermore comprises a business and/or operations support system <NUM> (or business support system <NUM>). Furthermore, the broadband access network <NUM> and/or the telecommunications network <NUM> comprises a service edge entity or functionality <NUM> and a policy controller entity or functionality <NUM>.

<FIG> schematically illustrates a communication diagram between the customer premises equipment <NUM> as well as entities or functionalities of the broadband access network <NUM> and/or the telecommunications network <NUM> according to the present invention. These entities or functionalities of the broadband access network <NUM> and/or of the telecommunications network <NUM> include an access node (or, a specific access node) <NUM> to which the customer premises equipment <NUM> is connected to. Furthermore, these entities or functionalities of the broadband access network <NUM> and/or of the telecommunications network <NUM> include the service edge entity or functionality <NUM>, the policy controller entity or functionality <NUM>, a domain name system entity or functionality <NUM>, an auto configuration server, ACS, <NUM>, a legitimation gateway <NUM>, and the business support system <NUM>.

According to the present invention, different access technologies between the access nodes of the broadband access network <NUM> and customer premises equipments, especially between the specific access node <NUM> and the customer premises equipment <NUM>, are possible - especially in order to provide network connectivity to different users or subscribers. , the telecommunications network <NUM> might comprise an access node such as an optical line terminal (OLT), having a plurality of access (node) ports, wherein each one of these access ports is able to serve a plurality of customer premises equipments and the associated client devices. This means that a shared medium (or a shared communication means, e.g. a point-to-multipoint access mechanism and especially a passive optical network or a part thereof or a data over cable service interface specification coaxial, DOCSIS, cable network) is used between such a plurality of customer premises equipments, and the respective access node (or, rather, between these customer premises equipments, and the respective access node port of the access node). Furthermore, the telecommunications network <NUM> might additionally or alternatively comprises another access node, such as an MSAN, serving DSL customers. Likewise, such an MSAN access node typically comprises a plurality of access (node) ports. In contrast to the above mentioned access node using a shared medium, these access (node) ports are only able to serve one customer premises equipment (and the associated client devices). The mentioned access nodes are typically connected to a service edge (entity or functionality) <NUM> or broadband network gateway (entity or functionality), especially realized in or as part of a central office point of delivery <NUM>, and the service edge (entity or functionality) <NUM> or broadband network gateway (entity or functionality) <NUM> is controlled by a policy server <NUM> or policy controller entity or functionality <NUM> (especially with an associated policy storage entity or functionality and/or an associated application programming interface, both not explicitly shown in <FIG>).

According to the present invention, the method relates to the operation of the customer premises equipment <NUM> (or a specific (one) customer premises equipment (of, typically, a plurality of customer premises equipments)) with the broadband access network <NUM> of the telecommunications network <NUM>, the broadband access network <NUM> comprising typically a plurality of access nodes of the kind (or of another kind) of the specific access node <NUM>; the specific access node <NUM> is enabled to operatively connect the (specific) customer premises equipment <NUM> to the telecommunications network <NUM> in view of providing communication services and/or communication access services to a user related or connected to the customer premises equipment <NUM> (i.e. especially a client device connected to that specific customer premises equipment <NUM>). According to the present invention, the broadband access network <NUM> comprises a service edge entity or functionality <NUM> and a policy controller entity or functionality <NUM> as well as a business support system entity or functionality <NUM>, wherein, in case that the customer premises equipment <NUM> is unknown to the telecommunications network <NUM> or has previously not been connected to the telecommunications network <NUM>, the method comprises the steps of:.

