# US 12,120,115 B2 · Methods and apparatus for provisioning services which require a device to be securely associated with an account > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,120,115 B2 - Document ID: US12120115B2 - Status: Granted - Kind: B2 - Application number: 16/036,892 - Filed: 2018-07-16 - Published: 2018-11-08 - Granted: 2024-10-15 - Earliest claimed: 2014-11-12 - Assignees: Time Warner Cable Enterprises LLC - Applicants: Time Warner Cable Enterprises LLC - Inventors: Albert William Straub; Miles Anton Johnson - Web page: https://patentgrep.com/patent/US12120115B2 ## CPC - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - G06F 21/44: Program or device authentication - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04W 12/35: {Protecting application or service provisioning, e.g. securing SIM application provisioning} - G06F 2221/2129: Authenticate client device independently of the user - H04L 41/28: Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04W 12/43: using shared identity modules, e.g. SIM sharing - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Methods and apparatus for provisioning and providing services to devices on a local network are described. The methods and apparatus allow for the provisioning of services to customer owned and managed devices on a local network on which another device, e.g., a first device, has already been authenticated and authorized to receive services corresponding to a customer account. After a first device on a local network is authenticated and associated with a customer account it detects the addition of new devices on the local network and assists in the registration of the new device by acting as an intermediary with a service provider device during the registration process. The security and registration established by the first device is leveraged allowing other devices on the network to be registered and authenticated for services corresponding to the same account as the first device without requiring user input of authentication and/or other information. ## Claims ### Claim 1 A communications method, the method comprising: operating a first customer premises device, having a security association with a network device, to monitor to detect one or more new devices on a local customer premises network, said first customer premises device being located on said local customer premises network; checking, at the first customer premises device, to determine whether a new device was detected on the local customer premises network; in response to said checking determining that a new device was detected on the local customer premises network, operating the first customer premises device to check with the network device whether the new device is already registered, said new device being a second device that does not have a security association with the network device; operating the first customer premises device to receive security information intended for said second device from said network device; operating the network device to update a first customer record, in which the first customer premises device is associated with a first customer account, to associate said second device with the first customer account; and operating the first customer premises device to provide said security information to said second device to thereby create a security association between said network device and said second device. ### Claim 2 (depends on 1) The method of claim 1, wherein operating the first customer premises device to monitor to detect one or more new devices on the local customer premises network includes operating the first customer premises device to monitor the local customer premises network for a signal communicating a device identifier of a device which was not previously on the local customer premises network; wherein said local customer premises network is located at a first customer premises; and wherein said network device is located outside said first customer premises. ### Claim 3 (depends on 1) The method of claim 1, wherein said first customer account corresponds to a first customer premises where said first customer premises device and said local customer premises network are located; and wherein operating the network device to update a first customer record, in which the first customer premises device is associated with a first customer account, to associate said second device with the first customer account includes indicating in the first customer record that the second device, in addition to the first customer premises device, is entitled to receive services corresponding to the first customer account in accordance with a contract between a first customer and a service provider. ### Claim 4 (depends on 3) The method of claim 3, further comprising: operating the first customer premises device to add the second device to a list of registered devices which the first customer premises device knows are attached to the local customer premises network. ### Claim 5 (depends on 4) The method of claim 4, further comprising: operating the first customer premises device to detect an additional new device on the local customer premises network; operating the first customer premises device to prompt a user to indicate whether the additional new device should be registered as corresponding to the first customer account; and operating the first customer premises device to take action based on user input received in response to said prompt. ### Claim 6 (depends on 5) The method of claim 5, wherein taking action based on user input received in response to said prompt includes: determining from user input that the customer does not want to register the additional new device with the first customer account; and adding the additional new device to a list of detected devices that the customer does not want to add to a list of registered devices corresponding to the first customer account. ### Claim 7 (depends on 5) The method of claim 5, wherein taking action based on user input received in response to said prompt includes: determining from user input that the customer wants to register the additional new device with the first customer account; and operating the first customer premises device to communicate a registration request including information corresponding to the additional new device to the network device requesting registration for the additional new device. ### Claim 8 (depends on 7) The method of claim 7, wherein taking action based on user input received in response to said prompt further includes: operating the first customer premises device to receive security information intended for said additional new device from said network device; and operating the first customer premises device to provide said security information intended for said additional new device to said additional new device to thereby create a security association between said network device and said new additional device. ### Claim 9 (depends on 1) The method of claim 1, further comprising: prior to the first customer premises device detecting said second device, creating, at the first customer premises device, said security association between said first customer premises device and said network device based on at least one of: i) first device identification information and information indicating that the first customer premises device is authorized to be used with the first customer account corresponding to the first customer premises or ii) account identification information and authentication information provided by said first customer premises device to the network device. ### Claim 10 (depends on 1) The method of claim 1, wherein checking to determine whether a new device was detected on the local customer premises network includes: checking, at the first customer premises device, a list of known previously detected devices to determine if a detected device is new, a new device being a detected device which is not included on the list of known previously detected devices. ### Claim 11 (depends on 1) The method of claim 1, wherein the first customer premises device is a device that was configured for service based on a MAC address without requiring user input for authentication or account identification purposes. ### Claim 12 (depends on 