AUTOMATIC RESIDENTIAL GATEWAY AUTHORIZATION METHOD

Abstract

A residential gateway includes a modem for connecting to a mobile network through which a broadband network is accessible, and a broadband controller for connecting to the broadband network. The residential gateway activates a service when two authentication steps (503 and 506) are successfully completed: one authentication, by the broadband controller, of the residential gateway to the broadband network; and one authentication, by the modem, of the residential gateway to the mobile network via a mobile network user plan. Figure to be published with the abbreviation: Fig. 5

Description

Title of the invention: METHOD FOR AUTOMATIC AUTHENTICATION OF A RESIDENTIAL GATEWAY technical field

[0001] The present invention relates to a method of automatic multi-factor authentication of a residential gateway offering broadband network access services via fixed wireless access (FWA). STATE OF PRIOR ART

[0002] Fixed wireless access (FWA) technologies enable network operators to provide ultra-fast broadband network access without having to deploy cable or fiber network infrastructure, by leveraging the latest generation of mobile network technologies (4G, 5G, etc.). This makes it possible, in particular, to provide broadband network access services in suburban and rural geographic areas where deploying fiber optics can be highly complex in terms of deployment and maintenance.

[0003] Furthermore, in order to strengthen access security to services, the use of two-factor authentication (2FA) is now widespread. The service is made accessible to an end user after they have presented two separate proofs of identity to an authentication mechanism.

[0004] It is desirable to provide a solution that strengthens remote authentication of residential gateways to offer the end user access to certain services (e.g., Internet access), without requiring interaction with the end user. Description of the invention

[0005] A method for activating service via a residential gateway is proposed herein. The residential gateway comprises electronic circuitry implementing a modem for connecting the residential gateway to a mobile network through which a broadband network is accessible, and a broadband controller for connecting the residential gateway to the broadband network. The method includes pre-authentication of the residential gateway to the mobile network via a control plane, so as to establish a communication link between the residential gateway and the mobile network via a user plane through which the residential gateway communicates with the broadband network. The method further comprises a first authentication and a second authentication, of which: one to Authentication, by the broadband controller, of the residential gateway to the broadband network; and authentication, by the modem, of the residential gateway to the mobile network via the mobile network user plan. The residential gateway activates the service once both the first and second authentications have been successfully completed.

[0006] Thus, remote authentication of the residential gateway to offer an end user access to certain services (e.g., Internet access) is strengthened, without however requiring interaction with the end user.

[0007] According to a particular embodiment, the broadband controller instructs the modem to initiate authentication of the residential gateway with the mobile network via the mobile network user plan.

[0008] According to a particular embodiment, the second authentication is triggered after the first authentication has been successfully completed.

[0009] According to a particular embodiment, the service is a broadband network access service.

[0010] According to a particular embodiment, the authentication, by the modem, of the residential gateway with the mobile network via the mobile network user plan includes sending an SMS-type message by the residential gateway.

[0011] According to a particular embodiment, the SMS-type message contains, in the body of said SMS message, a predetermined string of characters associated with the residential gateway.

[0012] A computer program is also proposed comprising program code instructions that cause an implementation of the process described above in any of its embodiments when said instructions are executed by a processor. An information storage medium for storing such program code instructions is also proposed herein.

[0013] According to a particular embodiment, during the authentication, by the modem, of the residential gateway with the mobile network via the mobile network user plan, the mobile network delegates said authentication to the broadband network.

