Management and enforcement of password policies based on regular expressions and device management capabilities

Abstract

To provide a device and method that control the creation of passwords to be used for protecting accesses to devices in a communication system.SOLUTION: A method uses configurable regular expressions through a device management data model, e.g., a Broadband Forum (BBF) data model such as a TR-98 data model, a TR-181 data model, or the like, as well as various combinations thereof, for controlling passwords created for customer devices of communication networks through a device management interface, e.g., a Web Graphical User Interface (WebGUI) or the like. The method enables service providers of the communication networks, e.g., Internet Service Providers (ISPs), Communication Service Providers (CSPs), or the like, as well as various combinations thereof, to support configuration and enforcement of password rules for the customer devices of the communication networks.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] Various exemplary embodiments relate generally to communication systems and, more particularly, but not exclusively, to controlling the creation of passwords used to secure access to devices within a communication system. [Background technology]

[0002] Various communication technologies may be used to support communication in various types of communication systems. Summary of the Invention

[0003] In at least some exemplary embodiments, an apparatus includes at least one processor and at least one memory including instructions that, when executed by the at least one processor, cause the apparatus to perform at least the steps of: receiving, by a customer device, a password policy including a set of password rules defined based on a respective set of regular expressions; receiving, by the customer device, a request to set a password for the customer device; and determining, by the customer device, whether to set a password for the customer device based on an evaluation of the password with the password policy. In at least some exemplary embodiments, the password policy is received from a service provider network that provides communications services to the customer device. In at least some exemplary embodiments, the password policy is received based on a device management protocol. In at least some exemplary embodiments, the device management protocol is based on TR-069 or TR-369. In at least some exemplary embodiments, the password policy is received from a device management element. In at least some exemplary embodiments, the device management element is an Auto-Configuration Server (ACS) or a User Services Platform (USP) element. In at least some exemplary embodiments, the password policy is represented using a device management data model. In at least some exemplary embodiments, the device management data model is a Broadband Forum data model. In at least some exemplary embodiments, the Broadband Forum data model is a TR-98 data model or a TR-181 data model. In at least some exemplary embodiments, the request to set a password on the customer device is received via a device management interface. In at least some exemplary embodiments, the device management interface is a customer facing device management interface. In at least some exemplary embodiments, the device management interface is a WebGUI interface. In at least some exemplary embodiments, the evaluation of the password with the password policy is based on a regular expression evaluation engine.In at least some exemplary embodiments, evaluating the password with the password policy includes evaluating the password with each of the regular expressions to determine whether the password satisfies each of the password rules of the password policy. In at least some exemplary embodiments, the instructions, when executed by the at least one processor, cause the apparatus to perform at least the steps of allowing the password to be set on the customer device based on a determination that the password satisfies the password policy. In at least some exemplary embodiments, the instructions, when executed by the at least one processor, cause the apparatus to perform at least the steps of preventing the password from being set on the customer device based on a determination that the password does not satisfy the password policy. In at least some exemplary embodiments, the customer device is a customer gateway device or a customer premises equipment device.

[0004] In at least some exemplary embodiments, a non-transitory computer readable medium stores computer program instructions that, when executed by the apparatus, cause the apparatus to perform at least the steps of: receiving, by a customer device, a password policy including a set of password rules defined based on a respective set of regular expressions; receiving, by the customer device, a request to set a password for the customer device; and determining, by the customer device, whether to set a password for the customer device based on an evaluation of the password with the password policy. In at least some exemplary embodiments, the password policy is received from a service provider network providing communications services to the customer device. In at least some exemplary embodiments, the password policy is received based on a device management protocol. In at least some exemplary embodiments, the device management protocol is based on TR-069 or TR-369. In at least some exemplary embodiments, the password policy is received from a device management element. In at least some exemplary embodiments, the device management element is an Auto-Configuration Server (ACS) or a User Services Platform (USP) element. In at least some exemplary embodiments, the password policy is represented using a device management data model. In at least some exemplary embodiments, the device management data model is a Broadband Forum data model. In at least some exemplary embodiments, the Broadband Forum data model is a TR-98 data model or a TR-181 data model. In at least some exemplary embodiments, the request to set a password on the customer device is received via a device management interface. In at least some exemplary embodiments, the device management interface is a customer facing device management interface. In at least some exemplary embodiments, the device management interface is a WebGUI interface. In at least some exemplary embodiments, the evaluation of the password with the password policy is based on a regular expression evaluation engine.In at least some exemplary embodiments, evaluating the password with the password policy includes evaluating the password with each of the regular expressions to determine whether the password satisfies each of the password rules of the password policy. In at least some exemplary embodiments, the computer program instructions, when executed by the apparatus, cause the apparatus to perform at least the steps of allowing the password to be set on the customer device based on a determination that the password satisfies the password policy. In at least some exemplary embodiments, the computer program instructions, when executed by the apparatus, cause the apparatus to perform at least the steps of preventing the password from being set on the customer device based on a determination that the password does not satisfy the password policy. In at least some exemplary embodiments, the customer device is a customer gateway device or a customer premises equipment device.

[0005] In at least some exemplary embodiments, the method includes receiving, by the customer device, a password policy including a set of password rules defined based on a respective set of regular expressions; receiving, by the customer device, a request to set a password on the customer device; and determining, by the customer device, whether to set a password on the customer device based on evaluating the password with the password policy. In at least some exemplary embodiments, the password policy is received from a service provider network providing communications services to the customer device. In at least some exemplary embodiments, the password policy is received based on a device management protocol. In at least some exemplary embodiments, the device management protocol is based on TR-069 or TR-369. In at least some exemplary embodiments, the password policy is received from a device management element. In at least some exemplary embodiments, the device management element is an Auto-Configuration Server (ACS) or a User Services Platform (USP) element. In at least some exemplary embodiments, the password policy is represented using a device management data model. In at least some exemplary embodiments, the device management data model is a Broadband Forum data model. In at least some exemplary embodiments, the Broadband Forum data model is a TR-98 data model or a TR-181 data model. In at least some exemplary embodiments, the request to set a password on the customer device is received via a device management interface. In at least some exemplary embodiments, the device management interface is a customer facing device management interface. In at least some exemplary embodiments, the device management interface is a WebGUI interface. In at least some exemplary embodiments, evaluation of the password with the password policy is based on a regular expression evaluation engine.In at least some exemplary embodiments, evaluating the password with the password policy includes evaluating the password with each of the regular expressions to determine if the password satisfies each of the password rules of the password policy. In at least some exemplary embodiments, the method includes allowing the password to be set on the customer device based on a determination that the password satisfies the password policy. In at least some exemplary embodiments, the method includes preventing the password from being set on the customer device based on a determination that the password does not satisfy the password policy. In at least some exemplary embodiments, the customer device is a customer gateway device or a customer premises equipment device.