11) The method of claim 11, wherein the first customer premises device is a set top box. ### Claim 13 (depends on 1) The method of claim 1, wherein the first customer premises device is a device which is registered and associated with the first customer account based on information supplied by a user of the first customer premises device and security information in the form of a password supplied by a user of the first customer premises device. ### Claim 14 A communications system, comprising: a first customer premises device, having a security association with a network device, said first customer premises device including a first processor configured to control the first customer premises device to: monitor to detect one or more new devices on a local customer premises network, said first customer premises device being located on said local customer premises network; check, at the first customer premises device, to determine whether a new device was detected on the local customer premises network; in response to said checking determining that a new device was detected on the local customer premises network, check with the network device whether the new device is already registered, said new device being a second device that does not have a security association with the network device; receive security information intended for said second device from said network device; and provide said security information to said second device to thereby create a security association between said network device and said second device; and said network device, said network device including a second processor configured to control the network device to: update a first customer record, in which the first customer premises device is associated with a first customer account, to associate said second device with the first customer account. ### Claim 15 (depends on 14) The system of claim 14, wherein the first processor is configured, as part of being configured to control the first customer premises device to monitor to detect one or more new devices on a local customer premises network, to monitor the local customer premises network for a signal communicating a device identifier of a device which was not previously on the local customer premises network; wherein said local customer premises network is located at the first customer premises; and wherein said network device is located outside said first customer premises. ### Claim 16 (depends on 14) The system of claim 14, wherein said first customer premises device is associated in a first customer record with a first customer account, said first customer account corresponding to a first customer premises where said first customer premises device and said local customer premises network are located. ### Claim 17 (depends on 16) The system of claim 16, wherein said first processor of the first customer premises device is further configured to control the first customer premises device to create said security association between said first customer premises device and said network device based on at least one of: i) first device identification information and information indicating that the first customer premises device is authorized to be used with the first customer account corresponding to the first customer premises or ii) account identification information and authentication information provided by said first customer premises device to the network device. ### Claim 18 (depends on 16) The system of claim 16, wherein the first processor of the first customer premises device is further configured to control the first customer premises device to add the second device to a list of registered devices which the first customer premises device knows are attached to the local customer premises network. ### Claim 19 (depends on 18) The system of claim 18, wherein the first processor of the first customer premises device is further configured to control the first customer premises device to: detect an additional new device on the local customer premises network; prompt a user to indicate whether the additional new device should be registered as corresponding to the first customer account; and take an action based on user input received in response to said prompt. ### Claim 20 (depends on 19) The system of claim 19, wherein the first processor of the first customer premises device is further configured to control the first customer premises device to: determine from user input received in response to said prompt if the user wants the additional new device to be registered as corresponding to the first customer account or does not want the additional new device to be registered as corresponding to the first customer account. ### Claim 21 (depends on 19) The system of claim 19, wherein the first processor of the first customer premises device is further configured to control the first customer premises device to: add the additional new device to a list of detected devices which are not to be registered as corresponding to the first customer account in response to determining that the user does not want the additional new device to be registered as corresponding to the first customer account. ### Claim 22 (depends on 19) The system of claim 19, wherein the first processor of the first customer premises device is further configured to control the first customer premises device to: communicate a registration request including information corresponding to the additional new device to the network device requesting registration for the additional new device in response to determining that the user wants the additional new device to be registered as corresponding to the first customer account. ### Claim 23 (depends on 22) The system of claim 22, wherein the first processor of the first customer premises device is further configured to control the first customer premises device to: receive from the network device security information and an IP address to be used by said new additional device; and forward the received security information and IP address to the new additional device. ### Claim 24 (depends on 14) The communications system of claim 14, wherein the first processor is configured to control the first customer premises device, as part of checking to determine whether a new device was detected on the local customer premises network, to check a list of known previously detected devices to determine if a detected device is new, a new device being a detected device which is not included on the list of known previously detected devices. ### Claim 25 (depends on 14) The communications system of claim 14, wherein the first customer premises device is a device that was configured for service based on a MAC address without requiring user input for authentication or account identification purposes. ### Claim 26 (depends on 14) The communications system of claim 14, wherein the first customer premises device is a device which is registered and associated with the first customer account based on information supplied by a user of the first customer premises device and security information in the form of a password supplied by a user of the first customer premises device. ### Claim 27 A non-transitory computer readable medium including machine executable instructions which when executed by a processor of a first customer premises device, which has a security association with a network device, causes the processor to control the first customer premises device to: monitor to detect one or more new devices on a local customer premises network, said first customer premises device being located on said local customer premises network; check, at the first customer premises device, to determine whether a new device was detected on the local customer premises network; in response to said checking determining that a new device was detected on the local customer premises network, check with the network device whether the new device is already registered, said new device being a second device that does not have a security association with the network device; receive security information intended for said second device from said network device; and provide said security information to said second device to thereby create a security association between said network device and said second device.