A method for realizing remote configuration management of a home intelligent gateway

Abstract

The application discloses a kind of methods for realizing the remote configuration management of home intelligent gateway, including home gateway built-in home gateway network management system ITMS, database, ITMS system uses TR-069 protocol as its core communication protocol, home gateway network management system ITMS includes two kinds of logical devices: user end equipment CPE and automatic configuration server ACS, CPE is built-in HTTP protocol.The application binds the domain name with the dynamic IP address of CPE device through dynamic DNS service, when the IP address of CPE device changes, dynamic DNS service will automatically update DNS record, ensure that domain name always points to the latest IP address, dynamic DNS service ensures the stable connection between ACS and CPE, reduces the connection interruption problem caused by IP address change, also reduces the troubleshooting time caused by connection problem, improves operation and maintenance efficiency, also simplifies operation and maintenance process, reduces the risk of connection interruption, also enhances the scalability and stability of network.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of intelligent gateway management, in particular to a method for realizing remote configuration management of a home intelligent gateway. BACKGROUND

[0002] With the development of the Internet and the development of intelligence, our life is more and more dependent on the Internet and electronic equipment, the Internet and electronic equipment in the smart home system are connected through the home intelligent gateway as a link, the home intelligent gateway is the core component of the smart home system, the home intelligent gateway connects, manages and controls various intelligent devices inside the home, such as the home intelligent gateway can realize information collection, information input, information output, centralized control, remote control, linkage control and other functions of various devices such as sensors, network equipment, cameras and host computers in the local area network, so that the occupants can check and monitor the operation of various devices at home at any time and place through various communication means, with the rapid development of smart home technology, the home intelligent gateway as the core hub connecting and controlling the home intelligent devices, its remote configuration management capability becomes the key to improve user experience and ensure stable operation of the system.

[0003] In the existing ACS active exploration of CPE, often due to the IP address of CPE exceeding the IP address validity time of DHCP, the IP address of CPE changes, ACS can no longer actively contact CPE, and can only wait for CPE to connect ACS in the next period to establish connection again, which brings a lot of inconvenience to the operation and management of remotely controlling CPE devices, and the operation efficiency is low, therefore, it is urgent to build a method for realizing remote configuration management of a home intelligent gateway. SUMMARY

[0004] The purpose of the present application is to provide a method for realizing remote configuration management of a home intelligent gateway to solve the problems raised in the background art.

[0005] To achieve the above purpose, the present application provides the following technical scheme:

[0006] A method for realizing remote configuration management of a home intelligent gateway, including a home gateway network management system ITMS and a database built-in the home intelligent gateway, the ITMS system adopts TR-069 protocol as its core communication protocol, the home gateway network management system ITMS includes two types of logical devices: user end device CPE and automatic configuration server ACS, the CPE is built-in HTTP protocol, including the following steps:

[0007] Step 1: Assign a fixed domain name to the CPE device and bind the domain name to the CPE device's dynamic IP address through the dynamic DNS service. During initial startup and after network configuration changes, such as IP address changes, the CPE initiates an HTTP connection request to the ACS using a SOAP request. The specific steps are as follows:

[0008] S1. Establishing a TCP connection: Based on the three-way handshake of the TCP / IP protocol, the CPE first attempts to establish a TCP connection with the ACS.

[0009] S2. Send HTTP request: After the TCP connection is established successfully, the CPE sends an HTTP POST request to the ACS.

[0010] S3. Contains a SOAP message: The body of the HTTP POST request will contain a SOAP message that encapsulates the RPC method that the CPE wants to execute and its CPE registration parameters. When the CPE registers, it will send a SOAP message containing the Inform RPC method.

[0011] S4. The CPE initiates an operation request to the ACS by sending an HTTP POST request containing a SOAP message with a specific RPC method. After receiving the HTTP request, the ACS parses the SOAP message and determines the operation that the CPE wants to perform. The ACS then sends an HTTP response to the CPE. The HTTP response contains a SOAP message that obtains CPE-specific information, such as the serial number, MAC address, device ID, URL and port number, and authentication credentials, such as the username and password.