[0006] In at least some exemplary embodiments, the apparatus includes means for receiving, by the customer device, a password policy including a set of password rules defined based on a respective set of regular expressions; means for receiving, by the customer device, a request to set a password on the customer device; and means for determining, by the customer device, whether to set a password on the customer device based on an evaluation of the password with the password policy. In at least some exemplary embodiments, the password policy is received from a service provider network providing communications services to the customer device. In at least some exemplary embodiments, the password policy is received based on a device management protocol. In at least some exemplary embodiments, the device management protocol is based on TR-069 or TR-369. In at least some exemplary embodiments, the password policy is received from a device management element. In at least some exemplary embodiments, the device management element is an Auto-Configuration Server (ACS) or a User Services Platform (USP) element. In at least some exemplary embodiments, the password policy is represented using a device management data model. In at least some exemplary embodiments, the device management data model is a Broadband Forum data model. In at least some exemplary embodiments, the Broadband Forum data model is a TR-98 data model or a TR-181 data model. In at least some exemplary embodiments, the request to set a password on the customer device is received via a device management interface. In at least some exemplary embodiments, the device management interface is a customer facing device management interface. In at least some exemplary embodiments, the device management interface is a WebGUI interface. In at least some exemplary embodiments, evaluation of the password with the password policy is based on a regular expression evaluation engine.In at least some exemplary embodiments, evaluating the password with the password policy includes evaluating the password with each of the regular expressions to determine whether the password satisfies each of the password rules of the password policy. In at least some exemplary embodiments, the apparatus includes means for allowing the password to be set on the customer device based on a determination that the password satisfies the password policy. In at least some exemplary embodiments, the apparatus includes means for preventing the password from being set on the customer device based on a determination that the password does not satisfy the password policy. In at least some exemplary embodiments, the customer device is a customer gateway device or a customer premises equipment device.

[0007] In at least some exemplary embodiments, an apparatus includes at least one processor and at least one memory including instructions that, when executed by the at least one processor, cause the apparatus to at least: receive, by a device management element, a password policy including a set of password rules represented using a device management data model and defined using a respective set of regular expressions, and transmit, by the device management element, the password policy to a customer device based on a device management protocol associated with the device management data model. In at least some exemplary embodiments, a non-transitory computer-readable medium stores computer program instructions that, when executed by the apparatus, cause the apparatus to at least: receive, by the device management element, a password policy including a set of password rules represented using the device management data model and defined using a respective set of regular expressions, and transmit, by the device management element, the password policy to a customer device based on a device management protocol associated with the device management data model. In at least some exemplary embodiments, the method includes receiving, by a device management element, a password policy represented using a device management data model and including a set of password rules defined using a respective set of regular expressions, and transmitting, by the device management element, the password policy toward the customer device based on a device management protocol associated with the device management data model. In at least some exemplary embodiments, the apparatus includes means for receiving, by the device management element, a password policy represented using the device management data model and including a set of password rules defined using a respective set of regular expressions, and means for transmitting, by the device management element, the password policy toward the customer device based on a device management protocol associated with the device management data model.

[0008] The teachings herein can be readily understood by considering the following detailed description in conjunction with the accompanying drawings. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 illustrates an example embodiment of a communication system configured to support management and enforcement of password policies for controlling passwords for customer devices based on the use of regular expressions and device management capabilities. [Diagram 2] FIG. 1 illustrates an example embodiment of modeling password policies using a data model to support management and enforcement of password policies for use in controlling passwords for customer devices. [Diagram 3] FIG. 1 illustrates an example embodiment of a method for use by a device management element of a service provider network that supports password policy management and enforcement to control passwords for customer devices based on the use of regular expressions and device management capabilities. [Figure 4] FIG. 1 illustrates an example embodiment of a method for use by customer devices of a customer network that supports password policy management and enforcement for controlling passwords on customer devices based on the use of regular expressions and device management capabilities. [Diagram 5] FIG. 1 illustrates an exemplary embodiment of a computer suitable for use in performing various functions presented herein.

[0010] For ease of understanding, the same reference numbers have been used herein, wherever possible, to designate identical elements that are common to the various figures. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Various exemplary embodiments for supporting security for a communications network are presented herein. Security for a communications network may be provided by protecting access to customer devices associated with the communications network. Protecting access to customer devices associated with the communications network may control access to the customer devices based on the use of passwords created by the customer for the customer devices. Protecting access to customer devices based on the use of passwords created by the customer for the customer devices may be provided by supporting management and enforcement of password policies that control the creation of passwords for customer devices by customers. Protecting access to customer devices based on the use of passwords created by the customer for the customer devices may be provided by enabling a service provider of a communications network that provides communications services to the customer devices to support management and enforcement of password policies that control the creation of passwords for customer devices by customers. Support for management and enforcement of password policies that control the creation of passwords for customer devices by customers may be based on the use of regular expressions that define password policies and may be based on the use of device management capabilities that manage password policies (e.g., based on the use of a device management data model that represents password policies and based on the use of a device management protocol that configures password policies on customer devices). Support for management and enforcement of password policies that control the creation of passwords by customers for customer devices can be configured to support management and enforcement of password policies independent of the customer device management interface used by the customer to create passwords for the customer device.It will be appreciated that these and various other exemplary embodiments supporting management and enforcement of password policies that control passwords created by customers for customer devices, as well as advantages or potential advantages of supporting management and enforcement of password policies that control passwords created by customers for customer devices, may be further understood by considering various aspects of such exemplary embodiments within particular contexts (e.g., providing security for a particular type of communications network, using particular device management capabilities such as a particular device management data model and a particular device management protocol, using particular customer device management interfaces, etc., as well as various combinations thereof), as discussed further below.

[0012] Various exemplary embodiments may be configured to support management and enforcement of password policies by a service provider of a communications network (e.g., an Internet Service Provider (ISP), a Communications Service Provider (CSP), etc., and various combinations thereof) to customer devices of the communications network (e.g., customer devices such as customer gateways and customer premises equipment (CPE)) to control passwords created by customers of the communications network for their customer devices via a customer device management interface (e.g., a Web Graphical User Interface (WebGUI) interface or other suitable device management interface) using password policies defined based on regular expressions and managed using device management capabilities (including representation of password policies based on device management data models (e.g., Broadband Forum (BBF) data models such as the TR-98 data model, the TR-181 data model, etc., and various combinations thereof) and configuration of password policies on customer devices using device management protocols (e.g., TR-069, TR-369, etc., and various combinations thereof). It will be appreciated that these and various other exemplary embodiments supporting management and enforcement of password policies used to control password creation for customer devices of a communications network may provide for improved management and enforcement of such password policies used to control password creation for customer devices of a communications network, thereby providing improved control over password creation for customer devices of a communications network, and thus improved security for such communications networks.It will be appreciated that these and various other exemplary embodiments for supporting management and enforcement of password policies used to control password creation for customer devices of a communications network, as well as advantages or potential advantages of supporting management and enforcement of password rules used to control password creation for customer devices of a communications network, may be further understood by considering various aspects of such exemplary embodiments within particular contexts (e.g., providing security for a particular type of communications network, using a particular type of password policy definition capability, using particular device management capabilities (e.g., a particular device management data model and / or a particular device management protocol), using particular customer device management interfaces, etc., as well as various combinations thereof), as discussed further below.