According to the present invention, it is especially preferred that the business support system entity or functionality <NUM> comprises a legitimation gateway <NUM>, wherein the protected data transmission tunnel <NUM> is, in a first sub-step of the third step, initiated towards the legitimation gateway <NUM>, wherein, in a second sub-step of the third step, the customer premises equipment <NUM> transmits, using the protected data transmission tunnel <NUM>, personal and/or commercial identity information as well as the line ID to the legitimation gateway <NUM>. Such personal and/or commercial identity information might, e.g., comprise information or data as part of a national or regional identity card, or a credit card or another device comprising such personalized and/or protected data. In <FIG>, this is schematically and exemplarily shown by means of an identity (document) device <NUM> (e.g. a smartcard device or a that is able to be connected to (or to exchange data with) the customer premises equipment <NUM>, especially via wireline or wireless data transmission interface of the customer premises equipment <NUM>, especially a smartcard reader and/or a nearfield communication interface, NFC interface, indicated, in <FIG>, by means of reference sign <NUM>.

These steps are schematically and exemplarily shown in <FIG> by means of a plurality of processing steps illustrating the inventive method. In a first processing step <NUM>, the customer premises equipment <NUM> - after initially being connected to the access node <NUM>, and typically also after having established a user plane communication channel using the access node <NUM> - transmits a PADI/DHCP discover message to the service edge entity or functionality <NUM>, and the access node <NUM> thereby injects the line ID information related to the connection. In a second processing step <NUM>, the service edge entity or functionality <NUM> transmits a radius request (especially comprising the line ID information) to the policy controller entity or functionality <NUM>. Hence, the first and second processing steps <NUM>, <NUM> result in the customer premises equipment <NUM> transmitting a request (according to the first step of the inventive method) to be connected to the broadband access network <NUM>, via the specific access node <NUM>, to the service edge entity or functionality <NUM> and/or to the policy controller entity or functionality <NUM>, wherein thereby the specific access node <NUM> also transmits the line ID information related to the connection, or port, used by the customer premises equipment <NUM>. In a third processing step <NUM>, the policy controller entity or functionality <NUM> transmits a default profile including a DNS information (domain name system information) and the line ID information to the service edge entity or functionality <NUM>. In a fourth processing step <NUM>, the service edge entity or functionality <NUM> transmits a PADO/DHCP offer message (via the access node <NUM>) to the customer premises equipment <NUM>. Hence, the third and fourth processing steps <NUM>, <NUM> result in the customer premises equipment <NUM> receiving (according to the second step of the inventive method), from the service edge entity or functionality <NUM> and/or from the policy controller entity or functionality <NUM> the line ID information. Especially according to the present invention, during the first and second steps, the customer premises equipment <NUM> on the one hand, and the service edge entity or functionality <NUM> and/or the policy controller entity or functionality <NUM> on the other hand, communicate using at least one out of the following:.

