Customer Premises Equipment Authentication

Abstract

In one embodiment, the distribution system includes customer premises equipment that is authenticated to a network including a cable modem termination system based on DOCSIS authentication. The customer premises equipment receives data from a supplicant device interconnected to the network through the customer premises equipment, the supplicant device being authenticated to the network based on 802.1X authentication.

Description

[Technical field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS This application claims the benefit of U.S. Provisional Patent Application No. 63 / 315,798, filed March 2, 2022. [Background technology]

[0002] The subject matter of this application relates to authentication techniques.

[0003] Cable television (CATV) services provide content to a large set of customers (e.g., subscribers) from a central distribution unit, commonly referred to as a "headend," which distributes channels of content to its customers through an access network comprising a hybrid fiber coaxial (HFC) cable plant with associated components (nodes, amplifiers, and taps). However, modern cable television (CATV) service networks not only provide media content, such as television channels and music channels, to customers, but also provide a host of digital communication services, such as Internet services, video on demand, telephone services such as VoIP, home automation / security, etc. These digital communication services, in turn, require communication not only in a downstream direction from the headend to the customers through the HFC, typically forming a branch network, but also in an upstream direction, typically through the HFC network, from the customers to the headend.

[0004] To this end, CATV headends have traditionally included a separate cable modem termination system (CMTS) used to provide high-speed data services such as cable Internet, Voice over Internet Protocol, etc. to cable customers, as well as a video headend system used to provide video services such as broadcast video and video on demand (VOD). Typically, the CMTS will include both an Ethernet interface (or other more traditional high-speed data interface) as well as a radio frequency (RF) interface so that traffic coming from the Internet can be routed (or bridged) through the Ethernet interface, through the CMTS, and then onto an RF interface that connects to the cable company's Hybrid Fiber Coaxial (HFC) system. While downstream traffic is delivered from the CMTS to cable modems and / or set-top boxes in the customer's home, upstream traffic is delivered from cable modems and / or set-top boxes in the customer's home to the CMTS. The video headend system in turn provides video to either set-tops, TVs with video decoding cards, or other devices capable of demodulating and decrypting the incoming encrypted video service. Many modern CATV systems combine the functionality of a CMTS with a video distribution system (e.g., EdgeQAM-quadrature amplitude modulation) in a single platform, commonly referred to as an integrated CMTS (e.g., an integrated centralized cable access platform (CCAP)), where video services are created and provided to an I-CCAP, which then QAM-modulates the video onto the appropriate frequency. Still other modern CATV systems, commonly referred to as a distributed CMTS (e.g., a distributed centralized cable access platform), may include a remote PHY (or R-PHY) that relocates the physical layer (PHY) of a traditional integrated CCAP by pushing it to the fiber nodes of the network (the R-MAC PHY relocates both the MAC and PHY to the nodes of the network).Thus, while the core in the CCAP platform performs higher layer processing, the R-PHY devices in the remote nodes convert downstream data transmitted from the core from digital to analog for transmission over radio frequency to cable modems and / or set-top boxes, and convert upstream radio frequency data transmitted from the cable modems and / or set-top boxes from analog to digital format for optical transmission to the core. [Brief description of the drawings]

[0005] For a better understanding of the present invention and to show how it may be carried into effect, reference will now be made, by way of example, to the accompanying drawings in which: [Figure 1] FIG. 1 shows an integrated cable modem termination system. [Diagram 2] FIG. 2 shows a distributed cable modem termination system. [Diagram 3] FIG. 3 illustrates authentication using the CMTS and customer premises equipment. [Figure 4] FIG. 4 illustrates authentication of a supplicant client and an authentication server. [Diagram 5] FIG. 5 illustrates customer premises equipment interconnected to a computing device and a supplicant client. [Figure 6] FIG. 6 illustrates one embodiment of a network architecture. [Figure 7] FIG. 7 shows the flow process for 802.1X authentication for the network architecture of FIG. [Figure 8] FIG. 8 illustrates another embodiment of a network architecture. [Figure 9] FIG. 9 shows the flow process for 802.1X authentication for the network architecture of FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0006] Referring to FIG. 1, an integrated CMTS (e.g., an integrated converged cable access platform (CCAP)) 100 may include data 110 that is transmitted and received over the Internet (or other network), typically in the form of packetized data. The integrated CMTS 100 may also receive downstream video 120, typically in the form of packetized data, from an operator video aggregation system. As an example, broadcast video is typically obtained from a satellite distribution system and pre-processed for distribution to subscribers through a CCAP or video head-end system. The integrated CMTS 100 receives and processes the received data 110 and downstream video 120. The CMTS 130 may transmit the downstream data 140 and downstream video 150 to a customer's cable modem and / or set-top box 160 through an RF distribution network, which may include other devices such as amplifiers and splitters. The CMTS 130 may receive upstream data 170 from a customer's cable modem and / or set-top box 160 through a network, which may include other devices such as amplifiers and splitters. The CMTS 130 may include multiple devices to achieve its desired capabilities.

