System and method for connecting customer premises equipment

Abstract

Systems and methods for automatically and securely connecting customer premises equipment (CPE) (102) to a headquarters production environment (110) are disclosed. The method comprises: automatically sending a handshake message from the CPE (102) to a headquarter pre-registration server (106); establishing a universal VPN tunnel (113) between the CPE (102) and an isolated server; obtaining one or more parameters from the CPE and establishing a pre-registered tunnel (114); validating the CPE using the one or more parameters (102); and establishing a production tunnel (113) between the CPE (102) and the production environment (110).

Description

Technical Field

[0001] Embodiments described herein relate generally to remote equipment configuration and, more particularly, to automatically and securely connecting customer premises equipment via a third party network. Background Art

[0002] Some companies / entities need to distribute customer premises equipment (CPE) to remote customers (e.g., by mailing the CPE or sending a technician to install the CPE), and then securely connect the CPE to the company server / network in order to, for example, configure / maintain / update / instruct / check the CPE. Companies typically need to use one or more third-party networks (e.g., using the Internet) to connect their CPE.

[0003] U.S. Patent No. 10,069,802 describes a method for securely configuring a CPE in a network including a configuration server, a DHCP server, and a CPE. The method includes: receiving a request from a CPE to lease an Internet Protocol (IP) address to the CPE; embedding a portion of a media access control (MAC) address of the CPE into the IP address; authenticating the CPE; and providing configuration to the CPE. The method also includes using a characteristic attribute of the CPE to generate an encryption key to establish a secure connection.

[0004] The present invention is directed to overcoming one or more problems discovered by the inventors. Summary of the invention

[0005] In one embodiment, a method of connecting customer premises equipment (CPE) to a production environment is disclosed. The method includes: sending a handshake packet from the CPE to a pre-registration server via a third-party network; determining via the pre-registration server that the handshake packet is legitimate; obtaining an identification parameter from the CPE; establishing a pre-registration tunnel between the CPE and an isolated portion of a headquarters data center; verifying the CPE using the identification parameter; and establishing a secure connection between the CPE and the production environment in response to the verification.

[0006] In one embodiment, a system for connecting to a CPE via a third-party network is disclosed. The system includes a pre-registration server configured to: receive a general VPN tunnel initiation request from the CPE; authenticate the general VPN tunnel initiation request; establish a first general VPN tunnel to the CPE; obtain one or more parameters from the CPE using a protected communication channel within the general VPN tunnel; pre-register the CPE by establishing a second CPE temporary pre-registration tunnel; and establish a third VPN tunnel between the CPE and a production server.

[0007] In one embodiment, a method for authenticating a CPE is disclosed. The method includes: receiving a handshake packet from the CPE; verifying the handshake packet; establishing a universal VPN tunnel to the CPE at least in response to the verification; obtaining one or more CPE parameters using a protected communication channel within the universal VPN tunnel; and verifying that the CPE is authentic and establishing a pre-registration tunnel based on the one or more CPE parameters. DETAILED DESCRIPTION

[0008] The details of the embodiments of the present disclosure, both as to its structure and operation, may be gleaned in part by studying the accompanying drawings, in which like reference numerals represent like parts, and in which:

[0009] Figure 1 A production system according to an embodiment is shown;

[0010] Figure 2 An example processing system according to an embodiment is shown by which one or more of the processes described herein may be performed;

[0011] Figure 3 shows the automatic connection of the CPE to Figure 1 A flowchart of a method for producing an environment within a system; and

[0012] Figure 4 Shows the Figure 1 A flow chart of a method for authenticating a CPE within a system and connecting to the CPE. DETAILED DESCRIPTION

[0014] The detailed description set forth below in conjunction with the accompanying drawings is intended as a description of various embodiments, rather than being intended to represent the only embodiment in which the present disclosure may be practiced. The detailed description includes specific details for providing a thorough understanding of the embodiments. However, it is apparent to those skilled in the art that embodiments of the present invention may be practiced without these specific details. In some cases, known structures and components are shown in simplified form for brevity of description.