[0013] Based on the use of password policy definition capabilities and device management capabilities, various exemplary embodiments supporting management and enforcement of password policies for customer devices may be configured to provide security for various types of communication networks. For example, various exemplary embodiments supporting management and enforcement of password policies for customer devices based on the use of password policy definition and device management capabilities may be used to provide security for customer devices of a customer network, where the customer devices of the customer network include a customer gateway and a CPE served by the customer gateway. The customer gateway provides the customer with several capabilities (e.g., features, settings, etc., as well as various combinations thereof) that can be used to manage the customer network, including network configuration, security settings, and device management for the customer gateway and the CPE served by the customer gateway. One important aspect of security is to enforce a strong password policy to protect against unauthorized access to the customer gateway and the CPE served by the customer gateway. A password policy typically includes password rules, which are a set of criteria and constraints imposed on a user when creating a password for a device (e.g., during initial password creation or during an update of an existing password based on the creation of a new password). Password rules help ensure that passwords are sufficiently secure, making them more difficult to guess or crack, thus providing enhanced security for devices on which the password is set. For example, common password rules include requirements for a minimum password length, requirements for the types and quantities of characters used in the password (e.g., the use of a combination of letters, numbers, and special characters), restrictions on common or easily guessable passwords or portions of passwords, etc., as well as various combinations thereof.It will be appreciated that, based on the use of password policy definition capabilities and device management capabilities, various exemplary embodiments that support management and enforcement of password policies for customer devices may be configured to provide security for various other types of communications networks.

[0014] Based on the use of password policy definition capabilities and device management capabilities, various exemplary embodiments supporting management and enforcement of password policies for customer devices may be configured to support management and enforcement of password policies for customer devices using a particular password policy definition capability in combination with various device management capabilities (e.g., device management data models and / or device management protocols). For example, the password policy definition capabilities may be used in using regular expressions to define password rules for a password policy. Regular expressions are pattern matching mechanisms used in computer science and programming to define and validate complex text patterns. By leveraging configurable regular expressions, service provider administrators gain greater control over password rules in accordance with service provider security policies that specify password requirements such as password length requirements, password character set requirements (e.g., quantity and type of characters, such as letters, numbers, and / or special characters), password complexity requirements, and various combinations thereof. The device management capabilities, including the device management data model and device management protocols, provide a framework for service providers to manage and enforce password policies, including password rules defined based on configurable regular expressions. The password policy definition capabilities and device management capabilities enable relatively simple configuration and provisioning of a service provider's password policies on customer devices for use in controlling the creation of passwords on customer devices, thereby supporting more robust and efficient definition and application of the service provider's password policies for use in controlling the creation of passwords on customer devices. It will be appreciated that based on the use of password policy definition capabilities and device management capabilities, various exemplary embodiments for supporting management and enforcement of password policies for customer devices can be configured to support management and enforcement of password policies for customer devices using various other password policy definition capabilities in combination with various device management capabilities.

[0015] Based on the use of password policy definition capabilities and device management capabilities, various exemplary embodiments for supporting management and enforcement of password policies for customer devices may be configured to support management and enforcement of password policies for customer devices using various password policy definition capabilities (e.g., configurable regular expressions) in combination with specific device management capabilities (e.g., device management data models and / or device management protocols based on BBF technical specifications or other suitable specifications). BBF has developed several technical specifications that define device management data models representing data used for management of customer devices in a customer network and define device management protocols for management of customer devices in a customer network. For example, TR-98 and TR-181 are two technical specifications developed by BBF that define device management data models for management of residential gateways and associated CPE devices. These BBF technical specifications, and the data models defined therein, may be extended to enable service providers to define password policies based on their security requirements without requiring any support from customer device vendors. For example, a password policy data model may be defined within the data model tree of a BBF device management data model (e.g., TR-98 or TR-181) to provide a mechanism by which a service provider can define password policies based on security requirements. For example, TR-069 and TR-369 are two technical specifications developed by BBF that define device management protocols for management of residential gateways and associated CPE devices. These BBF technical specifications, and the data management protocols defined therein, may be used to support configuration of service provider password policies for customer devices for use in evaluating passwords created on customer devices in a customer network.It will be appreciated that various example embodiments that support management and enforcement of password policies for customer devices based on the use of password policy definition capabilities and device management capabilities may be configured to support management and enforcement of password policies for customer devices using various other device management capabilities (e.g., device management data models and / or device management protocols based on the BBF technical specification or other suitable technical specifications).

[0016] Based on the use of password policy definition capabilities and device management capabilities, various exemplary embodiments supporting management and enforcement of password policies for customer devices may be configured to support management and enforcement of password policies for customer devices where passwords are created by a customer using a specific device management interface (i.e., using a WebGUI). A WebGUI is an interface system that allows a user to interact with a device or application via a web browser and is used in various contexts, including within the context of a customer network to allow a user to interact with customer devices in the customer network (e.g., a customer gateway, CPE, etc.). In many WebGUI implementations for CPEs, password rules are predefined and cannot be customized by the service provider. These password rules are often based on standard security best practices and aim to strike a balance between security and usability. However, the password rules may not necessarily align with the service provider's specific security requirements or preferences, thereby requiring the service provider to require the CPE vendor to release firmware that supports the service provider's desired password policies. Some CPE vendors work with multiple service providers, each with their own password policy for creating passwords on customer devices supported by the service provider, thereby resulting in multiple requests by the service providers to the CPE vendor to enable the CPE vendor to support the service provider's customized password policies. To accommodate these various password policy customizations, the CPE vendor pre-releases customized CPE firmware to each of the service providers to support the service provider's customized password policies (consuming significant research and development (R&D) resources of the CPE vendor, as well as consuming operational efforts by the CPE vendor, thereby placing a significant burden on the CPE vendor).It will be appreciated that various exemplary embodiments for enabling service providers to support the management and enforcement of password rules can alleviate this burden on CPE vendors, thereby leading to improved operational efficiency and increased profitability for CPE vendors. Based on the use of password policy definition capabilities and device management capabilities, it will be appreciated that various exemplary embodiments for supporting the management and enforcement of password policies for customer devices can be configured to support the management and enforcement of password policies for customer devices where passwords are created by the customer using a variety of other device management interfaces.

[0017] Various exemplary embodiments may be configured to enable a service provider of a communications network supporting a customer's customer network to support management and enforcement of password policies for customer devices of the customer network to control passwords created by the customers for customer devices of the customer network, such that various benefits may be provided to the service provider, the customer of the customer network, and the customer device vendor of the customer device. For example, by enabling the service provider to enforce the use of stricter password policies on customers during password creation, various exemplary embodiments for managing and enforcing service provider password policies that control the creation of passwords by customers for customer devices may increase the security of the service provider communications network and the customer network (e.g., the use of stricter password policies ensures the creation of stronger passwords that make it less likely that the customer devices of the customer network will be compromised, and therefore less likely that the service provider communications network will be compromised). For example, various exemplary embodiments for managing and enforcing service provider password policies that control the creation of passwords by customers for customer devices may improve the operational efficiency of service providers and customer device vendors by enabling service providers to efficiently and dynamically manage and enforce stricter password policies while enhancing the security of the service provider communication network and customer networks, and without involving the customer device vendors in this process (e.g., without requiring the service provider to involve each of the customer device vendors to request that the customer device vendor perform a firmware upgrade on the customer device to support the customized service provider password policy, and similarly without requiring the customer device vendor to develop and release customized customer device firmware to the service provider to support the customized service provider password policy).It will be appreciated that various exemplary embodiments that enable a service provider of a communications network supporting a customer's customer network to support management and enforcement of password policies for customer devices of the customer network and control passwords created by customers for customer devices of the customer network may provide various other benefits to the service provider, the customer of the customer network, and / or the customer device vendor of the customer device.