[0007] Referring to FIG. 2, as a result of increasing bandwidth demands, limited facility space for integrated CMTS, and power consumption considerations, it is desirable to include a distributed cable modem termination system (D-CMTS) 200 (e.g., a distributed centralized cable access platform (CCAP)). Generally, CMTSs focus on data services, while CCAPs also include broadcast video services. The D-CMTS 200 distributes some of the functionality of the I-CMTS 100 to remote locations downstream, such as fiber nodes, using network packetized data. An exemplary D-CMTS 200 may include a remote PHY architecture, with the remote PHY (R-PHY) being an optical node device preferably located at the junction of fiber and coax. Generally, the R-PHY often includes the PHY layer of a portion of the system. The D-CMTS 200 may include a D-CMTS 230 (e.g., a core) that includes data 210 that is transmitted and received over the Internet (or other network), typically in the form of packetized data. The D-CMTS 200 may also receive downstream video 220, typically in the form of packetized data from an operator video aggregation system. The D-CMTS 230 receives and processes the received data 210 and downstream video 220. The remote fiber node 280 preferably includes a remote PHY device 290. The remote PHY device 290 may transmit the downstream data 240 and downstream video 250 to a customer's cable modem and / or set-top box 260 over a network that may include other devices such as amplifiers and splitters. The remote PHY device 290 may receive upstream data 270 from a customer's cable modem and / or set-top box 260 over a network that may include other devices such as amplifiers and splitters. The remote PHY device 290 may include multiple devices to achieve its desired capabilities.The remote PHY device 290 primarily includes PHY-related circuitry such as a downstream QAM modulator, an upstream QAM demodulator, along with pseudowire logic that connects to the D-CMTS 230 with network packetized data. The remote PHY device 290 and the D-CMTS 230 may include data and / or video interconnects such as downstream data, downstream video, and upstream data 295. Note that in some embodiments, video traffic may go directly to the remote physical device, thereby bypassing the D-CMTS 230. In some cases, the remote PHY and / or remote MAC PHY functionality may be provided at the headend.

[0008] As an example, the remote PHY device 290 may convert downstream DOCSIS (i.e., Data Over Cable Service Interface Specification) data (e.g., DOCSIS 1.0, 1.1, 2.0, 3.0, 3.1, and 4.0, each of which is incorporated herein by reference in their entirety), video data, and out-of-band signals received from the D-CMTS 230 to analog for transmission over RF or analog optics. As an example, the remote PHY device 290 may convert upstream DOCSIS and out-of-band signals received from analog media such as RF or linear optics to digital for transmission to the D-CMTS 230. As can be observed, depending on the particular configuration, the R-PHY may move all or a portion of the DOCSIS MAC and / or PHY layers to the fiber node.

[0009] Referring to FIG. 3, customer premises equipment (e.g., cable modem / set-top box / etc.) 300 may be authenticated by a CMTS 310 (e.g., D-CMTS / I-CMTS). As an example, the customer premises equipment 300 may use the Baseline Privacy Key Management (BPKM) protocol to send an authentication request 320 including the customer premises equipment's identification attributes 330. The identification attributes 330 may be based on a concatenation of an X.509 certificate and a media access control (MAC) address, serial number, manufacturer identification, and a Rivest-Shamir-Adelman (RSA) public key for the customer premises equipment 300. After receiving the authentication request 320, the CMTS 310 authenticates the customer premises equipment 300 by verifying the X.509 certificate in the identification attributes 330 using a certificate chain provisioned in the CMTS 310's local memory. If the customer premises equipment 300 is authenticated for cable service, the CMTS 310 uses the BPKM protocol to send back an authentication response message 340 that includes a locally generated authentication key 350. The lifetime information and cipher suite information of the authentication key 350 are included in the authentication response message 340. Other techniques may be used to authenticate the customer premises equipment to utilize the cable network. By way of example, different protocols may be used to authenticate the customer premises equipment. By way of example, an authentication server may be used to authenticate the customer premises equipment. The authentication is preferably based on the DOCSIS 1.0, 1.1, 2.0, 3.0, 3.1, 4.0 protocols. In general, DOCSIS provisioning is based on the use of back office systems accessible via the Dynamic Host Configuration Protocol (DHCP). DHCP is defined by RFC 1541 of October 1993 and / or RFC 2131 of March 1997, each of which is incorporated herein by reference in its entirety.