[0014] A residential gateway is also proposed, comprising electronic circuitry configured to implement a modem for connecting the residential gateway to a mobile network through which a broadband network is accessible, and a broadband controller for connecting the residential gateway to the broadband network. The electronic circuitry is configured to perform pre-authentication of the residential gateway to the mobile network via a control plane, so as to establish a communication link between the residential gateway and the mobile network via a user plane through which the residential gateway communicates with the broadband network. The electronic circuitry is further configured to The system performs two authentication steps: first, by the broadband controller, of the residential gateway to the broadband network; and second, by the modem, of the residential gateway to the mobile network via the mobile network's user plan. The electronic circuitry is configured to activate the service once both the first and second authentications have been successfully completed. Brief description of the drawings

[0015] The features of the invention mentioned above, as well as others, will become clearer upon reading the following description of at least one exemplary embodiment, said description being made in relation to the accompanying drawings, among which:

[0016] [Fig.1] schematically illustrates a communication system;

[0017] [Fig.2] schematically illustrates an internal interconnection of a residential gateway of the communication system;

[0018] [Fig.3] schematically illustrates a material arrangement usable in the residential gateway;

[0019] [Fig.4] schematically illustrates logical communication paths in the communication system;

[0020] [Fig.5] schematically illustrates an authentication algorithm implemented by the residential gateway, in one embodiment;

[0021] [Fig.6] schematically illustrates exchanges occurring in the communication system within the framework of authentication of the residential gateway, in one embodiment; and

[0022] [Fig.7] schematically illustrates exchanges occurring in the communication system within the framework of authentication of the residential gateway, in another embodiment.

[0023] DETAILED DESCRIPTION OF IMPROVEMENTS

[0024] Fig. 1 thus schematically illustrates a communication system comprising an RGW 110 residential gateway.

[0025] The RGW 110 residential gateway implements a fixed wireless access (FWA) technology. The RGW 110 residential gateway is considered a CPE (Customer-Premises Equipment) type device in FWA technologies.

[0026] The RGW 110 residential gateway is capable of providing a set of services to an end user, including a broadband network access service, also referred to as a high-speed network or fixed access network, BBNET 130 via a MNET 120 mobile network. The terms "broadband network", "high-speed network", and "fixed access network" are used interchangeably.

[0027] The RGW 110 residential gateway includes an FWAM 151 modem for connecting the RGW 110 residential gateway to the MNET 120 mobile network and a BBC 150 broadband controller (or broadband access controller) for connecting the RGW 110 residential gateway to the BBNET 130 broadband network. By the term "broadband controller", it is also understood to mean a broadband network access controller, or equivalently, a broadband network access controller.

[0028] The RGW 110 residential gateway preferably includes a LAN (Local Area Network) interface manager, such as an AP 152 access point, enabling the establishment of a WLAN (Wireless LAN) type network, such as a Wi-Fi network. The user can thus take advantage of the services offered by the BBNET 130 broadband network via a UDEV 141 user terminal or device (such as a computer, tablet, smartphone, TV decoder, etc.).

[0029] Figure [Fig. 2] schematically illustrates an internal interconnection of the RGW 110 residential gateway.

[0030] The FWAM 151 modem is interconnected with the BBC 150 controller.

[0031] The FWAM 151 modem is interconnected with a SIM card reader (“Subscriber Identity Module (in English) SCR 220 in which a SIM card (in English) can be placed 230. Alternatively, the FWAM 151 modem can be interconnected with an eSIM type chip soldered onto an electronic board of the RGW 110 residential gateway or integrated in software and / or hardware into the RGW 110 residential gateway. The FWAM 151 modem implements a User Equipment (UE) function with respect to the MNET 120 mobile network, according to the terminology used in mobile telephone network standards.

[0032] The FWAM 151 modem is interconnected with an ANT 210 antenna system enabling the FWAM 151 modem to communicate with equipment of the MNET 120 mobile network.

[0033] Interconnections within the RGW 110 residential gateway can be achieved through communication buses, for example of the PCI (“Peripheral Component Interconnect” type) or USB (“Universal Serial bus” type).