[0015] For the sake of clarity and ease of explanation, some surfaces and details may be omitted in this specification and drawings. In addition, it should be understood that as used herein, the terms "side", "top", "bottom", "front" and "rear" are used for ease of understanding to convey the relative positions of various components with respect to each other, and do not imply any particular orientation of those components in absolute terms (e.g., relative to the external environment or the ground).

[0016] The following embodiments describe systems and methods for automatically connecting to customer premises equipment that: provide simple and fast customer network configuration; are widely and easily scalable globally; do not require initiating a connection to the CPE from outside the customer premises network (which may be prohibited by the security of the customer premises network); provide a high level of security; support the latest security protocols; support simultaneous and multiple installations of equipment on the same customer network; and allow zero-touch configuration in the field in the event of hardware replacement.

[0017] Figure 1 A production system including data transmission according to an exemplary embodiment is shown.

[0018] The CPE 102 may be a network connection device (e.g., a router or gateway) that interfaces / connects to field production or data collection equipment 112 (e.g., turbines, sensors, etc.). The CPE 102 is provided (e.g., rented or sold) to a customer by an entity (e.g., a company / enterprise). The CPE is installed at the customer's premises by a technician (e.g., a company employee) who collects (manually or automatically) one or more parameters of the CPE 102. After installation, the company has several ways to use the installation parameters to identify and authenticate the CPE 102. For example, at the time of installation, the technician may note the time / date of installation and the expected IP address of the CPE. In addition, the CPE may be manufactured or pre-installed with further identifying features, such as a device serial number. Finally, in an exemplary embodiment, the CPE 102 is pre-programmed to automatically attempt to establish a universal VPN tunnel to the company's pre-registration server 106 by continuously transmitting predetermined handshake messages to the pre-registration server 106 public IP address.

[0019] The network 104 may include the Internet, and the CPE 102 may communicate with the preregistration server 106 via the Internet using standard transfer protocols such as Hypertext Transfer Protocol (HTTP), Secure HTTP (HTTPS), File Transfer Protocol (FTP), Secure FTP (FTPS), Secure Shell FTP (SFTP), etc., as well as proprietary protocols. The network 104 may additionally include a customer premises intranet, a customer premises local area network, an LTE / 4G / 5G network, etc. Although the CPE 102 is illustrated as being connected to the preregistration server 106 via a single set of networks 104, it should be understood that the CPE 102 may be connected to various systems via different sets of one or more sets of networks.

[0020] The company headquarters data center may include a pre-registration server 106, a production server 108, and a production environment 110. In an exemplary embodiment, the pre-registration server 106 may be a dedicated server with a defined pre-registration server IP address. Although a single pre-registration server 106 is discussed, the pre-registration server 106 may include one or more servers that host and / or execute one or more pre-registration server functions, processes, methods, and / or software modules described herein. The pre-registration server 106 may include a server application and / or one or more databases, or be communicatively connected to the server application and / or one or more databases. A general VPN tunnel 113 (initiated by CPE 102) may be formed between the CPE 102 and the pre-registration server. A pre-registration tunnel 114 may be formed between the CPE 102 and the pre-registration server 106.

[0021] A user terminal 118 at the headquarters data center is communicatively connected to the pre-registration server 106 and the production server 108 and can be used by a user / engineer to access both.

[0022] The production server 108 may be a dedicated server with a defined production server IP address. In one embodiment, the production server 108 is connected to or is part of a production environment 110. The production environment 110 may be a plurality of servers and / or cloud instances that aggregate and analyze data collected from a plurality of customer equipment, including remote equipment 112. For example, the production environment 110 may collect and analyze various sensor data from each remote equipment (e.g., turbine) belonging to or served by a company / enterprise. A production tunnel 116 may be formed between the CPE 102 and the production server 108. The production tunnel 116 may be used to send site-to-site production data between the remote equipment 112 and the headquarters production environment 110.