Furthermore especially during the second step, the service edge entity or functionality <NUM> and/or the policy controller entity or functionality <NUM> provides an internet protocol connection to the customer premises equipment <NUM> in view of realizing or providing to the customer premises equipment <NUM> a walled garden functionality, especially a connectivity to a domain name system entity or functionality <NUM>. In a fifth processing step <NUM> and in a sixth processing step <NUM>, the customer premises equipment <NUM> transmits a request to the domain name system entity or functionality <NUM> (especially using the DNS information received in the previous processing step) to provide a location information or an indication regarding the legitimation gateway <NUM>, and the domain name system entity or functionality <NUM> provides such location information or indication regarding the legitimation gateway <NUM>. In a seventh processing step <NUM>, the customer premises equipment <NUM> transmits a tunnel establishment request (or a corresponding message) to the legitimation gateway <NUM> (especially using the location information or indication regarding the legitimation gateway <NUM> received in the previous processing step) - and/or, but not represented in <FIG>, to the business support system entity or functionality <NUM> - in order to establish a protected data transmission tunnel with the legitimation gateway <NUM> and/or with the business support system entity or functionality <NUM>. In an eighth processing step <NUM>, the customer premises equipment <NUM> receives, from the legitimation gateway <NUM> and/or from the business support system entity or functionality <NUM>, a corresponding tunnel establishment acknowledgement (or a corresponding message) such that the protected data transmission tunnel is able to be established with the legitimation gateway <NUM> and/or with the business support system entity or functionality <NUM>. Hence, the seventh and eighth processing steps <NUM>, <NUM> result in the customer premises equipment <NUM> initiating (according to the third step of the inventive method) the protected data transmission tunnel <NUM> to the business support system entity or functionality <NUM>; especially, the seventh and eighth processing steps <NUM>, <NUM>, correspond to the protected data transmission tunnel <NUM> being initiated, in the first sub-step of the third step, towards the legitimation gateway <NUM>. It is to be understood that the seventh and eighth processing steps <NUM>, <NUM> might comprise, respectively, more than one request or more than one message transmitted in each direction, in order for the protected data transmission tunnel <NUM> to be established. According to the present invention, the data transmission tunnel <NUM> is specific to the customer premises equipment <NUM>, and the line ID information as well as an identifier information, relating to the customer premises equipment <NUM>, is transmitted, using the data transmission tunnel <NUM>, to the business support system entity or functionality <NUM> and/or to the legitimation gateway <NUM>. Especially, according to the present invention, in the second sub-step of the third step, the customer premises equipment <NUM> transmits, using the protected data transmission tunnel <NUM>, personal and/or commercial identity information as well as the line ID to the legitimation gateway <NUM>. This is represented, in <FIG>, by means of a ninth processing step <NUM>, a tenth processing step <NUM>, an eleventh processing step <NUM>, a twelfth processing step <NUM>, a thirteenth processing step <NUM> and a fourteenth processing step <NUM>, during which.

The contractual relation of the new customer (with the network operator of the telecommunications network or the service provider) is able to be finalized by means of a fifteenth processing step <NUM> and a sixteenth processing step <NUM>, during which the customer choses from a service menu (especially regarding communication services) and finalizes the service configuration. In a seventeenth processing step <NUM>, a service profile information (regarding the customer premises equipment <NUM> requesting the respective server) is transmitted, by the business support system entity or functionality <NUM>, to the ACS <NUM>, and, in an eighteenth processing step <NUM>, the ACS <NUM> configures the customer premises equipment <NUM>. In a nineteenth processing step <NUM>, the business support system entity or functionality <NUM> triggers the policy controller entity or functionality <NUM> to replace the default profile for the service profile of the communication service chosen by the client or user of the customer premises equipment <NUM>, thus resulting the customer premises equipment <NUM> (and the associated user equipments or client devices <NUM>) being able to operatively using the network connectivity of the customer premises equipment <NUM> via the specific access node <NUM>.

Especially according to the present invention, the customer premises equipment <NUM> receives, prior to the second sub-step of the third step, the personal and/or commercial identity information using the data transmission interface <NUM>, especially a near-filed communication interface and/or a short-range communication interface, especially a Bluetooth interface, and/or a wireless local area network communication interface. The personal and/or commercial identity information is especially received from an identity document device <NUM> (or identity device <NUM>) and/or a smartcard device <NUM> and/or a mobile computing device or smart phone.