[0034] To enable the RGW 110 residential gateway to benefit from the services of the MNET 120 mobile network, the FWAM 151 modem authenticates the 230 SIM card, or the eSIM chip, with the MNET 120 mobile network, for example by exchanging information with an AuC (Authentication Center) of the MNET 120 mobile network. Following this prior authentication of the Using a 230 SIM card or eSIM chip, the FWAM 151 modem holds an encryption key that enables communication to be established by and with the RGW 110 residential gateway on the MNET 120 mobile network. The RGW 110 residential gateway can thus access the services of the MNET 120 mobile network. An operational communication link is then established between the RGW 110 residential gateway and the core of the MNET 120 mobile network, and further authentication can then be performed to allow the RGW 110 residential gateway to access the services of the BBNET 130 broadband network.

[0035] The FWAM 151 modem and the BBC 150 controller operate independently of each other. Each has its own processing / computing and memory resources. The FWAM 151 modem and the BBC 150 controller can be implemented in software on the same processor and interconnected by a software bus. Alternatively, the FWAM 151 modem and the BBC 150 controller can be implemented on separate processors and interconnected by a hardware bus.

[0036] Fig. 3 schematically illustrates a hardware arrangement usable in the RGW 110 residential gateway, more particularly for implementing the BBC 150 controller and / or the FWAM 151 modem.

[0037] The hardware arrangement shown comprises, connected by a communication bus 310: a processor or CPU (Central Processing Unit) 301; a RAM (Random-Access Memory) 302; a non-volatile memory, for example of type ROM (Read Only Memory) 303 or EEPROM (Electrically-Erasable Programmable ROM), or of type Flash; a storage unit, such as a storage medium SM 304, for example a hard disk drive HDD, or a storage medium reader, such as an SD card reader (Secure Digital); and a COM interface manager 305.

[0038] The COM 305 interface manager allows the presented hardware arrangement to interact with other elements of the RGW 110 residential gateway, such as the SCR 220 SIM card reader or the ANT 210 antenna system or the AP 152 access point.

[0039] The processor or CPU 301 is capable of executing instructions loaded into the RAM 302, in particular from the non-volatile memory 303 or the SM storage medium (such as an SD card) 304. When the hardware arrangement shown is powered on, the processor or CPU 301 is thus capable of reading instructions from the RAM 302 and executing them. These instructions form a computer program causing, in particular, the implementation by the processor or CPU 301 of the steps and behaviors described herein in relation to the FWAM modem 151 and the BBC controller 150, or more generally the RGW residential gateway 110.

[0040] All or part of the steps and behaviors described herein can thus be implemented in software form by the execution of a set of instructions by a programmable machine, for example a DSP (Digital Signal Processor) or a microcontroller, or be implemented in hardware form by a dedicated machine or electronic component (chip) or a dedicated set of electronic components (chipset), for example an FPGA (Field Programmable Gate Array) or ASIC (Application-Specific Integrated Circuit). In general, the FWAM 151 modem and the BBC 150 controller, and more generally the RGW 110 residential gateway, include electronic circuitry adapted and configured to implement the steps and behaviors described herein.

[0041] Fig. 4 schematically illustrates logical communication paths in the communication system.

[0042] By way of illustration, the MNET 120 mobile network complies with 5G mobile telephony standards.

[0043] The MNET 120 mobile network comprises, in addition to a radio access network part RAN (“Radio Access Network”), and a core network part which includes various equipment and / or functions including an SMF (“Session Management Function”) entity 410, an AMF (“Access and Mobility management Function”) entity 420 and a UPF (“User plane Function”) entity 430.

[0044] As its name indicates, the UPF entity manages the user plane, also called the data plane, i.e., the transport of user traffic. A user plane link thus connects the RGW 110 residential gateway and the UPF 430 entity. This user plane link is supported by an interface typically denoted NG-u between the radio access network part and the core network part.