[0023] Figure 2 is a block diagram illustrating an example wired or wireless system 200 that can be used in conjunction with the various embodiments described herein. For example, the system 200 can be used as or in conjunction with one or more of the functions, processes, or methods described herein (e.g., storing and / or executing implementation software), and can represent a component of the CPE 102, pre-registration server 106, production server 108, user equipment / terminal 118, and / or other processing devices described herein. The system 200 can be a server or any conventional personal computer, or any other processor-enabled device capable of wired or wireless data communications. As will be apparent to those skilled in the art, other computer systems and / or architectures can also be used.

[0024] The system 200 preferably includes one or more processors 210. The processor 210 may include a central processing unit (CPU). Additional processors may be provided, such as a graphics processing unit (GPU), an auxiliary processor to manage input / output, an auxiliary processor to perform floating point math operations, a special microprocessor with an architecture suitable for fast execution of signal processing algorithms (e.g., a digital signal processor), a processor subordinate to the main processing system (e.g., a back-end processor), an additional microprocessor or controller for a dual processor system or a multi-processor system, and / or a coprocessor. Such auxiliary processors may be discrete processors or may be integrated with the processor 210. Examples of processors that may be used with the system 200 include, but are not limited to, any processor provided by Intel Corporation of Santa Clara, California (e.g., Core TM i7, any processor provided by Advanced Micro Devices, Incorporated (AMD) of Santa Clara, California, any processor provided by Apple Inc. of Cupertino (e.g., A series, M series, etc.), any processor provided by Samsung Electronics Co., Ltd., of Seoul, South Korea (e.g., ), any processor provided by NXP Semiconductors NV of Eindhoven, Netherlands.

[0025] The processor 210 is preferably connected to a communication bus 205. The communication bus 205 may include a data channel for facilitating information transfer between the memory and other peripheral components of the system 200. In addition, the communication bus 205 may provide a set of signals for communicating with the processor 210, including a data bus, an address bus, and / or a control bus (not shown). The communication bus 205 may include any standard or non-standard bus architecture, such as a bus architecture that conforms to the Industry Standard Architecture (ISA), the Extended Industry Standard Architecture (EISA), the Micro Channel Architecture (MCA), the Peripheral Component Interconnect (PCI) local bus, a standard published by the Institute of Electrical and Electronics Engineers (IEEE), etc.

[0026] The system 200 preferably includes a main memory 215 and may also include a secondary memory 220. The main memory 215 provides storage of instructions and data for programs (such as any software discussed herein) executed on the processor 210. It should be understood that the programs stored in the memory and executed by the processor 210 can be written and / or compiled according to any suitable language, including but not limited to C / C++, Java, JavaScript, Perl, VisualBasic, NET, etc. The main memory 215 is typically a semiconductor-based memory, such as a dynamic random access memory (DRAM) and / or a static random access memory (SRAM). Other semiconductor-based memory types include, for example, synchronous dynamic random access memory (SDRAM), Rambus dynamic random access memory (RDRAM), ferroelectric random access memory (FRAM), etc., including read-only memory (ROM).

[0027] The secondary memory 220 is a non-transitory computer-readable medium on which computer executable code (e.g., any software disclosed herein) and / or other data is stored. The computer software or data stored on the secondary memory 220 is read into the main memory 215 for execution by the processor 210. The secondary memory 220 may include, for example, semiconductor-based memories such as programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable read-only memory (EEPROM), and flash memory (block-oriented memory similar to EEPROM).

[0028] The secondary memory 220 may optionally include internal media 225 and / or removable media 230. The removable media 230 is read and / or written in any known manner. The removable storage medium 230 may be, for example, a tape drive, a compact disc (CD) drive, a digital versatile disc (DVD) drive, other optical drives, a flash drive, etc.