[0018] It will be appreciated that these and various other exemplary embodiments supporting management and enforcement of password policies to control the creation of passwords for customer devices of a communications network, as well as the advantages or potential advantages of supporting management and enforcement of password policies to control the creation of passwords for customer devices of a communications network, may be further understood by considering various aspects of such exemplary embodiments within the context of the exemplary communications system illustrated in FIG.

[0019] FIG. 1 illustrates an example embodiment of a communications system configured to support management and enforcement of password policies for controlling passwords for customer devices based on the use of regular expressions and device management capabilities.

[0020] The communication system 100 includes a customer network 110 and a service provider network 120. The customer network 110 is a customer network that is a customer of a service provider that operates the service provider network 120. The customer network 110 supports the customer's communications and enables various customer devices of the customer to access the Internet via the service provider network 120. The service provider network 120 supports the customer network 110's communications, including downstream communications to the customer network 110 and upstream communications from the customer network 110. The service provider network 120 may support the customer network 110's communications based on various access technologies (e.g., wireless, fiber optic, cable, digital subscriber line, etc., as well as various combinations thereof), various core communication technologies, etc. The service provider network 120 also supports the management of the customer network 110 to support communication services for the customer network 110. As discussed further below, the communication system 100 is configured to support the management and enforcement of password rules implemented by the service provider of the service provider network 120 for passwords created by the customers of the customer network 110 for the customer devices of the customer network 110.

[0021] The customer network 110, as described above, is a network of a customer of a service provider of the service provider network 120. The customer network 110 may be associated with a residential location, a business location, an enterprise location, and the like. The customer network 110 includes a customer gateway 111 and a set of customer premises equipment (CPE) 115-1 through 115-N (collectively, CPEs 115). The customer gateway 111 is configured to operate as a gateway of the customer network 110 for the CPEs 115 and supports communications between the CPEs 115 and the service provider network 120. For example, the customer gateway 111 may be a residential gateway, where the customer network 110 is a residential network, the customer gateway 111 may be a business gateway, where the customer network 110 is a business network, and the like. The CPEs 115 may be any end device of the customer that may be deployed as part of the customer network 110 and may communicate via the customer gateway 111. For example, CPE 115 may be computers (e.g., desktops, laptops, tablets, etc.), set-top boxes, smart televisions, smart appliances, Internet of Things (IoT) devices, etc., as well as various combinations thereof. As shown in Figure 1, customer network 110 is configured to support management and evaluation of password rules implemented by a service provider of service provider network 120 on a customer of customer network 110. It will be appreciated that customer network 110 may include various other devices, elements, functions, etc.

[0022] The service provider network 120 is a network of a service provider that provides communication services to the customer network 110, as described above. The service provider network 120 may be associated with various types of service providers that may support the customer network 110, such as an ISP, a CSP, etc. The service provider network 120 includes a support system 121, an administrator system 125, and a device management element 129. The support system 121 is configured to support management of the customer network 110, including supporting configuration of the customer network 110, monitoring of the customer network 110, etc., as well as various combinations thereof. For example, the support system 121 may include a business support system, an operation support system, etc., as well as various combinations thereof. The administrator system 125 is configured to support interaction of the support system 121 and the device management element 129 by a service provider administrator, thereby enabling the service provider administrator to perform various management operations to support management of the customer network 110. The device management element 129 is configured to support management of customer devices (including the customer gateway 111 and the CPEs 115) of the customer network 110 using information available from the support systems 121 to support various management tasks (e.g., device configuration, firmware updates, security control, etc.). The device management element 129 is configured to support management of devices of the customer network 110 using information available from the support systems 121 based on device management capabilities including a device management data model (e.g., a BBF data model such as TR-98, TR1-181, or other suitable device management data model configured to support device management by a service provider for the customer network 110) and a device management protocol (e.g., a BBF protocol such as TR-069, TR-369, or other suitable device management protocol configured to support device management by a service provider for the customer network 110).It will be appreciated that the service provider network 120 may include various other systems, elements, functions, and the like.

[0023] The communication system 100 is configured to support management and enforcement of password policies using configurable regular expressions and BBF-based data management capabilities to enable a service provider of the service provider network 120 to control the setting of passwords for customer devices of the customer network 110. The password policies are configured by the service provider of the service provider network 120 to ensure that passwords set by the customers of the customer network 110 for customer devices of the customer network 110 meet the password requirements of the service provider of the service provider network 120. The password policies are configured by the service provider of the service provider network 120 to define the password policies (e.g., defining the password rules that constitute the password policies) using regular expressions and to represent the password policies (e.g., representing the regular expressions that define the password rules of the password policies as string objects in the BBF device management data model) using a BBF device management data model (e.g., TR-98, TR-181, etc.). Password policies configured by a service provider of service provider network 120 are maintained on service provider network 120 using the BBF device management data model and provided from service provider network 120 into customer network 110 (e.g., on customer gateway 111) using a BBF device management protocol (e.g., TR-069 via an Auto-Configuration Server (ACS), TR-369 via a User Services Platform (USP) element, etc.). Password policies provided by service provider network 120 on customer network 110 are used in customer network 110 to evaluate passwords specified by customers of customer network 110 for customer devices of customer network 110 via device management interfaces (e.g., WebGUIs, etc.) supported by customer devices of the customer network.In this manner, the service provider of service provider network 120 can enforce its password policies on customer devices of customer network 110 in a manner that ensures that passwords set by customers of customer network 110 meet the password requirements of the service provider of service provider network 120. It will be appreciated that various aspects of such password control by the service provider of service provider network 120 over passwords created by customers of customer network 110 may be further understood by considering certain elements of communication system 100 configured to support password policy management and enforcement using configurable regular expression and BBF-based data management capabilities.

[0024] The communication system 100 is configured to support password policy management using configurable regular expressions and BBF-based data management capabilities to enable a service provider of the service provider network 120 to control the setting of passwords for customer devices of the customer network 110. The service provider network 120 is configured to support password policy management using configurable regular expressions and BBF-based data management capabilities. The support system 121 of the service provider network 120 includes a password policy system 122. The password policy system 122 is configured to support a service provider password policy 124. The service provider password policy 124 is configured for use to determine whether a password meets a set of service provider password requirements. The service provider password policy 124 may be comprised of a set of password rules that may be evaluated to determine whether a password meets the password policy 124. The service provider password policies 124 may be configured on the password policy system 122 by one or more service provider administrators via an administrator system 125 (e.g., defining password rules to be included in the password policy 124, defining configurable regular expressions that specify the password rules to be included in the password policy 124, expressing the password policy 124 within the context of a BBF-based device management data model, etc.). The service provider password policies 124 may be maintained by the password policy system 122 to make the password policies 124 available for use in configuring the customer network 110 to apply the password policies 124 within the context of password creation within the customer network 110. The service provider password policies 124 may be provided on the customer network 110 by the device management element 129 based on interactions with the password policy system 122 by the device management element 129.The customer network 110 is configured to support management of the service provider's password policy 124 based on support for configuration of the service provider's password policy 124 on the customer network 110 for use within the customer network 110 to evaluate passwords created by customers for customer devices on the customer network 110.