[0012] Step 2: After obtaining the CPE's unique information, the ACS requests authentication credentials. The ACS will ask the CPE to perform HTTP Digest Authentication. If the authentication is successful, the ACS will respond with a connection confirmation, successfully establishing the connection.

[0013] Step 3: After successfully establishing a connection between the CPE and the ACS, the CPE immediately sends an Inform request to the ACS by calling the Inform RPC method. The request contains the CPE's device information, authentication information, and the reason for sending the Inform request. After receiving the Inform request from the CPE, the ACS processes the connection request based on the connection request content. The steps are as follows:

[0014] S1. The ACS authenticates the Inform request. Based on the authentication information in the Inform request, the ACS first checks whether the username in the authentication information exists in its database. If so, the ACS further verifies whether the provided password matches the password stored in the database. If authentication is successful, the ACS allows the CPE to continue subsequent management operations. If not, the ACS rejects the CPE's request.

[0015] S2. If the username and password match, the ACS allows the CPE to access the network. The ACS responds with an InformResponse, indicating that the RPC method has completed and the CWMP connection has been successfully established.

[0016] S3. During the CWMP connection establishment process, the CPE and ACS use SSL / TLS protocol for encrypted communication.

[0017] Step 4: After a connection is successfully established and authentication is passed, the ACS and CPE begin exchanging information using RPC methods. RPC methods are divided into methods supported by the ACS and methods supported by the CPE. The ACS calls the RPC methods supported by the CPE for remote configuration management, and the CPE calls the RPC methods supported by the ACS to report status information and request hardware image file download operations.

[0018] Preferably, in step 1, the domain name is bound to the dynamic IP address of the CPE device through a dynamic DNS service, and the specific steps are as follows:

[0019] S1. Register an account with a dynamic DNS service provider to obtain a domain name;

[0020] S2. Install and configure the dynamic DNS client software or plug-in on the CPE device to bind the domain name to the dynamic IP address of the CPE device;

[0021] S3. Update the CPE device access method on the ACS, using a fixed domain name instead of the original IP address, and test whether the ACS can successfully access the CPE device through the domain name.

[0022] S4. Monitor the operating status and performance of the dynamic DNS service, and adjust configuration parameters or optimize the network environment based on actual conditions.

[0023] Preferably, in step 1, the CPE establishes a TCP connection with the ACS, as follows:

[0024] (1) CPE sends a SYN packet: The CPE sends a TCP segment with the synchronization sequence number SYN flag to the ACS. In the segment, the SYN flag is set to 1, indicating that this is a connection request message. At the same time, the segment also contains a sequence number, which is randomly generated by the CPE and used for subsequent confirmation and data packet sorting during the communication process.

[0025] (2) CS responds with a SYN-ACK packet: When the ACS receives the SYN packet sent by the CPE, it sends a synchronization confirmation SYN-ACK segment as a response. In the SYN-ACK segment, both the SYN and ACK flags are set to 1, indicating that this is a confirmation of the connection request, and the ACS is also preparing its own sequence number for the new connection. The SYN-ACK segment contains an acknowledgment number for the sequence number in the CPE's SYN segment, that is, the CPE's sequence number plus 1, and the ACS's own initial sequence number.

[0026] (3) CPE sends ACK packet: When CPE receives the SYN-ACK segment from ACS, it sends an ACK segment in response. In the ACK segment, the ACK flag is set to 1, indicating that this is an acknowledgment of the SYN-ACK segment. The acknowledgment number in the ACK segment is set to the initial sequence number of ACS plus 1, indicating that CPE has received the SYN-ACK segment from ACS and is ready to exchange data.

[0027] Through the above three steps, a reliable TCP connection is established between the CPE and the ACS.

[0028] Preferably, in step 3, the CPE and the ACS use the SSL / TLS protocol for encrypted communication, and the steps are as follows:

[0029] (1) The ACS responds to the CPE's connection request and sends its own SSL / TLS certificate to the CPE. The certificate contains the ACS's public key, information about the CA that issued the certificate, and the validity period.

[0030] (2) After receiving the certificate from the ACS, the CPE verifies the validity of the certificate, including whether it is issued by a trusted CA, whether the certificate has expired, and whether the domain name in the certificate matches the requested domain name. If the certificate verification is successful, the CPE generates a random number, called a pre-key or Pre-Master Secret, and encrypts the random number using the ACS's public key before sending it to the ACS. This process is called key exchange.