[0045] Thus, with regard to the residential gateway RGW 110, the exchanges carried out between the residential gateway RGW 110 and the broadband network BBNET 130 pass through the UPF 430 entity in the mobile network MNET 120. In other words, the exchanges via the mobile network MNET 120 which involve the BBC controller 150 pass through user plane link with the UPF 430 entity, including authentication exchanges of the residential gateway RGW 110 with an ACS (Auto Configuration Server) 450 of the broadband network BBNET 130. To exchange with the ACS 450, the BBC controller 150 typically implements a daemon according to the TR-069 protocol (CPE WAN Management Protocol, published by the Broadband Forum).

[0046] User data exchanges involving the FWAM 151 modem, such as SMS messaging exchanges (“Short Message Service” in English) are carried out via the user plane connection with the UPF 430 entity.

[0047] To enable the implementation of user plane links in the MNET 120 mobile network, the SMF 410 entity and the AMF 420 entity cooperate in the implementation of the control plane of the MNET 120 mobile network. A control plane link thus connects the residential gateway RGW 110 and the AMF 420 entity. This control plane link is supported by an interface typically denoted NG-c between the radio access network part and the core network part.

[0048] Thus, with regard to the residential gateway RGW 110, the signaling exchanges carried out between the residential gateway RGW 110 and the mobile network MNET 120 pass through the AMF 420 entity in the mobile network MNET 120. In other words, this control plane link is reserved for the FWAM 151 modem in the residential gateway RGW 110 and is not accessible by the BBC 150 controller.

[0049] It follows from the above that the FWAM 151 modem does not interact with the BBNET 130 broadband network and the BBC 150 controller does not interact with the MNET 120 mobile network. By way of illustrative example, this implies that an IP address (“Internet Protocol”) provisioning for the BBC 150 controller is carried out with a DHCP (“Dynamic Host Configuration Protocol”) server located in the BBNET 130 broadband network, and an IP address provisioning for the FWAM 151 modem is carried out with the SMF 410 entity located in the MNET 120 mobile network.

[0050] Figure 5 schematically illustrates an authentication algorithm implemented by the RGW 110 residential gateway in one embodiment. The authentication algorithm allows the RGW 110 residential gateway to decide whether or not to activate a service. In a preferred embodiment, the service is an access service to services offered by the BBNET 130 broadband network. More specifically, the service could be the establishment of a user plane link between the BBC 150 controller and the BBNET 130 broadband network. The service could also be the setup of the LAN or WLAN.

[0051] In a 501 state, the service is disabled. The communication link with the MNET 120 mobile network is operational, which implies that the aforementioned pre-authentication has been performed. Thus, the aforementioned user plane and control plane links have been established.

[0052] In a step 502, the RGW 110 residential gateway detects a need to activate the service. For example, the need to activate the service is detected when the RGW 110 residential gateway has completed an initialization phase at startup or after a restart.

[0053] In step 503, the residential gateway RGW 110 triggers a first at authentication with the BBNET 130 broadband network. The first authentication is for example a certificate-based authentication using a "handshake" type exchange protocol.

[0054] In step 504, the RGW 110 residential gateway verifies that the initial authentication was successful. If so, step 506 is performed; otherwise, the RGW 110 residential gateway enters an error state 505. For example, a light and / or sound signal is activated by the RGW 110 residential gateway.

[0055] In step 506, the residential gateway RGW 110 initiates a second authentication with the MNET 120 mobile network. The second authentication is performed via the user plane of the MNET 120 mobile network (i.e., the communication link between the residential gateway RGW 110 and the core network portion of the MNET 120 mobile network is operational). The second authentication is, for example, the transmission by the residential gateway RGW 110 of a predetermined string of characters associated with the residential gateway RGW 110, such as a secret known to both the residential gateway RGW 110 and the core network portion of the MNET 120 mobile network (see [Fig. 6]) or a secret known to both the residential gateway RGW 110 and the BBNET 130 broadband network (see [Fig. 7]).