[0025] Password policy 124 specifies a set of service provider password requirements to be imposed on customers of customer network 110 when creating passwords for customer devices of customer network 110 (e.g., during initial password creation or updating an existing password based on the creation of a new password). The password requirements of password policy 124 may include various criteria and constraints to be imposed on customers of customer network 110 when creating passwords for customer devices of customer network 110. Password policy 124 may be defined with a set of password rules that may specify the password requirements (e.g., each of the password rules for which password policy 124 is configured may specify one or more criteria and / or constraints that must be satisfied by a password in order for the password to be accepted). Password policy 124 helps ensure that passwords created for customer devices of customer network 110 are sufficiently secure, making it more difficult to guess or crack the passwords, thus providing increased security to customer devices of customer network 110 and service provider network 120 communicatively connected thereto.

[0026] The password rules of the service provider password policy 124 may include various types of password rules that may be implemented for password creation. For example, the password rules may include a requirement for a minimum password length (e.g., at least 8 characters, at least 10 characters, etc.). For example, the password rules may include requirements for the type and quantity of characters used in the password (e.g., the use of a combination of letters, numbers, and special characters). For example, the password rules may include a rule that a password must include at least one lowercase letter, at least one uppercase letter, at least one number, and at least one special character. For example, the password rules may include a rule that a password must include at least one lowercase letter, at least one uppercase letter, at least one number, and at least one special character. For example, the password rules may include rules that specify restrictions on the use of common or easily guessable passwords or portions of passwords (e.g., excluding passwords that include the word "password", excluding passwords with repeating characters or well-known sequences of characters (e.g., "12345", "abcde", etc.), etc.). It will be appreciated that the password rules of the password policy 124 defined on the password policy system 122 may include various other types of password rules that may be implemented for password creation.

[0027] The password rules of the password policy 124 may be defined by the service provider using regular expressions. A regular expression is a pattern matching mechanism used in computer science and programming to define and validate complex text patterns. Administrators of the service provider network 120 may leverage configurable regular expressions to gain greater control over the service provider's password rules by defining configurable regular expressions that specify the password rules. For example, Table 1 below provides an example set of password rules and corresponding regular expressions that may be defined to specify password rules that may be used as the password policy 124. It will be understood that the password rules specified in Table 1 are only one example of a set of password rules that may be used as the password policy 124 (e.g., fewer or more password rules may be included in the password policy 124, different definitions of these password rules may be included in the password policy 124, different types of password rules may be included in the password policy 124, and various combinations thereof). [Table 1]

[0028] The password rules of the password policy 124 are defined using regular expressions as shown above and in Table 1 (illustratively, each password rule is defined using a regular expression). For example, a password rule that requires a password to have eight or more characters may be defined using a regular expression of "^.{8,}$". For example, a password rule that requires a password to have at least one upper case letter, one lower case letter, and one number may be defined using a regular expression of "^(?=.*[az])(?=.*[AZ])(?=.*\d).+$". For example, a password rule that requires a password to have at least one upper case letter, one lower case letter, one number, and one special character may be defined using a regular expression of "^(?=.*[az])(?=.*[AZ])(?=.*\d)(?=.*[!@#$%^&*()]).+$". For example, a password rule requiring passwords to exclude the word "password" may be defined using the regular expression "^(?!.*password).+$". For example, a password rule requiring passwords to exclude passwords with repeated characters may be defined using the regular expression "^(?!.*(.)\1).+$". As mentioned above, it will be appreciated that various other password rules or combinations of password rules may be specified as part of the password policies 124 maintained on the password policy system 122.

[0029] The password policies 124 may be represented by the service provider using a device management data model. The device management data model may serve as a framework for the service provider to configure and enforce the password policies 124, including storing and managing configurable regular expressions used to define the password policies 124, and further supporting relatively simple configuration and modification of the password rules of the password policies 124 to control the creation of passwords for customer devices of the customer network 110 (including customization of the password rules of the password policies 124 based on configurable regular expressions without requiring modifications to customer device firmware of the customer devices of the customer network 110). The device management data model used to represent the password policies 124 may be a standardized (vendor-independent) device management data model (e.g., a BBF-based device management data model such as TR-98, TR-181, etc.) or a vendor-specific data model. For example, the device management data model used to represent password policy 124 may be a BBF-based device management data model (e.g., TR-98, TR-181, etc.) configured to support remote management of customer devices, such as broadband gateways and CPEs, serviced by a broadband gateway, such as a residential gateway.

[0030] Password policy 124 may be represented using a device management data model, as described above. The representation of password policy 124 in the device management data model may be based on a representation of each password rule with, for each of the password rules of the password policy, a respective string object representing a respective regular expression that defines that password rule, and thus password policy 124 may be composed of an array of regular expressions (modeled as strings) of password rules of password policy 124. The representation of password policy 124 in the device management data model may be based on the use of a password policy data model configured to support the representation or modeling of password policies including password rules defined using regular expressions. The password policy data model may be added to an existing device management data model (e.g., a standardized password policy data model added to a standardized device management data model, or a vendor-specific password policy data model added to a vendor-specific data model) by extending the existing device management data model to support the password policy data model.

[0031] Password policy 124 may be represented using a password policy data model in the device management data model, as described above. The password policy data model is configured to support the representation or modeling of password policies, including password rules defined using regular expressions. The representation of password policy 124 in the password policy data model may be based on a representation of each password rule with, for each of the password rules of the password policy, a respective string object representing the respective regular expression that defines that password rule; thus, password policy 124 may be composed of an array of regular expressions (modeled as strings) of the password rules of password policy 124. The password policy data model may be specified using a path, which may be defined based on whether the password policy data model is a BBF-based device management data model (e.g., in this case the path may be specified as Device.Users.CredentialPolicies.{i}, or using any other suitable path), or a vendor-specific data model (e.g., in this case the path may be specified as Device.Users.X_VENDOR1-COM_WebGUIPasswordPolicy, and the password rules data model is specific to a vendor known as VENDOR1, or using any other suitable path). Although presented primarily with respect to the use of a single password policy data model to support the expression of password policies including password rules defined using regular expressions, it will be understood that in at least some example embodiments, multiple password policy data models may be designed and deployed to support the expression of password policies including password rules defined using regular expressions.

[0032] The password policy 124 can be represented using a password policy data model that forms part of a device management data model, such as a standardized device management data model (e.g., a BBF-based device management data model such as TR-98, TR-181, etc.) or a vendor-specific data model, as described above. An exemplary embodiment for the representation of the password policy 124 (defined to include the set of password rules specified in Table 1) based on an extension of the BBF-based device management data model to include the password policy data model is presented in FIG. 2. As shown in FIG. 2, the password policy data model 200 includes a device top-level object, a number of entries object indicating the number of entries, a password policy object, and a string that specifies the set of password rules defined using a set of regular expressions (illustratively, in the example of FIG. 2, including the password rules defined in Table 1 and associated regular expressions). It will be understood that the representation of the password policy 124 in the device policy data model portion of the standardized device management data model can be provided in a variety of other ways. It will be understood that the representation of the password policy 124 using a vendor-specific device management data model can be implemented in a variety of ways that may vary across different vendors.