[0029] In an embodiment, the I / O interface 235 provides an interface between one or more components of the system 200 and one or more input and / or output devices. Example input devices include, but are not limited to, sensors, keyboards, touch screens or other touch-sensitive devices, cameras, biometric sensing devices, computer mice, trackballs, pen-based pointing devices, and the like. Examples of output devices include, but are not limited to, other processing devices, cathode ray tubes (CRTs), plasma displays, light emitting diode (LED) displays, liquid crystal displays (LCDs), printers, vacuum fluorescent displays (VFDs), surface conduction electron emitter displays (SEDs), field emission displays (FEDs), and the like. In some cases, input and output devices may be combined, such as in the case of a touch panel display (e.g., a display console, or in a smartphone, tablet computer, or other mobile device).

[0030] System 200 may include a communication interface 240. Communication interface 240 allows software and data to be transferred between system 200 and external devices (e.g., a printer), a network (e.g., network 104), or other information sources. For example, computer software or executable code may be transferred from a network server (e.g., pre-registration server 106 or production server 108) to system 200 via communication interface 240. Examples of communication interface 240 include a built-in network adapter, a network interface card (NIC), a Personal Computer Memory Card International Association (PCMCIA) network card, a cardbus network adapter, a wireless network adapter, a universal serial bus (USB) network adapter, a modem, a wireless data card, a communications port, an infrared interface, IEEE 1394 FireWire, and any other device capable of interfacing system 200 with a network (e.g., network 104) or another computing device. The communication interface 240 preferably implements industry-published protocol standards, such as Ethernet IEEE 802 standards, Fiber Channel, Digital Subscriber Line (DSL), Asynchronous Digital Subscriber Line (ADSL), Frame Relay, Asynchronous Transfer Mode (ATM), Integrated Digital Services Network (ISDN), Personal Communications Service (PCS), Transmission Control Protocol / Internet Protocol (TCP / IP), Serial Line Internet Protocol / Point-to-Point Protocol (SLIP / PPP), etc., but may also implement customized or non-standard interface protocols.

[0031] Software and data transmitted via communication interface 240 are typically in the form of electrical communication signals 255. These signals 255 may be provided to communication interface 240 via communication channel 250. In embodiments, communication channel 250 may be a wired or wireless network (e.g., network 104) or any other communication link of any kind. Communication channel 250 carries signals 255 and may be implemented using a variety of wired or wireless communication means, including wire or cable, fiber optics, conventional telephone lines, cellular telephone links, wireless data communication links, radio frequency ("RF") links, or infrared links, to name a few.

[0032] Computer executable code (e.g., computer programs, such as the disclosed software) is stored in the main memory 215 and / or the secondary memory 220. The computer executable code may also be received via the communication interface 240 and stored in the main memory 215 and / or the secondary memory 220. Such computer programs, when executed, enable the system 200 to perform various functions of the disclosed embodiments described elsewhere herein.

[0033] In this specification, the term "computer-readable medium" is used to refer to any non-transitory computer-readable storage medium used to provide computer executable code and / or other data to or within the system 200. Examples of such media include main memory 215, secondary memory 220 (including internal memory 225 and / or removable media 230), external storage media 245, and any peripheral devices (including network information servers or other network devices) communicatively coupled to communication interface 240. These non-transitory computer-readable media are components used to provide software and / or other data to system 200.

[0034] System 200 may also include optional wireless communication components that facilitate wireless communication over a voice network and / or a data network (e.g., network 104). The wireless communication components include antenna system 270, radio system 265, and baseband system 260. Baseband system 260 is communicatively coupled to processor 210. In system 200, radio frequency (RF) signals are sent and received over the air by antenna system 270 under the management of radio system 265.

[0035] Figure 3 is a flow chart of a method for automatically connecting CPE 102 to a corporate production environment 110 from the perspective of CPE 102. Figure 3 The method can be Figure 1 implemented within the system. Figure 3 The functions / procedures described in Figure 2 One or more parts of the system described in are implemented as software modules of CPE 102.