[0031] (3) During the key exchange process, the CPE and ACS will perform key exchange and protocol parameter negotiation to determine the encryption algorithm, key length, and session key used in subsequent communications. The CPE and ACS will also negotiate the use of pre-set keys and random numbers from the client and server, and generate a session key using an algorithm such as the pseudo-random number generator function (PRF) of the TLS protocol. The session key will be used for encryption and decryption in subsequent communications.

[0032] (4) The CPE uses the session key to encrypt the data to be sent to the ACS, and then sends the encrypted data to the ACS. When the ACS receives the encrypted data, it will use the session key to decrypt the data to restore the original data. Similarly, the ACS also uses the session key to encrypt the data to be sent to the CPE. When the CPE receives the encrypted data, it will use the session key to decrypt the data to restore the original data.

[0033] Compared with the prior art, the present invention has the following advantages: the domain name is bound to the dynamic IP address of the CPE device through the dynamic DNS service. When the IP address of the CPE device changes, the dynamic DNS service automatically updates the DNS record to ensure that the domain name always points to the latest IP address. The dynamic DNS service automatically updates the IP address of the CPE device in the ACS, which helps to maintain a stable improvement in operation and maintenance efficiency. The ACS is configured to use the fixed domain name to access the CPE device instead of directly using the IP address. Regardless of how the IP address of the CPE device changes, the ACS can find and connect to the CPE device through the domain name. The dynamic DNS service ensures a stable connection between the ACS and the CPE, reduces the problem of connection interruption caused by IP address changes, and allows operation and maintenance personnel to manage and monitor the CPE device more efficiently, reducing the troubleshooting time caused by connection problems. By applying the dynamic DNS service, problems caused by IP address changes when the ACS actively explores the CPE are solved, thereby improving operation and maintenance efficiency, simplifying the operation and maintenance process, reducing the risk of connection interruption, and enhancing the scalability and stability of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A flowchart of a method for implementing remote configuration management of a home intelligent gateway according to the present invention;

[0035] Figure 2 This is a flow chart of HTTP connection request for a method for implementing remote configuration management of a home intelligent gateway according to the present invention;

[0036] Figure 3 This is a flow chart of HTTP DigestAuthentication authentication in a method for implementing remote configuration management of a home intelligent gateway according to the present invention;

[0037] Figure 4 A flow chart of establishing a CWMP connection in a method for implementing remote configuration management of a home intelligent gateway according to the present invention;

[0038] Figure 5 This is a flow chart of information exchange between the ACS and the CPE using the RPC method in a method for implementing remote configuration management of a home intelligent gateway according to the present invention. DETAILED DESCRIPTION

[0039] The following will provide a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0040] Example

[0041] See also Figure 1-Figure 5 The present invention provides an embodiment of a method for remote configuration management of a home smart gateway, including a home gateway network management system (ITMS) and a database built into the home smart gateway. The ITMS system uses the TR-069 protocol as its core communication protocol. The home gateway network management system (ITMS) includes two types of logical devices: a customer premises equipment (CPE) and an automatic configuration server (ACS). The CPE has a built-in HTTP protocol, including the following steps:

[0042] Step 1: Assign a fixed domain name to the CPE device and bind the domain name to the dynamic IP address of the CPE device through the dynamic DNS service. The specific steps are as follows:

[0043] S1. Register an account with a dynamic DNS service provider to obtain a domain name;

[0044] S2. Install and configure the dynamic DNS client software or plug-in on the CPE device to bind the domain name to the dynamic IP address of the CPE device;

[0045] S3. Update the CPE access method on the ACS, using a fixed domain name instead of the original IP address. Test whether the ACS can successfully access the CPE using the domain name. The ACS sends a connection request or management command to the CPE using the domain name. Observe whether the ACS can successfully connect to the CPE and receive a response from the CPE.