[0033] Service provider password policies 124, defined using regular expressions to specify password rules and represented using the BBF device management data model, are provided from service provider network 120 to customer network 110 based on BBF-based device management capabilities. Device management element 129 automatically accesses service provider password policies 124 from password policy system 122 and automatically provides service provider password policies 124 to customer network 110 based on such BBF-based device management capabilities. The device management element 129 may automatically access the password policies 124 from the password policy system 122 and provide the password policies 124 within the customer network 110 by enabling the device management element 129 to seamlessly access the password policies 124 from the password policy system 122 using a standardized data structure based on the representation of the password policies 124 using a BBF device management data model (e.g., TR-98, TR-181, etc.) and the propagation of the password policies 124 using a BBF device management protocol (e.g., TR-069, TR-369, etc.) and efficiently communicate the password policies 124 from the password policy system 122 to the customer network 110 by interacting with the BBF device management data model within the context of the BBF device management protocol. In the example of FIG. 1, it will be appreciated that the device management element 129 of the service provider network 120 automatically provides the service provider's password policies 124 to the customer gateway 111 of the customer network 110. However, it will be appreciated that the device management element 129 of the service provider network 120 may also, or alternatively, automatically provision the service provider's password policy 124 on one or more CPEs 115 of the customer network 110 .In this manner, the service provider's password policy 124 is configured within the customer network 110 for use within the customer network 110 to evaluate passwords specified by customers of the customer network 110 for customer devices of the customer network 110.

[0034] A service provider password policy 124, defined using regular expressions and represented using the BBF device management data model to specify password rules, is received at customer network 110 from service provider network 120. As discussed above, in the example of Figure 1, service provider password policy 124 is automatically provisioned on customer gateway 111 of customer network 110 by device management element 129 of service provider network 120. As described above, the provision of the service provider's password policies 124 to the customer gateway 111 of the customer network 110 is based on expressing the password policies 124 using a BBF device management data model (e.g., TR-98, TR-181, etc.) and propagating the password policies 124 using a BBF device management protocol (e.g., TR-069, TR-369, etc.), which allows the device management element 129 to seamlessly access the password policies 124 from the password policy system 122 using standardized data structures and efficiently communicate the password policies 124 from the password policy system 122 to the customer network 110 by interacting with the BBF device management data model within the context of the BBF device management protocol. The customer gateway 111 of the customer network 110 receives the password policies 124 and stores the password policies 124 for use in evaluating passwords specified by customers of the customer network 110 for customer devices of the customer network 110. In this manner, the service provider's password policy 124 is configured to evaluate passwords specified by customers of the customer network 110 for customer devices of the customer network 110 within the customer network 110 for use within the customer network 110.

[0035] The communication system 100 is configured to support password policy enforcement to allow a service provider of the service provider network 120 to control the setting of passwords for customer devices of the customer network 110 using configurable regular expressions and data management capabilities based on the BBF technical specifications. The communication system 100 is configured to support password policy enforcement for passwords entered by customers of the customer network 110 for customer devices of the customer network 110 based on evaluation of the passwords entered by the customers of the customer network 110 for customer devices of the customer network 110 using a service provider password policy 124 configured in the customer network 110 by the service provider network 120. The customer network 110 is configured to support evaluation of passwords entered by customers of the customer network 110 for customer devices of the customer network 110 using the service provider password policy 124 by supporting configuration of the customer gateway 111 to evaluate passwords entered by customers of the customer network 110 for customer devices of the customer network 110 using the service provider password policy 124. For clarity in describing various exemplary embodiments that support evaluation of passwords based on a service provider's password policy 124, it should be noted that the following description assumes that a customer is attempting to create a password for a customer gateway 111 of a customer network 110 (as opposed to one or more CPEs 115 of the customer network 110).

[0036] The customer gateway 111 of the customer network 110 is configured to support enforcement of the service provider's password policy 124 for creation of passwords for the customer gateway 111. The customer gateway 111 of the customer network 110 includes a device management element 112, a device management interface 112, and a password evaluation element 114. The device management element 112 is configured to support configuration of the service provider's password policy 124 by the device management element 129 of the service provider network 120 to the customer gateway 111 (e.g., based on use of device management capabilities including a device management data model and a device management protocol) for use in evaluating passwords entered by customers of the customer network 110 for the customer gateway 111 of the customer network 110. For example, the device management element 112 may be based on various BBF technical specifications for device management. The device management interface 113 is configured to support web-based access by a customer of the customer network 110 to the customer gateway 111 of the customer network 110 to enable the customer to interact with the customer device of the customer network 110 (e.g., create a password for the customer device of the customer network 110). For example, the device management interface 113 may be a WebGUI interface or other suitable type of customer-facing device management interface. The password evaluation component 114 is configured to evaluate a password created by a customer for the customer gateway 111 via the device management interface 113 based on a service provider password policy 124 set in the customer gateway 111 by the service provider network 120 via the device management interface 112 prior to setting a password for the customer gateway 111.

[0037] The customer gateway 111 receives the service provider password policy 124 from the service provider network 120. The customer gateway 111 receives the service provider network 120 password policy from the device management element 129 of the service provider network 120 via the device management element 112 of the customer gateway 111. The customer gateway 111 stores the service provider password policy 124 on the password evaluation element 114 of the customer gateway 111 for use by the password evaluation element 114 of the customer gateway 111 to evaluate passwords created by customers for the customer gateway 111 using the device management interface 113 of the customer gateway 111. Although presented primarily with respect to storage of the service provider password policy 124 on the password evaluation element 114 of the customer gateway 111, it will be understood that the service provider password policy 124 may be maintained on the customer gateway 111 in a variety of other ways while still being accessed by the password evaluation element 114 of the customer gateway 111 to evaluate passwords created by customers for the customer gateway 111 using the device management interface 113 of the customer gateway 111.

[0038] The customer gateway 111 receives a customer-created password for the customer gateway 111 via the device management interface 113. A customer of the customer network 110 accesses the device management interface 113 of the customer gateway 111 to perform various management functions for the customer devices of the customer network 110 (e.g., the customer gateway 111 and / or one or more CPEs 115). A customer of the customer network 110 may access the device management interface 113 of the customer gateway 111 from any suitable web browser or other suitable interface that may be supported by any suitable end user device of the customer (e.g., one of the CPEs 115, one or more other end user devices of the customer that are not considered part of the customer network 110, etc.). A customer of the customer network 110 can access the device management interface 113 of the customer gateway 111 to initiate creation of a password for one of the customer devices of the customer network 110, where creation of a password for one of the customer devices of the customer network 110 can be creation of an initial password for one of the customer devices of the customer network 110 or creation of a new password to replace an existing password for one of the customer devices of the customer network 110. A customer of the customer network 110 can initiate creation of a password for a customer device of the customer network 110 by providing a password to be used so that the customer gateway 111 receives a password setting request including a password for the customer device of the customer network 110 and then the password can be evaluated by the password evaluation element 114 of the customer gateway 111.

[0039] The customer gateway 111 evaluates a password created by a customer for the customer gateway 111 via the device management interface 113 based on a service provider password policy 124 configured on the customer gateway 111 by the service provider network 120 before setting a password for the customer gateway 111. The password evaluation element 114 of the customer gateway 111 evaluates the password using the password policy 124 configured on the password evaluation element 114 by the service provider network 120. The customer gateway 111 evaluates the password specified by the customer for the customer gateway 111 based on the password policy 124 by evaluating the password against each of the password rules specified in the password policy 124 (which, as shown herein, are defined using regular expressions). The password evaluation element 114 can evaluate the password using the password rules defined using regular expressions based on the use of a regular expression evaluation engine to evaluate the password with respect to regular expressions representing the password rules. Password evaluation element 114 determines whether a password satisfies a password rule based on whether the password satisfies a regular expression used to define the password rule (i.e., satisfying the regular expression means satisfying the password rule of password policy 124, and not satisfying the regular expression means not satisfying the password rule of password policy 124). Password evaluation element 114 determines whether a password satisfies password policy 124 based on whether the password satisfies the password rules of password policy 124 (i.e., the password satisfying each password rule of password policy 124 means the password satisfies password policy 124, and not satisfying each password rule of password policy 124 means the password does not satisfy password policy 124).It will be appreciated that the password evaluation component 114 may perform various other functions to evaluate a password specified by a customer for the customer gateway 111 against the service provider's password policy 124 hosted on the customer gateway 111.