[0036] In step 302, the CPE 102 is installed in the remote environment. The CPE 102 is installed as part of a broader project to collect data and send the data between the remote production environment 112 and the headquarters data center production environment 110. In an exemplary embodiment, a field technician personally goes to the site to install the CPE 102 and connect the CPE to the network 104. In one embodiment, the installation can be synchronized with the headquarters data center staff / technician receiving the identification parameters of the installation. At this time, these identification parameters are recorded / sent as expected identification parameters of the CPE 102. The installed CPE 102 automatically includes some identification parameters, such as the device serial number and public key. In addition, the field technician also collects other identification parameters during the installation process, such as the IP and default gateway configured by the CPE 102, the CPE 102 source public IP, the installation date and time, etc. In one embodiment, the expected date / time of registration is included in the identification. The expected date / time can be determined by the field technician, for example, based on the location of the CPE, a predetermined schedule, etc. In one embodiment, some or all identification parameters can be automatically sent to the headquarters data center.

[0037] In step 304, CPE 102 connects to network 104 through which it can access the headquarters data center.

[0038] In step 306, the CPE 102 announces itself by transmitting a handshake packet to the headquarters (e.g., to the preregistration public server 106). In an exemplary embodiment, the CPE 102 is preprogrammed to transmit handshake messages within the expected protocol to the public IP address of the preregistration server 106. The CPE 102 continues to transmit handshake messages indefinitely (e.g., periodically or on a schedule) as long as: (i) it has the ability to transmit traffic over the Internet, and (ii) it has not received a proper response from the preregistration server 106. In an exemplary embodiment, the handshake message includes an encrypted virtual private network (VPN) initiation request. In one embodiment, the VPN initiation request is a WireGuard initiation request, but other common VPN protocols may be used. The encryption key set is preprogrammed / preinstalled on the CPE.

[0039] In step 308, CPE 102 receives a response to the handshake message from the headquarters (eg, from preregistration server 106). In one embodiment, the response includes the creation of a common VPN tunnel 113 initiated by the CPE.

[0040] In step 310, CPE 102 receives a secure shell (SSH) session initiation within common VPN tunnel 113. In step 312, CPE 102 sends a reply to the SSH session.

[0041] In steps 314 to 320, the CPE 102 receives the request for identification parameters (step 314) and transmits the identification parameters within the SSH session (step 316). In step 316, the CPE 102 sends its identification parameters, including, for example, the device serial number, the device configured IP and default gateway, the device source public IP, the CPE installation / registration date and time, etc. After sending the identification parameters, the CPE 102 waits until the headquarters data center verifies the CPE 102, and in step 318, the CPE receives the temporary pre-registration tunnel 114 configuration parameters from the pre-registration server 106. In step 320, the CPE establishes the temporary pre-registration tunnel 114.

[0042] After the final / manual verification, in step 322, the corporate headquarters data center server (e.g., pre-registration server 106, production server 108, etc.) generates the final production tunnel 116 from CPE 102 to the headquarters production server 108. After the production tunnel 116 is established, CPE 102 can send remote production data (e.g., turbine data) to the production environment 110.

[0043] Figure 4 From the perspective of headquarters Figure 3 Flowchart of the method. Figure 4 The process can be Figure 1 production system. Figure 4 The functions / procedures described in Figure 2 One or more parts of the system described in the present invention may be at least partially implemented as software modules (e.g., pre-registration server 106, production server 108, etc.).

[0044] In step 402, the pre-registration server 106 is ready and waiting to receive a handshake message / handshake packet.

[0045] In step 404, the preregistration server 106 receives a handshake packet from the CPE 102. In one embodiment, the handshake packet includes a VPN initiation request for authentication using an expected key.

[0046] In steps 406 to 410, the pre-registration server 106 performs the initial verification step of the handshake packet. Steps 406 to 410 represent Figure 4The first authentication step within the method. In step 406, the preregistration server 106 determines whether the handshake message is part of an existing stream. If the handshake message is part of an existing stream, the preregistration performs no further steps and returns to waiting by default (step 402). In step 408, if the handshake message is from a new CPE, the preregistration server 106 determines whether the message includes an appropriate VPN initiation request (e.g., a WireGuard initiation request). If the packet does not include the initiation request, the preregistration server 106 returns to waiting. In step 410, the preregistration server 106 determines whether the public CPE encryption key matches the expected encryption key. If the keys do not match, the preregistration server returns to step 402. Otherwise, the process proceeds to step 412.