[0010] 4, other networks, such as when a device attempts to connect to a LAN or WLAN, may require authentication mechanisms such as IEEE 802.1X, IEEE 802.1X-2020, Feb. 28, 2020, which is incorporated herein by reference in its entirety. 802.1X networks include authentication servers, called RADIUS servers, that check users' credentials to see if they are active members of an organization and grant users different levels of access to the network depending on network policies. This allows for the use of unique credentials or certificates per user, eliminating reliance on a single network password that can be easily stolen.

[0011] 802.1X is a network authentication protocol that opens ports for network access when an organization authenticates a user's identity and allows access to the network. The user's identity is determined based on the user's credentials or certificate, which is verified by a RADIUS server, which may communicate with the organization's directory, if necessary. The standard authentication protocol used in encrypted networks is the Extensible Authentication Protocol (EAP), which provides a secure method of transmitting identifying information for network authentication. 802.1X is the standard used to pass EAP over wired and wireless local area networks.

[0012] The 802.1X authentication process consists of four main steps: initialization, initiation, negotiation, and authentication. Initialization begins when the authenticator detects a new device and attempts to establish a connection. The authenticator port is set to an "unauthorized" state, meaning that only 802.1X traffic is accepted and all other connections are dropped. Initiation involves the authenticator starting to send EAP requests to the new device and then sending an EAP response back to the authenticator. The response typically includes a method to identify the new device. The authenticator receives the EAP response and relays it to the authentication server in a RADIUS Access-Request packet. Negotiation involves the authentication server receiving a request packet, then responding with a RADIUS Access-Challenge packet, which includes the EAP authentication method approved for the device. The authenticator then passes the challenge packet to the device to be authenticated. Authentication involves the authentication server starting to send configuration profiles so that the device can be authenticated once the EAP method is configured on the device. Once the process is complete, the port is set to "authenticated" and the device is configured into the 802.1X network.

[0013] The DOCSIS protocol does not include support for 801.1X authentication. Thus, devices configured to be authenticated based on 802.1X, such as voice-based cellular telephones interconnected to customer premises equipment, are not suitable to be authenticated onto a DOCSIS-based cable network. It is desirable to facilitate the use of devices on a DOCSIS-based network that are authenticated using other techniques, such as IEEE 802.1X, a port-based network access control technique. It is desirable to identify network traffic that is not authenticated using DOCSIS to accommodate devices whose data is transmitted using a DOCSIS-based cable network that is authenticated based on a non-DOCSIS technique, such as IEEE 802.1X.

[0014] Referring to FIG. 5, customer premises equipment 500 is interconnected to a DOCSIS-based cable network using DOCSIS authentication 510. A supplicant client 520, such as a user device, is interconnected to a port or other connection to the customer premises equipment 500. The supplicant client 520 may be authenticated based on 802.1X authentication. Other devices, such as laptops, tablets, and other computing devices 540, are similarly authenticated based on DOCSIS authentication 510. Thus, the supplicant client 520 needs to authenticate its data traffic in a different manner than that done for the DOCSIS authentication 510. Then, once the supplicant client 520 is authenticated, it is desirable for its data traffic to be transmitted to the cable network in a typical manner. The manner in which the supplicant client 520 is authenticated to the DOCSIS network may be implemented using an integrated cable modem termination system and / or a distributed cable modem termination system. The network system may also be based on DPoE, a DOCSIS provisioning of Ethernet Passive Optical Network (EPON), which addresses management and configuration of data transmission over the EPON system. In general, a DPoE network is composed of EPON fiber optic terminals and optical network units, which for the purposes of this description are considered to be CMTSs and corresponding cable modems. In general, for DOCSIS and / or DPoE-based PON systems, a Dynamic Host Protocol Server (DHCP) provides authorization to customer premises equipment by leasing Internet Protocol addresses to requesting customer premises equipment.