[0046] S4. Monitor the operating status and performance of the dynamic DNS service, adjust configuration parameters or optimize the network environment according to actual conditions to ensure the stability and efficiency of the dynamic DNS service;

[0047] When the CPE is first started or when the network configuration changes, such as when the IP address changes, the CPE initiates an HTTP connection request to the ACS using a SOAP request. The specific steps are as follows:

[0048] S1. Establishing a TCP connection: Based on the three-way handshake of the TCP / IP protocol, the CPE first attempts to establish a TCP connection with the ACS. The steps are as follows:

[0049] (1) CPE sends a SYN packet: The CPE sends a TCP segment with the synchronization sequence number SYN flag to the ACS. In the segment, the SYN flag is set to 1, indicating that this is a connection request message. At the same time, the segment also contains a sequence number, which is randomly generated by the CPE and used for subsequent confirmation and data packet sorting during the communication process.

[0050] (2) CS responds with a SYN-ACK packet: When the ACS receives the SYN packet sent by the CPE, it sends a synchronization confirmation SYN-ACK segment as a response. In the SYN-ACK segment, both the SYN and ACK flags are set to 1, indicating that this is a confirmation of the connection request, and the ACS is also preparing its own sequence number for the new connection. The SYN-ACK segment contains an acknowledgment number for the sequence number in the CPE's SYN segment, that is, the CPE's sequence number plus 1, and the ACS's own initial sequence number.

[0051] (3) CPE sends ACK packet: When CPE receives the SYN-ACK segment from ACS, it sends an ACK segment in response. In the ACK segment, the ACK flag is set to 1, indicating that this is an acknowledgment of the SYN-ACK segment. The acknowledgment number in the ACK segment is set to the initial sequence number of ACS plus 1, indicating that CPE has received the SYN-ACK segment from ACS and is ready to exchange data.

[0052] Through the above three steps, a reliable TCP connection is established between the CPE and the ACS.

[0053] S2. Send HTTP request: After the TCP connection is successfully established, the CPE sends an HTTP POST request to the ACS. The request URI points to the service endpoint on the ACS that processes TR-069 requests, ensuring that the ACS can correctly identify and process the request from the CPE.

[0054] S3. Contains a SOAP message: The body of the HTTP POST request will contain a SOAP message that encapsulates the RPC method that the CPE wants to execute and its CPE registration parameters. For example, for CPE registration, a SOAP message containing the Inform RPC method will be sent.

[0055] S4. The CPE initiates an operation request to the ACS by sending an HTTP POST request containing a SOAP message with a specific RPC method. After receiving the HTTP request, the ACS parses the SOAP message and determines the operation that the CPE wants to perform. The ACS then sends an HTTP response to the CPE. The HTTP response contains a SOAP message that obtains CPE-specific information, such as the serial number, MAC address, device ID, URL and port number, and authentication credentials, such as the username and password.

[0056] Step 2: After obtaining the CPE's unique information, the ACS requests authentication credentials. The ACS will require the CPE to perform HTTP Digest Authentication. The specific steps are as follows:

[0057] S1. The ACS sends an HTTP 401 Unauthorized response to the CPE, which includes a WWW-Authenticate header field. The field indicates that the ACS expects Digest authentication and includes the realm, nonce, and quality of protection (qop) parameters.

[0058] After receiving the 401 response, S2 and the CPE use the MD5 hash algorithm to calculate a digest based on the URL, realm, nonce, and qop parameters provided by the ACS and the username and password entered by the user. The specific steps are as follows:

[0059] (1) Obtain necessary information: Get the URL, realm, nonce, qop parameters, and the username and password entered by the user from the WWW-Authenticate header of the 401 response;

[0060] (2) Construct A1 string:

[0061] For qop of auth or auth-int, A1 = username:realm:password;

[0062] (3) Perform MD5 hashing on A1: HA1 = MD5(A1)

[0063] (4) Construct A2 string: for qop = auth, A2 = method: URI

[0064] Where method is the HTTP request method, such as GET or POST, and URI is the request URI, excluding the query string.

[0065] (5) Perform MD5 hashing on A2: HA2 = MD5(A2). When calculating the response digest, A2 will participate in the non-hashed form.

[0066] (6) Build the response digest:

[0067] For qop=auth, response=MD5(HA1:nonce:nonceCount:cnonce:qop:HA2)

[0068] Where, nonceCount and cnonce are values ​​generated by the CPE. NonceCount is usually initialized to '00000001' and incremented with each request. cnonce is a random string provided by the client to increase the complexity of the digest.

