# US 11,444,788 B2 · Authentication and access control for device management and provisioning > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,788 B2 - Document ID: US11444788B2 - Status: Granted - Kind: B2 - Application number: 16/847,082 - Filed: 2020-04-13 - Published: 2021-10-14 - Granted: 2022-09-13 - Earliest claimed: 2020-04-13 - Assignees: Verizon Patent and Licensing Inc. - Applicants: Verizon Patent and Licensing Inc. - Inventors: Warren Hojilla Uy; Young R. Choi; Manuel Enrique Caceres; Emilia C. Quijano - Web page: https://patentgrep.com/patent/US11444788B2 ## CPC - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - G06F 16/245: Query processing - H04L 41/0253: using browsers or web-pages for accessing management information - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 61/50: Address allocation - H04L 63/0838: {using one-time-passwords} - H04L 63/0846: {using time-dependent-passwords, e.g. periodically changing passwords} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/102: {Entity profiles} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04W 12/068: {using credential vaults, e.g. password manager applications or one time password [OTP] applications} - H04W 12/069: using certificates or pre-shared keys - H04W 12/30: Security of mobile devices; Security of mobile applications - H04W 76/10: Connection setup - H04L 61/103: across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP] - H04L 61/5014: using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP] - H04L 2101/622: Layer-2 addresses, e.g. medium access control [MAC] addresses - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method or system for authentication and access control in for network device management is disclosed. The method or system may include establishing a communication channel between a user device and a network device and receiving, by the network device, a public-key certificate including a specified identity of the user device. The method or system may include determining whether the public-key certificate is valid against a root certificate stored in the network device, and determining an actual identity of the user device. The method or system may include indicating that the user device is authentic and authorized when the received public-key is valid against the root certificate and when the actual identity of the user device matches the specified identity in the public-key certificate. ## Claims ### Claim 1 A method comprising: establishing a communication channel between a user device and a customer premises equipment (CPE) device; receiving, by the CPE device from the user device, a public-key certificate including a specified identity of the user device; determining whether the public-key certificate received by the CPE device is valid against a root certificate stored in the CPE device; determining an actual identity of the user device; indicating that the user device is authentic and authorized when the public-key certificate received by the CPE device is valid against the root certificate and when the actual identity of the user device matches the specified identity in the public-key certificate; querying a database to determine whether a user identity associated with the user device is authorized to access the CPE device and sending a supplied password to the user device when the user identity is authorized; receiving, by the CPE device from the user device, the supplied password; comparing, by the CPE device, the supplied password with a stored password; and indicating that the user identity is authorized to access the CPE device when the supplied password matches the stored password. ### Claim 2 (depends on 1) The method of claim 1, wherein the specified identity and the actual identity each include a media access control (MAC) address. ### Claim 3 (depends on 1) The method of claim 1, further comprising: determining a location of the user device; and determining a location associated with the CPE device, wherein sending the supplied password includes sending the supplied password to the user device when the location of the user device matches the location associated with the CPE device. ### Claim 4 (depends on 1) The method of claim 1, further comprising: determining a current time; querying a second database to determine whether the user identity is authorized to access the CPE device during a specified time; and sending the supplied password to the user device when the current time matches the specified time. ### Claim 5 (depends on 1) The method of claim 1, wherein the supplied password includes a one-time password. ### Claim 6 (depends on 1) The method of claim 1, wherein the supplied password includes a one-time password based on a current time. ### Claim 7 (depends on 1) The method of claim 1, wherein the supplied password includes a one-time password based on a counter. ### Claim 8 (depends on 5) The method of claim 5, wherein the public-key certificate includes the one-time password. ### Claim 9 (depends on 1) The method of claim 1, further comprising: serving a graphical user interface to the user device to enable configuration of the CPE device. ### Claim 10 A system including a first network device and a second network device, wherein the first network device comprises: a communication interface having a receiver and a transmitter; a memory for storing instructions and a root certificate; and a processor configured to execute the instructions to: establish a communication channel between a user device and the first network device, receive, by the first network device, a public-key certificate including a specified identity of the user device, determine, by the first network device, whether the public-key certificate received by the first network device is valid against the root certificate, determine, by the first network device, an actual identity of the user device, and indicate, by the first network device, that the user device is authentic and authorized when the public-key certificate received by the first network device is valid against the root certificate and when the actual identity of the user device matches the specified identity in the public-key certificate, and wherein the second network device comprises: a communication interface having a receiver and a transmitter; a memory for storing instructions; and a processor configured to execute the instructions in the memory of the second network device to: query a database to determine whether a user identity associated with the user device is authorized to access the first network device and send a supplied password to the user device when the user identity is authorized, wherein the processor in the first network device is further configured to: receive, by the first network device from the user device, the supplied password; compare, by the first network device, the supplied password with a stored password; and indicate that the user identity is authorized to access the first network device when the supplied password matches the stored password. ### Claim 11 (depends on 10) The system of claim 10, wherein the specified identity and the actual identity each include a media access control (MAC) address. ### Claim 12 (depends on 10) The system of claim 10, wherein the processor of the second network device further is configured to execute the instructions to: determine a location of the user device; and determine a location associated with the first network device, wherein sending the supplied password includes sending the supplied password to the user device when the location of the user device matches the location associated with the first network device. ### Claim 13 (depends on 10) The system of claim 10, wherein the processor of the second network device is further configured to execute the instructions to: determine a current time; query a second database to determine whether the user identity is authorized to access the first network device during a specified time; and send the supplied password to the user device when the current time matches the specified time. ### Claim 14 (depends on 10) The system of claim 10, wherein the supplied password includes a one-time password. ### Claim 15 (depends on 10) The system of claim 10, wherein the supplied password includes a one-time password based on a current time. ### Claim 16 (depends on 10) The system of claim 10, wherein the supplied password includes a one-time password based on a counter. ### Claim 17 (depends on 14) The system of claim 14, wherein the public-key certificate includes the one-time password. ### Claim 18 (depends on 10) The system of claim 10, wherein the processor of the first device is further configured to execute the instructions to serve a graphical user interface to the user device to enable configuration of the first network device. ### Claim 19 A method comprising: establishing a communication channel between a user device and a customer premises equipment (CPE) device; receiving, by the CPE device from the user device, a public-key certificate including a specified identity of the user device; determining whether the public-key certificate received by the CPE device is valid against a root certificate stored in the CPE device; determining an actual identity of the user device; indicating that the user device is authentic and authorized when the public-key certificate received by the CPE device is valid against the root certificate and when the actual identity of the user device matches the specified identity in the public-key certificate; determining a location of the user device or determining a current time; determining a location associated with the CPE device; querying a database to determine whether a user identity associated with the user device is authorized to access the CPE device during a specified time or at a specified location associated with the CPE device and sending a supplied password to the user device when the user identity is authorized; receiving, by the CPE device from the user device, the supplied password; comparing, by the CPE device, the supplied password with a stored password; and indicating that the user identity is authorized to access the CPE device when the supplied password matches the stored password. ### Claim 20 (depends on 19) The method of claim 19, wherein the supplied password includes a one-time password, the method further including: serving a graphical user interface to the user device to enable configuration of the CPE device.