[0015] 6, an exemplary network architecture is illustrated in which a remote controller (e.g., a software entity installed on a remote server) performs 802.1X authentication functions for supplicant clients accessing a network via a cable modem / optical network unit registered with a distributed access device. The network architecture may include customer premises equipment (e.g., cable modem and / or optical network unit) 600, a distributed access device 610, a multi-service operator network 620, a remote controller 630, an authentication server 640, a DHCP server 650, and / or a supplicant client 660.

[0016] 7, the customer premises equipment 600 is registered with the MSO network 620 and / or the DAA device 610 (e.g., I-CMTS / D-CMTS / OLT), and configuration settings from a customer premises equipment configuration file are applied to the customer premises equipment 600 and the MSO network 620 and / or the DAA device 610 to support the service flows from the customer premises equipment 600. The configuration settings on the MSO network 620 and / or the DAA device 610 indicate whether traffic for each service flow from the customer premises equipment 600 is subject to 802.1X authentication. In particular, in addition to the quality of service settings, the service class name definition referenced from the customer premises equipment configuration file for each service flow provides a setting (or a pointer to a setting) that enables 802.1X authentication of the customer premises equipment 600. This setting (or a pointer to a setting) may also be used to specify a unique S-VLAN or Q-VLAN for the traffic on that service flow.

[0017] The customer premises equipment 600 forwards all upstream traffic 700, including EAPoL (Extensible Authentication Protocol over LAN), from the supplicant client 660, the customer premises equipment 600 to a service flow 710 configured for 802.1X authentication. The MSO network 620 and / or the DAA device 610 discard 720 all non-EAPoL traffic received from the service flow 710.

[0018] The MSO network 620 and / or the DAA device 610 process (730) all EAPoL traffic received from the service flow 710. In one approach, the DAA device 610 tunnels (740) the EAPoL packets to the remote controller 630 for processing. The remote controller 630 performs the role of an 802.1X authenticator. The remote controller 630 may, for example, use a protocol such as RADIUS to query the authentication server 640 to authorize the media access control (MAC) address of its supplicant client 660. As an example, the authentication process may involve (1) EAPoL request ID 750, (2) EAPoL response ID 752, (3) request 754, (4) challenge 756, (5) EAPoL request challenge 758, (6) EAPoL response challenge 760, (7) request 762, (8) accept 764, and (9) EAPoL success 766. As a result, the authentication server 640 can successfully authenticate (768) the MAC address of the supplicant device 660.

[0019] The 802.1X authenticator (e.g., remote controller 630 and / or DAA device 610) updates the forwarding table 770 to bind (772) the MAC address of the supplicant client 660 to the MAC address of the customer premises equipment 600 to enable forwarding to and from the supplicant client 660. In this manner, the MAC address of the supplicant device is added to the forwarding table. The supplicant client's 660 DHCP traffic 774 (discovery / offer / request / acknowledgement) is allowed on the network, and the supplicant client 660 may obtain an IP address lease from the DHCP server 650. Periodically, the 802.1X authenticator (e.g., remote controller 630 and / or DAA device 610) may re-authenticate the MAC of the supplicant device 660. The supplicant device's IP address 776 is added to the forwarding table. The supplicant device 660 is permitted to access the network 780 to send and receive data 782 with the MAC address and IP address of the supplicant client 660 being added to the forwarding table.

[0020] If the MAC address of the supplicant device 660 does not successfully re-authenticate, the 802.1X authenticator updates the DAA device 610 forwarding table to remove the MAC address binding to the supplicant device 660 and / or deny forwarding to / from the MAC address of the supplicant device 660.

[0021] Another exemplary network architecture is illustrated with a process description with reference to Figures 8 and 9. In the approach shown in Figures 8 and 9, the CMTS / OLT may process EAPoL packets directly and may also perform an 802.1X authenticator process, using a protocol such as RADIUS, to check with an authentication server to authorize the Media Access Control (MAC) address of the supplicant client.