[0040] The customer gateway 111 sets a password for the customer gateway 111 based on a determination by the password evaluation element 114 that the password specified by the customer for the customer gateway 111 satisfies the service provider's password policy (and is thereby allowed to be set on the customer gateway 111). A determination that the password specified by the customer for the customer gateway 111 satisfies the password policy may be based on a determination that the password successfully satisfies each of the password rules of the password policy (or at least a threshold number of the password rules of the password policy) based on an evaluation of associated regular expressions used to define the password rules of the password policy 124. After the password is successfully set for the customer gateway 111, the customer gateway 111 may provide an indication of successful password setting to the customer via the device management interface 113 (e.g., by sending a password setting response including an indication that the result of the password setting attempt was that the password specified by the customer was successfully set for the customer gateway 111). At this point, it will be appreciated that the password specified by the customer via the device management interface 113 has been successfully set because it satisfies the service provider password policy 124 of the service provider network 120 that provides communications services to the customer network 110.

[0041] The customer gateway 111 prevents the setting of a password for the customer gateway 111 based on a determination by the password evaluation element 114 that a password specified by a customer for the customer gateway 111 does not satisfy the service provider's password policy (and is not allowed to be set for the customer gateway 111) (e.g., if the password setting attempt is to set an initial password for the customer gateway 111, then a password is not set for the customer gateway 111, but if the password setting attempt is to change an existing password for the customer gateway 111, then the existing password remains as the password for the customer gateway 111). A determination that a password specified by a customer for the customer gateway 111 does not satisfy a password policy may be based on a determination that the password does not satisfy one or more password rules of the password policy (or at least a threshold number of password rules of the password policy) based on an evaluation of associated regular expressions used to define the password rules of the password policy 124. After determining that a password is not permitted to be set for the customer gateway 111 (e.g., by sending a password set response including an indication that the password specified by the customer was not successfully set for the customer gateway 111 because the result of the password set attempt did not satisfy one or more password rules of the service provider), the customer gateway 111 may provide an indication of the failure of the password set to the customer via the device management interface 113. At this point, it will be appreciated that the password specified by the customer via the device management interface 113 was not successfully set because it did not satisfy the service provider password policy 124 of the service provider network 120 that provides communications services to the customer network 110.

[0042] Although presented primarily with respect to the management and enforcement of a service provider's password policy of the service provider network 120 on a particular customer device of the customer network 110 (i.e., on the customer gateway 111) for evaluation of passwords entered for a particular customer device of the customer network (for the customer gateway 111), it will be understood that the management and enforcement of a service provider's password policy of the service provider network 120 may be performed for various other customer devices of the customer network 110 and / or password evaluation may be performed for various other customer devices of the customer network 110 (e.g., the service provider's password policy may be configured on the customer gateway 111 and used on the customer gateway 111 to evaluate passwords created for the CPEs 115 associated with the customer gateway 111, the service provider's password policy may be configured on the CPEs 115 and used on the CPEs 115 to evaluate passwords created for the CPEs 115, as well as various combinations thereof).

[0043] Although presented primarily with respect to supporting management and enforcement of password policies based on the use of particular data management capabilities that support remote management of devices (i.e., data management capabilities based on BBF technical specifications, including the BBF device management data model (e.g., TR-98, TR-181, etc.) and the BBF device management protocol (e.g., TR-069, TR-369, etc.)), it will be understood that various exemplary embodiments supporting management and enforcement of password policies may be provided based on the use of other types of data management capabilities that support remote management of devices.

[0044] Although presented primarily with respect to supporting management and enforcement of password policies within a particular type of communications system (i.e., within a communications system that supports communications services for customer networks, such as residential networks or business networks), it will be appreciated that various exemplary embodiments for supporting management and enforcement of password policies may be applied within various other types of communications systems that utilize passwords to protect access to devices.

[0045] FIG. 3 illustrates an exemplary embodiment of a method for use by a device management element of a service provider network to support management and enforcement of password policies for controlling passwords of customer devices based on the use of regular expressions and device management capabilities. Although presented as being primarily performed sequentially, it will be understood that at least some of the functions of the method 300 may be performed simultaneously or in a different order than presented with respect to FIG. 3. At block 301, the method 300 begins. At block 310, the device management element receives a password policy represented using a device management data model, the password policy including a set of password rules defined using a respective set of regular expressions. At block 320, the device management element transmits the password policy towards the customer device based on a device management protocol associated with the device management data model. At block 399, the method 300 ends. It will be understood that various functions presented herein with respect to FIG. 1 may be incorporated within the context of the method 300 of FIG. 3.

[0046] FIG. 4 illustrates an exemplary embodiment of a method for use by a customer device of a customer network to support management and enforcement of a password policy for controlling passwords for the customer device based on the use of regular expressions and device management capabilities. Although presented as being performed primarily sequentially, it will be understood that at least some of the functions of method 400 may be performed simultaneously or in a different order than presented with respect to FIG. 4. At block 401, method 400 begins. At block 410, a password policy is received by the customer device, the password policy including a set of password rules defined based on a respective set of regular expressions. At block 420, a request is received by the customer device to set a password for the customer device. At block 430, the customer device determines whether to set a password for the customer device based on an evaluation of the password with the password policy. At block 499, method 400 ends. It will be understood that various functions presented herein with respect to FIG. 1 may be incorporated within the context of method 400 of FIG. 4.

[0047] Various exemplary embodiments for supporting the management and enforcement of password rules for customer devices may provide various advantages or potential advantages. For example, various exemplary embodiments for supporting the configuration and enforcement of password rules for customer devices may provide regular expression-based password rules configurable through a data model in a manner that supports more efficient configuration and enforcement of password rules for controlling password settings for customer devices, thereby enhancing security for customer devices without requiring support from the device vendor. For example, various exemplary embodiments for supporting the configuration and enforcement of password rules for customer devices may provide service providers with customization that enhances security by aligning password rules with specific service provider security needs and preferences, and allowing enforcement of stricter password requirements, if desired, without the need for support from the customer device vendor. For example, various exemplary embodiments for supporting the configuration and enforcement of password rules for customer devices may enable the creation of robust password policies that adapt to evolving security threats based on the use of regular expressions that allow for the definition of complex and adaptive password rules (where regular expressions can accommodate a wide range of patterns and constraints). For example, various exemplary embodiments for supporting the configuration and enforcement of password rules for customer devices can provide a flexible and scalable platform for managing password rules across multiple users or devices based on the use of a data model to support the configuration and enforcement of password rules, and changes to password rules can be easily propagated and applied to ensure consistency and uniformity across the entire customer environment.For example, various exemplary embodiments for supporting configuration and enforcement of password rules for customer devices may provide significant advances in service provider enforcement of customer network security based on the introduction of configurable regular expression-based password rules via a data model, providing various benefits to service providers (e.g., providing greater control, adaptability, and customization with respect to enforcing strong password policies on customer devices) and to customer device vendors (e.g., increasing operational efficiency for device vendors by eliminating the need for device vendors to react to service provider requests for changes to customer devices in order to be able to support enhanced security for customer devices). It will be appreciated that various exemplary embodiments for supporting configuration and enforcement of password rules for customer devices may provide various other advantages or potential advantages.