In <FIG>, another representation of the exchange of identifier information according to the present invention is schematically shown between the customer premises equipment <NUM> on the one hand, and the legitimation gateway <NUM> and/or the business support system entity or functionality <NUM> on the other hand. In a first processing step <NUM> the customer premises equipment <NUM> - especially a network ID module or entity or functionality <NUM> of the customer premises equipment <NUM> (i.e. the customer premises equipment <NUM> comprises such a network ID module or entity or functionality <NUM>) - dials in to retrieve the line ID information (transmitted from the service edge entity or functionality <NUM> and/or from the policy controller entity or functionality <NUM> in the third and/or fourth processing steps <NUM>, <NUM> shown in <FIG>, but initially originating from the access node <NUM>, cf. the first processing step <NUM> shown in <FIG>). In a second processing step <NUM>, the network ID module or entity or functionality <NUM> of the customer premises equipment <NUM> extracts the line ID information and provides the line ID information to a tunnel client module or entity or functionality <NUM> as part of the customer premises equipment <NUM> (i.e. the customer premises equipment <NUM> comprises such a tunnel client module or entity or functionality <NUM>). In a third processing step <NUM>, the tunnel client module or entity or functionality <NUM> retrieves (or receives) the hardware address of the customer premises equipment <NUM>, i.e. the identifier information relating to the customer premises equipment <NUM>, typically the MAC address or a serial number. In a fourth processing step <NUM>, the tunnel client module or entity or functionality <NUM> sets up a CPE-specific tunnel towards the legitimation gateway <NUM> and/or the business support system entity or functionality <NUM>, using the identifier information relating to the customer premises equipment <NUM>. In a fifth and sixth processing steps <NUM>, <NUM>, the data transmission interface <NUM> (especially a reader external to the customer premises equipment <NUM>, e.g. a user equipment, an application on such a user equipment or an NFC device) and/or the identity document device <NUM> provide personal identity information (cf. the fifth processing step <NUM>) and/or commercial identity information (cf. the sixth processing step <NUM>) to respective first CID (customer ID) client entity or functionality <NUM> of the customer premises equipment <NUM> and/or second CID (customer ID) client entity or functionality <NUM> of the customer premises equipment <NUM> (i.e. the customer premises equipment <NUM> comprises such a first CID client entity or functionality <NUM> and/or such a second CID client entity or functionality <NUM>). In a seventh and eighth processing steps <NUM>, <NUM>, the first CID (customer ID) client entity or functionality <NUM> realizes network/customer federation (federating the line ID information with an information relating to the customer premises equipment <NUM> and/or the client or customer (Pers. ID) - seventh processing step <NUM>), and the second CID (customer ID) client entity or functionality <NUM> realizes (or concludes) the contract between the client or customer (related to the customer premises equipment <NUM>) and the telecommunications network or network operator (eighth processing step <NUM>; this eighth processing step <NUM> especially being optional).

<FIG> schematically illustrates a representation regarding the protected data transmission tunnel <NUM> - especially its establishment and how it is operated - between the customer premises equipment <NUM> and the broadband access network <NUM> and/or an entity or functionality of the telecommunications network <NUM>, especially the legitimation gateway <NUM>, wherein the specific exemplary illustration of <FIG> relates to a considered transmission - using the protected data transmission tunnel <NUM> - in the direction from the customer premises equipment <NUM> towards the legitimation gateway <NUM>. Especially in view of such a considered transmission (direction), the customer premises equipment <NUM> comprises, especially as part of the tunnel client module or entity or functionality <NUM>, a payload scrambler <NUM>', and the legitimation gateway <NUM> comprises a payload descrambler <NUM>'. Especially as part of the fourth processing step <NUM> (represented in <FIG>), the protected data transmission tunnel <NUM> is established or set up and such a considered transmission occurs in the direction from the customer premises equipment <NUM> towards the legitimation gateway <NUM>. <FIG> exemplary shows, regarding such a situation, that the line ID information <NUM>' (of the access node <NUM> used by the customer premises equipment <NUM>) as well as the identifier information <NUM>' relating to the customer premises equipment <NUM> is transmitted, by the customer premises equipment <NUM>, and received by the legitimation gateway <NUM>, in a protected manner (especially in an encrypted manner), i.e. the line ID information <NUM>' and the identifier information <NUM>' relating to the customer premises equipment <NUM> is not transmitted as plaintext (but as ciphertext, i.e. in encrypted manner), i.e. protected with regard to, e.g., a man-in-the-middle attack or an eavesdropping attempt. As represented in <FIG>, both the line ID information <NUM>' as well as the identifier information <NUM>' (relating to the customer premises equipment <NUM> - especially internally (of the customer premises equipment <NUM>) detected or learned or retrieved, cf. the third processing step <NUM> represented in <FIG>).