[0022] Furthermore, each functional block or various features in each of the foregoing embodiments may be implemented or performed by a circuit, typically an integrated circuit or multiple integrated circuits. A circuit designed to perform the functions described herein may include a general-purpose processor, a digital signal processor (DSP), an application specific or general purpose integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic, or discrete hardware components, or a combination thereof. A general-purpose processor may be a microprocessor, or alternatively, the processor may be a conventional processor, controller, microcontroller, or state machine. The general-purpose processor or each circuit described above may be composed of digital circuits or may be composed of analog circuits. Furthermore, as advances in semiconductor technology emerge that allow integrated circuits to replace multiple integrated circuits at present, integrated circuits according to this technology may also be used.

[0023] It will be understood that the present invention is not limited to the particular embodiments described, and that modifications may be made therein, as interpreted in accordance with the principles of prevailing law, including the doctrine of equivalents, or any other principle that expands the scope of enforceable claims beyond their literal scope, without departing from the scope of the invention as defined in the appended claims. Unless the context indicates otherwise, a reference in a claim to the number of instances of an element, whether it is a reference to one instance or to multiple instances, requires at least the recited number of instances of the element, but is not intended to exclude from the scope of the claim a structure or method having more instances of that element than are recited. As used in the claims, the term "comprise" or its derivatives is used in a non-exclusive sense that is not intended to exclude the presence of other elements or steps in the claimed structure or method.

Claims

1. A network distribution system, comprising: (a) comprising customer premises equipment that is authenticated to a network including a cable modem termination system based on DOCSIS authentication; (b) the customer premises equipment receives data from a supplicant device interconnected to the network through the customer premises equipment, the supplicant device being authenticated to the network based on 802.1X authentication.

2. The network distribution system of claim 1 , wherein the customer premises equipment receives an extensible authentication protocol communication from the supplicant device.

3. 3. The network distribution system of claim 2, wherein the Extensible Authentication Protocol communications are assigned to a service flow configured for 802.1X authentication and provided to the network.

4. The network distribution system of claim 1 , wherein the customer premises equipment receives non-extensible authentication protocol communications from the supplicant device.

5. 5. The network distribution system of claim 4, wherein the non-extensible authentication protocol communications are provided to a distributed access device that is assigned to a service flow configured for 802.1X authentication and that discards the non-extensible authentication protocol communications.

6. 5. The network distribution system of claim 4, wherein the non-extensible authentication protocol communications are assigned to a service flow configured for 802.1X authentication and provided to the cable modem termination system, which discards the non-extensible authentication protocol communications.

7. 4. The network distribution system of claim 3, wherein the extensible authentication protocol communication is provided over the service flow to at least one of a DAA device and the cable modem termination system.

8. 8. The network distribution system of claim 7, wherein the extensible authentication protocol communications are tunneled from the DAA device to a controller.

9. The network distribution system of claim 8 , wherein the controller performs 802.1X authentication on the supplicant device.

10. 10. The network distribution system of claim 9, wherein the controller consults an authentication server to approve a media access control (MAC) address of the supplicant device.

11. The network distribution system of claim 10, wherein the 802.1X authentication includes EAPoL Request ID, EAPoL Response ID, Request, Challenge, EAPoL Request Challenge, EAPoL Response Challenge, Request, Accept, and EAPoL Success.

12. 11. The network distribution system of claim 10, wherein a forwarding table is updated to include the media access control (MAC) address of the supplicant device.

13. 13. The network distribution system of claim 12, wherein the forwarding table binds the media access control (MAC) address to the customer premises equipment.

14. 14. The network distribution system of claim 13, wherein a Dynamic Host Configuration Protocol server provides an IP address to a supplicant client in response to a request from the supplicant client.

15. 15. The network distribution system of claim 14, wherein the forwarding table is updated to include the IP address of the supplicant device.

16. 1. A networking system comprising: (a) customer premises equipment that is authenticated to a network including a cable modem termination system based on DOCSIS authentication; (b) the customer premises equipment receives data from an interconnected device to a port of the customer premises equipment interconnected to the network through the customer premises equipment, the interconnected device being authenticated to the network based on an authentication different from the DOCSIS authentication.

17. 1. A networking system comprising: (a) customer premises equipment that is authenticated to a network, including a cable modem termination system, based on a first non-port-based authentication technique; (b) the customer premises equipment receives data from an interconnected device to a port of the customer premises equipment interconnected to the network through the customer premises equipment, and the interconnected device is authenticated to the network based on a port-based authentication technique that is different from a first authentication.

Images