[0047] Once the handshake message is verified, steps 412 and 414 are performed. In step 412, the pre-registration server 106 responds to the handshake message. In step 414, the pre-registration server 106 establishes a universal VPN tunnel 113 to the CPE 102 based on the VPN initiation request.

[0048] In step 416 , pre-registration server 106 opens an SSH session to CPE 102 in common VPN tunnel 113 .

[0049] In step 417, the preregistration server 106 receives an appropriate response from the CPE. At this point, the device / CPE 102 is authenticated as a genuine CPE. Figure 4 The second authentication step within the method.

[0050] In step 418, the preregistration server 106 uses the SSH session to retrieve CPE identification parameters from the CPE 102. In one embodiment, the preregistration server 106 transmits a request to the CPE 102 and receives the parameters in response to the request. These identification parameters may include one or more of the following: device serial number, device configured IP and default gateway, device source public IP, and installation and / or registration date / time.

[0051] In step 422, the preregistration server 106 preregisters the CPE 102 (transmits temporary tunnel parameters to the CPE, establishes a preregistration tunnel, and inserts the CPE into a preregistration queue). In an exemplary embodiment, the preregistration server 106 also sends a command to the CPE 102 to, for example, display a notification / message on a display of the CPE 102 (e.g., notifying the user that the device has been preregistered). In step 422, the CPE 102 waits in the preregistration queue until the final verification and preregistration server 106 process is complete.

[0052] In step 424, a final verification of CPE 102 is performed. The final verification is Figure 4 The third authentication step of the method. The final verification includes verifying at least some of the identification parameters received from the CPE 102 with expected identification parameters (e.g., collected during installation of the CPE or learned from the manufacturer). The identification parameters used in the final verification step may include one or all of the following: the public IP address of the CPE, the installation or registration date and time, etc. In one embodiment, the registration date and / or time received from the CPE is compared to the current date / time. In another example, the installation date / time received from the CPE is compared to the current date / time, and it is verified whether the current date / time is within a specific time range after the installation date / time. For example, the registration process can be expected to occur within a specific time period after the CPE is installed (e.g., one month, one year, etc.).

[0053] In step 426, if the final verification of CPE 102 passes, the process continues to connect the CPE to the production server (step 428), and remove the CPE from the pre-registration queue (step 429). Otherwise, if the final verification does not pass, in step 427, CPE 102 is removed from the pre-registration queue and optionally placed on a block list.

[0054] The tunnel 116 established between the CPE 102 and the headquarters data center production server 108 in step 428 is a protected VPN tunnel 116 that the CPE 102 can use to send production data from the remote production environment 112 to the headquarters production environment 110, and vice versa. The production server 108 can use the protected VPN tunnel to securely: collect data from the remote environment 112, transmit instructions to the remote environment 112, configure the CPE 102, etc.

[0055] In an exemplary embodiment, final verification 426 is performed by an engineer / staff member at the headquarters center via, for example, user terminal 118 ( Figure 1 ). In some embodiments, personnel must manually check whether the identification parameters received from the CPE during the pre-registration process match the expected identification parameters (e.g., the identification parameters collected by a technician during CPE installation and / or determined for the CPE during manufacturing / pre-programming). In alternative embodiments, some or all portions of the final verification are performed automatically via one or more software modules (e.g., within system 200).

[0056] Although Figure 3 and Figure 4The processes are illustrated as having certain arrangements and orderings of subprocesses, but these processes can be implemented with fewer, more, or different subprocesses and different arrangements and / or orderings of subprocesses. It should be understood that any subprocess that is not dependent on the completion of another subprocess can be performed before, after, or in parallel with other independent subprocesses, even if the subprocesses are described or illustrated in a particular order.