[0056] It should be noted that the second authentication is different from the previously mentioned prior authentication, since said prior authentication makes it possible to make operational a communication link between the residential gateway RGW 110 and the mobile network MNET 120, whereas this communication link must be operational in order to perform the second authentication.

[0057] In step 507, the RGW 110 residential gateway verifies that the second authentication was successful. If so, step 508 is performed; otherwise, the RGW 110 residential gateway enters error state 505. For example, a light and / or sound signal is activated by the RGW 110 residential gateway.

[0058] In step 508, the RGW 110 residential gateway activates the service and transitions to state 509 where the service is activated. Thus, service activation was achieved automatically via two-factor authentication, without user intervention.

[0059] In a particular embodiment, the second authentication (with the MNET 120 mobile network) is ordered to the FWAM 151 modem by the BBC 150 controller.

[0060] The first authentication is shown above as being performed with the BBNET 130 broadband network and the second authentication as being performed with the MNET 120 mobile network. Alternatively, the first authentication is performed with the MNET 120 mobile network and the second authentication is performed with the BBNET 130 broadband network. The first and second authentications Alternatively, the operations can be carried out in parallel.

[0061] In a particular embodiment, the first and second authentications have a time limit and must be repeated once this time limit has expired. To monitor this aspect, in state 509, the BBC 150 controller triggers a timer of a duration equal to the aforementioned time limit. When the timer expires, the RGW 110 residential gateway returns to state 501, and the first and second authentications must be renewed.

[0062] Fig. 6 schematically illustrates exchanges occurring in the communication system within the framework of an authentication of the RGW 110 residential gateway, in one embodiment.

[0063] [Fig.6] shows first authentication exchanges 610 between the BBC 150 controller and equipment of the BBNET 130 broadband network (see for example [Fig.5], in particular step 503), typically the ACS 450 automatic configuration server. These exchanges pass through the user plane of the MNET 120 mobile network (operational communication link thanks to prior authentication).

[0064] When the first authentication has been successfully completed, the BBC controller 150 sends an instruction 620 to the FWAM modem 151 to initiate the second authentication. Second authentication exchanges 630 then take place between the FWAM modem 151 and a piece of equipment on the MNET mobile network 120 (see, for example, [Fig. 5], in particular step 506).

[0065] When the second authentication is successful, the FWAM 151 modem sends a corresponding 640 message to the BBC 150 controller, which can then activate the service (see [Fig. 5]). If the second authentication fails, the FWAM 151 modem informs the BBC 150 controller, which then decides not to activate the service (see [Fig. 5]).

[0066] Fig. 7 schematically illustrates exchanges occurring in the communication system within the framework of an authentication of the RGW 110 residential gateway, in another embodiment.

[0067] Fig. 7 also shows the first authentication exchanges 610, as well as the sending of the instruction 620 to trigger the second authentication and the second authentication exchanges 630.

[0068] [Fig. 7] differs from [Fig. 6] in that, within the framework of the 630 second authentication exchanges, the MNET 120 mobile network equipment exchanges information with equipment from the BBNET 130 broadband network, typically the ACS 450 auto-configuration server. The MNET 120 mobile network equipment then acts as an intermediary between the BBNET 130 broadband network and the FWA 151 modem (which is not configured to communicate with BBNET 130 broadband network equipment), and thus delegates the handling of the second authentication. BBNET 130 broadband network authentication.

[0069] When the second authentication is successful (here, at the discretion of the BBNET 130 broadband network equipment), the FWAM 151 modem sends a corresponding 640 message to the BBC 150 controller, which can then activate the service (see [Fig. 5]). If the second authentication fails (here, at the discretion of the BBNET 130 broadband network equipment), the FWAM 151 modem informs the BBC 150 controller, which then decides not to activate the service (see [Fig. 5]).