[0048] FIG. 5 illustrates an exemplary embodiment of a computer suitable for use in performing various functions presented herein.

[0049] Computer 500 includes a processor 502 (e.g., a central processing unit (CPU), a processor, a processor having a set of processor cores, a processor core of a processor, etc.) and memory 504 (e.g., Random Access Memory (RAM), Read Only Memory (ROM), etc.). In at least some exemplary embodiments, computer 500 may include at least one processor and at least one memory that stores instructions that, when executed by the at least one processor, cause the computer to perform various functions presented herein.

[0050] The computer 500 may also include a cooperating element 505. The cooperating element 505 may be a hardware device. The cooperating element 505 may be a process that may be loaded into the memory 504 and executed by the processor 502 to implement various functions presented herein (wherein, for example, the cooperating element 505 (including associated data structures) may be stored on a non-transitory computer-readable medium, such as a storage device or other suitable type of storage element (e.g., magnetic drive, optical drive, etc.)).

[0051] The computer 500 may also include one or more input / output devices 506. The input / output devices 506 may include one or more of user input devices (e.g., a keyboard, keypad, mouse, microphone, camera, etc.), user output devices (e.g., a display, speakers, etc.), one or more network communication devices or elements (e.g., input ports, output ports, receivers, transmitters, transceivers, etc.), one or more storage devices (e.g., tape drives, floppy drives, hard disk drives, compact disk drives, etc.), and the like, as well as various combinations thereof.

[0052] It will be appreciated that computer 500 may represent a general architecture and functionality suitable for implementing the functional elements described herein, portions of the functional elements described herein, and the like, as well as various combinations thereof. For example, computer 500 may provide a general architecture and functionality suitable for implementing one or more elements presented herein. For example, computer 500 may provide a general architecture and functionality suitable for implementing at least one of a service provider device or portions thereof (e.g., a support system, a policy system, an administrator system, a device management element, etc.), a customer device or portions thereof (e.g., a customer gateway device such as a residential gateway, a customer CPE device, a device interface element, a device management interface, a password validation element, etc.), as well as various combinations thereof.

[0053] It will be understood that at least some of the functionality presented herein may be implemented in software (e.g., via implementation of the software on one or more processors for execution (e.g., via execution by one or more processors) on a general-purpose computer to provide a special-purpose computer, etc.) and / or in hardware (e.g., using a general-purpose computer, one or more application specific integrated circuits, and / or any other hardware equivalents).

[0054] It will be understood that at least some of the functionality presented herein may be implemented in hardware, for example, as circuitry that cooperates with a processor to perform various functions. Portions of the functionality / elements described herein may be implemented as a computer program product, where computer instructions, when processed by a computer, adapt the operation of the computer such that the methods and / or techniques described herein are invoked or otherwise provided. Instructions for invoking the various methods may be stored on fixed or removable media (e.g., non-transitory computer-readable media), transmitted via a data stream in a broadcast or other signal-bearing medium, and / or stored in memory within a computing device that operates according to the instructions.

[0055] It will be understood that the term "non-transient" as used herein is a limitation of the medium itself (i.e., tangible as opposed to a signal) as opposed to a limitation of data storage persistence (e.g., RAM vs. ROM).

[0056] As used herein, "at least one of " and "at least one of: " and similar phrases, when a list of two or more elements is joined by "and" or "or", will be understood to mean at least any one of the elements, or at least any two or more of the elements, or at least all of the elements.

[0057] As used herein, the term "or" will be understood to refer to a non-exclusive "or" unless otherwise indicated (e.g., use of "or otherwise" or "or in the alternative").

[0058] While various embodiments incorporating the teachings presented herein have been shown and described in detail herein, it will be understood that those skilled in the art could readily devise many other various embodiments which still incorporate these teachings.

Claims

1. At least one processor; and at least one memory containing instructions that, when executed by the at least one processor, cause the apparatus to at least: receiving, by the customer device, a password policy including a set of password rules defined based on a respective set of regular expressions; receiving, by the customer device, a request to set a password for the customer device; determining, by the customer device, whether to set the password for the customer device based on an evaluation of the password with the password policy; An apparatus for executing the above-mentioned procedure.

2. The apparatus of claim 1 , wherein the password policy is received from a service provider network that provides communication services to the customer device.

3. The apparatus of claim 1 , wherein the password policy is received based on a device management protocol.

4. The apparatus according to claim 3, characterized in that the device management protocol is based on TR-069 or TR-369.

5. The apparatus of claim 1 , wherein the password policy is received from a device management element.

6. 6. The apparatus of claim 5, wherein the device management element is an Auto-Configuration Server (ACS) or a User Services Platform (USP) element.

7. The apparatus of claim 1 , wherein the password policy is represented using a device management data model.

8. The apparatus of claim 7 , wherein the device management data model is a Broadband Forum data model.

9. 9. The apparatus of claim 8, wherein the Broadband Forum data model is a TR-98 data model or a TR-181 data model.

10. The apparatus of claim 1 , wherein the request to set the password on the customer device is received via a device management interface.

11. The apparatus of claim 10 , wherein the device management interface is a customer facing device management interface.

12. The apparatus of claim 10, wherein the device management interface is a WebGUI interface.

13. 2. The apparatus of claim 1, wherein evaluation of the password with the password policy is based on a regular expression evaluation engine.

14. 2. The apparatus of claim 1, wherein evaluating the password with the password policy includes evaluating the password with respect to each of the regular expressions to determine whether the password satisfies each of the password rules of the password policy.

15. The instructions, when executed by the at least one processor, cause the device to at least:

2. The apparatus of claim 1, further comprising the step of allowing the password to be set on the customer device based on a determination that the password satisfies the password policy.

16. The instructions, when executed by the at least one processor, cause the device to at least:

2. The apparatus of claim 1, further comprising: preventing the password from being set on the customer device based on a determination that the password does not meet the password policy.

17. The apparatus of claim 1 , wherein the customer device is a customer gateway device or a customer premises equipment device.

18. receiving, by the customer device, a password policy including a set of password rules defined based on a respective set of regular expressions; receiving, by the customer device, a request to set a password for the customer device; determining, by the customer device, whether to set the password for the customer device based on an evaluation of the password using the password policy; 23. A method comprising:

19. At least one processor; and at least one memory containing instructions that, when executed by the at least one processor, cause the apparatus to at least: receiving, by a device management element, a password policy represented using a device management data model and including a set of password rules defined using a respective set of regular expressions; transmitting, by the device management element, the password policy to a customer device based on a device management protocol associated with the device management data model; An apparatus for executing the above-mentioned procedure.

20. receiving, by the device management element, a password policy requested using a device management data model and including a set of password rules defined using a respective set of regular expressions; transmitting, by the device management element, the password policy to a customer device based on a device management protocol associated with the device management data model; 23. A method comprising:

Images