[0057] It should be understood that the above benefits and advantages may relate to one embodiment or may relate to several embodiments. Aspects described in conjunction with one embodiment are intended to be usable with other embodiments. Any explanation in conjunction with one embodiment applies to similar features of other embodiments, and elements of multiple embodiments may be combined to form other embodiments. The embodiments are not limited to embodiments that solve any or all of the problems described or embodiments that have any or all of the benefits and advantages described.

[0058] The foregoing detailed description is merely exemplary in nature and is not intended to limit the invention or the application and use of the invention. The described embodiments are not limited to use in conjunction with a particular type of processing system or machine. Therefore, although the present embodiment is depicted and described as being implemented in a particular processing system for ease of illustration, it should be understood that it can be implemented in various other types of processing systems and machines. In addition, it is not expected to be bound by any theory proposed in any of the preceding sections. It should also be understood that the illustrations may include exaggerated dimensions and graphic representations to better illustrate the referenced items shown, and are not to be considered restrictive unless explicitly stated as such.

Claims

1. A method of connecting customer premises equipment (CPE) (102) to a production environment (110), the method comprising: Sending a handshake packet from the CPE (102) to a pre-registration server (106) via a third-party network (104); Determining, via the pre-registration server (106), that the handshake packet is legitimate; Obtaining identification parameters from the CPE (102); Establishing a pre-registration tunnel between the CPE (102) and an isolated portion of a headquarters data center; authenticating the CPE using the identification parameters (102); and In response to the verification, a secure connection (116) is established between the CPE (102) and the production environment (110).

2. The method of claim 1, wherein sending the handshake packet comprises: The handshake packets are continuously sent.

3. The method of claim 1 , wherein sending the handshake packet comprises: The handshake packet is automatically sent to a pre-programmed public IP address on the CPE (102).

4. The method according to claim 1, wherein determining that the handshake packet is legitimate comprises at least: The handshake packet is authenticated using the expected key.

5. The method according to claim 1, wherein determining that the handshake packet is legitimate comprises at least: It is determined that the handshake packet includes a VPN initiation request.

6. The method according to claim 1, wherein determining that the handshake packet is legitimate comprises at least: It is determined that the handshake packet is not part of an existing flow.

7. The method according to claim 1, further comprising: Prior to establishing the pre-registration tunnel, a general VPN tunnel is established and a secure shell (SSH) session is opened to the CPE to retrieve CPE identification parameters and to transmit temporary parameters to establish the pre-registration tunnel.

8. The method of claim 1 , wherein authenticating the CPE comprises: enabling users of the headquarters data center to view at least some of the identification parameters; And receiving manual verification of the CPE from the user.

9. The method of claim 1 , wherein authenticating the CPE comprises: At least some of the identified parameters are automatically compared to one or more expected parameters.

10. The method of claim 1, wherein the identification parameters include one or more of: a unique serial number, a public IP address, and a registration time.

11. The method according to claim 10, further comprising: Prior to authenticating the CPE, the CPE is placed in a pre-registration queue.

12. The method according to claim 11, further comprising: Before placing the CPE in the pre-registration queue, determine that the CPE can be pre-registered.

13. A system for connecting to a CPE (102) via a third party network (104), the system comprising: A pre-registration server (106), wherein the pre-registration server is configured to: Receiving a general VPN tunnel initiation request from the CPE (102); authenticating the request to initiate the universal VPN tunnel; Establishing a first universal VPN tunnel (113) to the CPE (102); obtaining one or more parameters from the CPE (102) using a protected communication channel within the common VPN tunnel; pre-registering the CPE (102) by establishing a second CPE temporary pre-registration tunnel (114); and A third VPN tunnel (116) is established between the CPE (102) and the production server (108).

14. The system of claim 13, wherein the first universal VPN tunnel (113) and the second CPE temporary pre-registration tunnel (114) are located between the CPE (102) and an isolation server, wherein the isolation server is isolated from the production server (108).

15. The system of claim 13, wherein pre-registering the CPE based on the one or more parameters comprises: Determining that the unique serial number of the CPE (102) is not in a database of registered devices; And based at least on the determination, pre-registering the CPE (102).

Images