Regarding the inverse direction, i.e. a transmission in the direction from the legitimation gateway <NUM> towards the customer premises equipment <NUM>, a realization analogous to the representation of <FIG> is preferably (but not necessarily) implemented according to the present invention. This means that - regarding such a transmission having an inverse direction - the customer premises equipment <NUM> comprises, likewise especially as part of the tunnel client module or entity or functionality <NUM>, a payload descrambler, and the legitimation gateway <NUM> likewise comprises a payload scrambler (both not shown in <FIG>). Especially as part of the fourth processing step <NUM> (represented in <FIG>) or as part of subsequent processing steps, the protected data transmission tunnel <NUM> is established or set up and such transmission occurs in the direction from the legitimation gateway <NUM> towards the customer premises equipment <NUM>.

According to the present invention, it is preferred that the customer premises equipment <NUM> receives, prior to the second sub-step of the third step, the personal and/or commercial identity information using the data transmission interface <NUM> and/or the identity document device <NUM>. The identity document device <NUM> could, alternatively or cumulatively, also be a user equipment (such as, e.g., a smart phone) or a computing device (such as, e.g., a tablet or the like). This is possible, according to the present invention, with a reduced effort as, even today, typical fixed network customer premises equipments (CPEs, e.g. for DSL access, G-PON access and/or P2P fiber access) is usually already suitable for collecting this data and transmitting it during startup due to the technology used (i.e. the data transmission interface <NUM>). Especially in case that the terminal device hardware address/modem ID/serial number (i.e. the identifier information <NUM>' relating to the customer premises equipment <NUM>) is also transmitted to the network, it is possible not only to realize federation (i.e. customer - connection federation) to be performed by (or in) the business support system entity or functionality <NUM>, but the customer premises equipment <NUM> (or customer premises equipment device) can also be recognized and special features taken into account during automatic configuration - a prerequisite for such a functionality would be a default profile with an IP address and a comparatively low bandwidth. Alternatively to using the data transmission interface <NUM> of the customer premises equipment <NUM> (to transmit customer-related data and/or connection related data towards the telecommunications network <NUM>), it is alternatively possible and preferred, according to the present invention, that, e.g., a smartphone application collects the necessary data (such as, e.g., customer ID, device ID (i.e. the identifier information <NUM>' relating to the customer premises equipment <NUM>), connection ID (i.e. the line ID information <NUM>')) and transmits such data via a mobile communication network (i.e. out-of-band) to the policy controller entity or functionality <NUM> and/or business support system entity or functionality <NUM>; such a solution would be required in case that - due to the (hardware) design of the actual customer premises equipment <NUM> used - no feedback or confirmation to the customer or of the customer can be made; however, it is preferred, according to the present invention, to use an in-band transmission of such data. Hence, typically according to the present invention, the necessary data are retrieved via (radio) near field technology, which is built (as the data transmission interface <NUM>) into the fixed network customer premises equipment <NUM>. The customer premises equipment <NUM> first establishes a default IP connection to the network to establish basic connectivity (first and second step or first to fourth processing steps <NUM> to <NUM> of <FIG>). Via a DNS call (fifth and sixth processing steps <NUM>, <NUM> of <FIG>), the customer premises equipment <NUM> obtains the destination address of the business support system entity or functionality <NUM> system and/or the legitimization gateway <NUM> (and/or payment gateway) which provides the possibility to establish the protected data transmission tunnel <NUM> which may especially be encrypted (i.e. transports the transmitted data in encrypted manner).