[0069] S3. The CPE adds the calculated digest to the "Authorization" header field of the request and resends the request to the ACS. The "Authorization" header field contains the username, URI, realm, nonce, qop, client random number cnonce, and digest information.

[0070] S4. After receiving the request with the digest, the ACS uses the same algorithm and parameters to calculate an expected digest and compares it with the digest provided by the CPE. If the two are consistent, the authentication is successful and the ACS responds with a connection confirmation. Otherwise, the authentication fails and the ACS returns a 401 response to the CPE. The CPE calculates the response according to the digest authentication algorithm based on the WWW-Authenticate information, URL, user name, and password in the ACS response, and constructs the digest authentication information for the next request. It then initiates the HTTP request again and records the number of retries.

[0071] Step 3: After successfully establishing a connection between the CPE and the ACS, the CPE immediately sends an Inform request to the ACS by calling the Inform RPC method. The request contains the CPE's device information, authentication information, and the reason for sending the Inform request. Device information includes manufacturer, model, serial number, and software version; authentication information includes username and password; and the reason for the Inform request includes connection request and status change notification. After receiving the Inform request from the CPE, the ACS processes the request based on the connection request content. The steps are as follows:

[0072] S1. The ACS authenticates the Inform request. Based on the authentication information in the Inform request, the ACS first checks whether the username in the authentication information exists in its database. If so, the ACS further verifies whether the provided password matches the password stored in the database. If authentication is successful, the ACS allows the CPE to continue subsequent management operations. If not, the ACS rejects the CPE's request.

[0073] S2. If the username and password match, the ACS allows the CPE to access the network. The ACS responds with an InformResponse, indicating that the RPC method has completed and the CWMP connection has been successfully established.

[0074] S3. During the CWMP connection establishment process, to ensure the security of communication between the CPE and ACS, the CPE and ACS use the SSL / TLS protocol for encrypted communication to ensure confidentiality and data integrity. The steps are as follows:

[0075] (1) The ACS responds to the CPE's connection request and sends its own SSL / TLS certificate to the CPE. The certificate contains the ACS's public key, information about the CA that issued the certificate, and the validity period.

[0076] (2) After receiving the certificate from the ACS, the CPE verifies the validity of the certificate, including whether it is issued by a trusted CA, whether the certificate has expired, and whether the domain name in the certificate matches the requested domain name. If the certificate verification is successful, the CPE generates a random number, called a pre-key or Pre-Master Secret, and encrypts the random number using the ACS's public key before sending it to the ACS.

[0077] (3) During the key exchange process, the CPE and ACS will perform key exchange and protocol parameter negotiation to determine the encryption algorithm, key length, and session key used in subsequent communications. The CPE and ACS will also negotiate the use of pre-set keys and random numbers from the client and server, and generate a session key using an algorithm such as the pseudo-random number generator function (PRF) of the TLS protocol. The session key will be used for encryption and decryption in subsequent communications.

[0078] (4) The CPE uses the session key to encrypt the data to be sent to the ACS, and then sends the encrypted data to the ACS. When the ACS receives the encrypted data, it decrypts the data using the session key to restore the original data. Similarly, the ACS also uses the session key to encrypt the data to be sent to the CPE. When the CPE receives the encrypted data, it decrypts the data using the session key to restore the original data.

[0079] SSL / TLS authentication encrypts and protects communications between the CPE and ACS, preventing security threats such as eavesdropping, tampering, and identity spoofing. During the interaction between the CPE and ACS, SSL / TLS ensures data confidentiality, integrity, and authentication, providing strong security for remote management and configuration.

[0080] Step 4: After a successful connection is established and authentication is passed, the ACS and CPE begin exchanging information using RPC methods. RPC methods are categorized as ACS-supported and CPE-supported. Messages between the ACS and CPE are transmitted over HTTP 1.1, with message content encapsulated in SOAP packets. SOAP messages consist of a SOAP header and a SOAP body, both in XML format. The SOAP request from the ACS to the CPE is based on an HTTP response, while the SOAP response from the CPE to the ACS is based on a subsequent HTTP post.