[0070] In a particular embodiment, the FWAM 151 modem initiates the second authentication by formatting a dedicated SMS message addressed to a dedicated telephone number. Preferably, this SMS message contains in its body a predetermined string of characters associated with the RGW 110 residential gateway, such as an identifier of the RGW 110 residential gateway. Thus, in addition to the source telephone number of the SMS message (linked to the SIM card or eSIM), this SMS message may contain a serial number, an IMEI (International Mobile Equipment Identity), or a unique key assigned to the RGW 110 residential gateway. This SMS message is sent by the RGW 110 residential gateway without interaction with the user, and since this SMS message is not intended to be read by the user, the residential gateway deletes it without storing it on the SIM card or in the memory of the FWAM 151 modem.This is referred to as a service SMS message or silent SMS message. The core network part of the MNET 120 mobile network, via an SMSC (Short Message Service Center) messaging center, receives this service SMS message and processes it, or exchanges it with equipment from the BBNET 130 broadband network, to perform the second authentication.

Claims

Claims

1. A method of activating service by a residential gateway (110), the residential gateway (110) comprising electronic circuitry implementing a modem (151) for connecting the residential gateway (110) to a mobile network (120) via which a broadband network (130) is accessible and a broadband controller (150) for connecting the residential gateway (110) to the broadband network (130), the method comprising a prior authentication of the residential gateway (110) with the mobile network (120) via a control plane, so as to make operational a communication link between the residential gateway (110) and the mobile network (120) via a user plane by which the residential gateway (110) communicates with the broadband network (130), characterized in that the method further comprises a first authentication (503) and a second authentication (506) among which: - an authentication,by the broadband controller (150), of the residential gateway (110) to the broadband network (130); and - an authentication, by the modem (151), of the residential gateway (110) to the mobile network (120) via the user plane of the mobile network (120), the residential gateway (110) activating the service when the first authentication (503) and the second authentication (506) have been successfully carried out.,

2. The method of claim 1, wherein the broadband controller (150) instructs the modem (151) to trigger authentication of the residential gateway (110) to the mobile network (120) via the user plane of the mobile network (120).

3. The method of claim 1 or 2, wherein the second authentication (506) is triggered after the first authentication (503) has been successfully completed.

4. A method according to any one of claims 1 to 3, wherein the service is a service for accessing services of the broadband network (130).

5. Method according to any one of claims 1 to 4, wherein the authentication, by the modem (151), of the residential gateway (110) with the mobile network (120) via the user plane of the mobile network (120) includes sending an SMS type message by the residential gateway (110).

6. The method of claim 5, wherein the SMS type message contains, in the body of said SMS message, a predetermined character string associated with the residential gateway (110).

7. A method according to any one of claims 1 to 6, wherein during authentication, by the modem, of the residential gateway to the mobile network via the user plane of the mobile network, the mobile network delegates said authentication to the broadband network.

8. A residential gateway (110) comprising electronic circuitry configured to implement a modem (151) for connecting the residential gateway (110) to a mobile network (120) via which a broadband network (130) is accessible and a broadband controller (150) for connecting the residential gateway (110) to the broadband network (130), the electronic circuitry being configured to perform a prior authentication of the residential gateway (110) with the mobile network (120) via a control plane, so as to operationalize a communication link between the residential gateway (110) and the mobile network (120) via a user plane by which the residential gateway (110) communicates with the broadband network (130), characterized in that the electronic circuitry is further configured to perform a first authentication (503) and a second authentication (506) among which: - an authentication,by the broadband controller (150), of the residential gateway (110) to the broadband network (130); and - an authentication, by the modem (151), of the residential gateway (110) to the mobile network (120) via the user plane of the mobile network (120), the electronic circuitry being configured to activate the service when the first authentication (503) and the second authentication (506) have been successfully carried out.,

9. A computer program product comprising program code instructions causing an implementation of the method according to any one of claims 1 to 6, when said instructions are executed by a processor.

10. An information storage medium storing program code instructions causing an implementation of the method according to any one of claims 1 to 6, when said instructions are read and executed by a processor.

Images