The connection to the card reading function (i.e. especially using the data transmission interface <NUM> of the customer premises equipment <NUM>, e.g. to a mobile application (of a user equipment or smart phone device also having such an analogous data transmission interface) or to an additional device (such as an identity document device <NUM>) is then established (cf. processing steps <NUM> to <NUM> of <FIG>). The customers legitimize themselves by transferring their data read out from the ID card and/or their cash card (credit,. Based on the device ID (e.g. HW address of the terminal device, SN,. ), the ID card (ID card, cash card), all data for registration and, if necessary, also for concluding a contract are available. An initial plausibility check of the address determines whether the new customers are located (roughly) in the area of their (stated) place of residence, in which case activation takes place directly. If such check shows that the specified place of residence does not (roughly) match the area, activation takes place for a limited time, such that corresponding customers can connect to an agent for legitimation and thus put the connection into operation.

Especially according to the present invention, it is advantageously possible to use automatic connection identification (by means of transmitting the line ID information <NUM>' to the customer premises equipment <NUM> and then again, using the protected data transmission tunnel <NUM> towards the business support system entity or functionality <NUM> and/or legitimation gateway <NUM>) for automatic connection set up. However, such automatic connection identification is also generally applicable for hardware exchange of the customer premises equipment <NUM> and/or for relocation and/or for wholesale. Especially according to the present invention, the line ID information <NUM>' is transmitted or transferred in (or as part of) the point-to-point-protocol connection to the customer premises equipment <NUM>. Hence, according to the present invention, the customer ID (e.g. by means of an ID card) is transmitted to the customer premises equipment <NUM>, and from there transmitted (with the hardware ID) to the access node (with the line ID information), and from there to perform connection set up (contract conclusion or contract change / services). Line ID for downward compatibility with the previous network and for special cases (HW exchange, replacement circuits in network, relocation and wholesale) Registration can take place via first (fixed network) and second (mobile network) path (first path is innovation driver here).

According to the present invention, a specific set of data or a set of pieces of information is held in the customer premises equipment <NUM> (such a set of data or a set of pieces of information might relate to the connection (such as the line ID information), to customer data (such data identifying the user) and/or to the service profile / service profiles / applications), i.e. such a set of data or a set of pieces of information is held in a decentralized manner and not longer centered in the telecommunications network (e.g. on or at a repository such as the BNG/platform control) but managed by and agent (or module or component in the router, i.e. the customer premises equipment <NUM>.

Claim 1:
Method for operating a customer premises equipment (<NUM>) with a broadband access network (<NUM>) of a telecommunications network (<NUM>), wherein the broadband access network (<NUM>) comprises at least one access node (<NUM>),
wherein a specific access node (<NUM>) of the broadband access network (<NUM>) is enabled to operatively connect the customer premises equipment (<NUM>) to the telecommunications network (<NUM>) in view of providing communication services and/or communication access services to a user related or connected to the customer premises equipment (<NUM>),
wherein the broadband access network (<NUM>) comprises a service edge entity or functionality (<NUM>) and a policy controller entity or functionality (<NUM>) as well as a business support system entity or functionality (<NUM>),
wherein, in case that the customer premises equipment (<NUM>) is unknown to the telecommunications network (<NUM>) or has previously not been connected to the telecommunications network (<NUM>), the method comprises the following steps:
-- in a first step, the customer premises equipment (<NUM>) transmits a request to be connected to the broadband access network (<NUM>), via the specific access node (<NUM>), to the service edge entity or functionality (<NUM>) and/or to the policy controller entity or functionality (<NUM>), wherein thereby the specific access node (<NUM>) also transmits a line ID information related to the connection, or port, used by the customer premises equipment (<NUM>),
-- in a second step, the customer premises equipment (<NUM>) receives, from the service edge entity or functionality (<NUM>) and/or from the policy controller entity or functionality (<NUM>) the line ID information,
-- in a third step, the customer premises equipment (<NUM>) initiates a protected data transmission tunnel (<NUM>) to the business support system entity or functionality (<NUM>), wherein the data transmission tunnel (<NUM>) is specific to the customer premises equipment (<NUM>), and wherein the line ID information as well as an identifier information, relating to the customer premises equipment (<NUM>), is transmitted, using the data transmission tunnel (<NUM>), to the business support system entity or functionality (<NUM>).