[0081] The ACS invokes RPC methods supported by the CPE for remote configuration management, such as obtaining and setting CPE parameters, remote configuration management, hardware upgrades, or device restarts. The steps are as follows:

[0082] S1. When the ACS calls an RPC method, it sends a SOAP packet containing the function name and parameters to the CPE.

[0083] S2. After receiving the RPC call from the ACS, the CPE parses the SOAP packet and performs the corresponding operation according to the request;

[0084] After S3 and CPE complete the operation, they send a response SOAP packet to the ACS to inform it of the operation result and required information.

[0085] S4. After the communication ends, the ACS sends an HTTP 204 No Content response to indicate the end of the session.

[0086] The CPE calls the RPC method supported by the ACS to report status information and request hardware image file download operations. The steps are as follows:

[0087] S1. The CPE periodically calls the ACS's RPC method to report status information. This is achieved through the Inform RPC method. The information contains the CPE's device information, status information, and possible error or alarm information. After receiving the status information, the ACS can monitor the CPE's status.

[0088] S2. When the ACS detects that the CPE needs to update its firmware or perform a system upgrade, the CPE requests the hardware image file from the ACS.

[0089] S3. The CPE can send a request containing the required image file information to the ACS;

[0090] S4. After receiving the request, the ACS verifies the CPE's authority and the validity of the request. If the verification is successful, the ACS provides the download address of the image file and sends the image file to the CPE.

[0091] S5. After receiving the image file, the CPE will download and install it to update and upgrade the system.

[0092] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above and that the invention can be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims, not the foregoing description, and all variations within the meaning and range of equivalents of the claims are intended to be included therein. Any reference sign in a claim should not be construed as limiting the claim to which it relates.

Claims

1. A method for remotely configuring and managing a home smart gateway, comprising: a home gateway network management system (ITMS) and a database built into the home smart gateway; the ITMS system using the TR-069 protocol as its core communication protocol; the home gateway network management system (ITMS) including two logical devices: a customer premises equipment (CPE) and an automatic configuration server (ACS); and a CPE with a built-in HTTP protocol. The method is characterized by: The following steps are involved: Step 1: Assign a fixed domain name to the CPE device and bind the domain name to the CPE device's dynamic IP address through the dynamic DNS service. During initial startup and when the network configuration changes, the CPE initiates an HTTP connection request to the ACS using a SOAP request. The specific steps are as follows: S1. Establishing a TCP connection: Based on the three-way handshake of the TCP / IP protocol, the CPE first attempts to establish a TCP connection with the ACS. S2. Send HTTP request: After the TCP connection is established successfully, the CPE sends an HTTP POST request to the ACS. S3. Contains a SOAP message: The body of the HTTP POST request will contain a SOAP message that encapsulates the RPC method that the CPE wants to execute and its CPE registration parameters. When the CPE registers, it will send a SOAP message containing the Inform RPC method. S4. The CPE initiates an operation request to the ACS by sending an HTTP POST request containing a SOAP message with an RPC method. After receiving the HTTP request, the ACS parses the SOAP message and determines the operation that the CPE wants to perform. The ACS then sends an HTTP response to the CPE. The HTTP response contains a SOAP message that obtains CPE-specific information, including the serial number, MAC address, device ID, URL, and port number. Step 2: After obtaining the CPE's unique information, the ACS requests authentication credentials, including the username and password. The ACS then asks the CPE to perform HTTP Digest Authentication. If the authentication succeeds, the ACS responds with a connection confirmation, successfully establishing the connection. Step 3: After successfully establishing a connection between the CPE and the ACS, the CPE immediately sends an Inform request to the ACS by calling the Inform RPC method. The request contains the CPE's device information, authentication information, and the reason for sending the Inform request. After receiving the Inform request from the CPE, the ACS processes the connection request based on the connection request content. The steps are as follows: S1. The ACS authenticates the Inform request. Based on the authentication information in the Inform request, the ACS first checks whether the username in the authentication information exists in its database. If so, the ACS further verifies whether the provided password matches the password stored in the database. If authentication is successful, the ACS allows the CPE to continue subsequent management operations. If not, the ACS rejects the CPE's request. S2. If the username and password match, the ACS allows the CPE to access the network. The ACS responds with an InformResponse, indicating that the RPC method has completed and the CWMP connection has been successfully established. S3. During the CWMP connection establishment process, the CPE and ACS use SSL / TLS protocol for encrypted communication. Step 4: After a connection is successfully established and authentication is passed, the ACS and CPE begin exchanging information using RPC methods. RPC methods are divided into methods supported by the ACS and methods supported by the CPE. The ACS calls the RPC methods supported by the CPE for remote configuration management, and the CPE calls the RPC methods supported by the ACS to report status information and request hardware image file download operations.

2. A method for implementing remote configuration management of a home smart gateway according to claim 1, characterized in that: In step 1, the domain name is bound to the dynamic IP address of the CPE device through the dynamic DNS service. The specific steps are as follows: S1. Register an account with a dynamic DNS service provider to obtain a domain name; S2. Install and configure the dynamic DNS client software or plug-in on the CPE device to bind the domain name to the dynamic IP address of the CPE device; S3. Update the CPE device access method on the ACS, using a fixed domain name instead of the original IP address, and test whether the ACS can successfully access the CPE device through the domain name. S4. Monitor the operating status and performance of the dynamic DNS service, and adjust configuration parameters or optimize the network environment based on actual conditions.

3. A method for implementing remote configuration management of a home smart gateway according to claim 1, characterized in that: In step 1, the CPE establishes a TCP connection with the ACS as follows: (1) CPE sends a SYN packet: The CPE sends a TCP segment with the synchronization sequence number SYN flag to the ACS. In the segment, the SYN flag is set to 1, indicating that this is a connection request message. At the same time, the segment also contains a sequence number, which is randomly generated by the CPE and used for subsequent confirmation and data packet sorting during the communication process. (2) CS responds with a SYN-ACK packet: When the ACS receives the SYN packet sent by the CPE, it sends a synchronization confirmation SYN-ACK segment as a response. In the SYN-ACK segment, both the SYN and ACK flags are set to 1, indicating that this is a confirmation of the connection request, and the ACS is also preparing its own sequence number for the new connection. The SYN-ACK segment contains an acknowledgment number for the sequence number in the CPE's SYN segment, and the ACS's own initial sequence number. The acknowledgment number is the CPE's sequence number plus 1. (3) CPE sends ACK packet: When CPE receives the SYN-ACK segment from ACS, it sends an ACK segment in response. In the ACK segment, the ACK flag is set to 1, indicating that this is an acknowledgment of the SYN-ACK segment. The acknowledgment number in the ACK segment is set to the initial sequence number of ACS plus 1, indicating that CPE has received the SYN-ACK segment from ACS and is ready to exchange data. Through the above three steps, a reliable TCP connection is established between the CPE and the ACS.

4. A method for implementing remote configuration management of a home smart gateway according to claim 1, characterized in that: In step 3, the CPE and ACS use the SSL / TLS protocol for encrypted communication. The steps are as follows: (1) The ACS responds to the CPE's connection request and sends its own SSL / TLS certificate to the CPE. The certificate contains the ACS's public key, information about the CA that issued the certificate, and the validity period. (2) After receiving the certificate from the ACS, the CPE verifies the validity of the certificate, including whether it is issued by a trusted CA, whether the certificate has expired, and whether the domain name in the certificate matches the requested domain name. If the certificate verification is successful, the CPE generates a random number, called a pre-key or Pre-Master Secret, and encrypts the random number using the ACS's public key before sending it to the ACS. This process is called key exchange. (3) During the key exchange process, the CPE and ACS will perform key exchange and protocol parameter negotiation to determine the encryption algorithm, key length, and session key used in subsequent communications. The CPE and ACS will also negotiate the use of a pre-set key, the client's and server's respective random numbers, and generate a session key using the TLS protocol's pseudo-random number generator function (PRF). The session key will be used for encryption and decryption in subsequent communications. (4) The CPE uses the session key to encrypt the data to be sent to the ACS, and then sends the encrypted data to the ACS. When the ACS receives the encrypted data, it will use the session key to decrypt the data to restore the original data. The ACS also uses the session key to encrypt the data to be sent to the CPE. When the CPE receives the encrypted data, it will use the session key to decrypt the data to restore the original data.

Images