# US 2018/0324183 A1 · Methods and apparatus for provisioning services which require a device to be securely associated with an account > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0324183 A1 - Document ID: US20180324183A1 - Status: Published application - Kind: A1 - Application number: 16/036,892 - Filed: 2018-07-16 - Published: 2018-11-08 - Earliest claimed: 2014-11-12 - Assignees: Time Warner Cable Enterprises LLC - Applicants: Time Warner Cable Enterprises LLC - Inventors: Albert William Straub; Miles Anton Johnson - Web page: https://patentgrep.com/patent/US20180324183A1 ## CPC - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - G06F 21/44: Program or device authentication - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04W 12/35: {Protecting application or service provisioning, e.g. securing SIM application provisioning} - G06F 2221/2129: Authenticate client device independently of the user - H04L 41/28: Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04W 12/43: using shared identity modules, e.g. SIM sharing - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Methods and apparatus for provisioning and providing services to devices on a local network are described. The methods and apparatus allow for the provisioning of services to customer owned and managed devices on a local network on which another device, e.g., a first device, has already been authenticated and authorized to receive services corresponding to a customer account. After a first device on a local network is authenticated and associated with a customer account it detects the addition of new devices on the local network and assists in the registration of the new device by acting as an intermediary with a service provider device during the registration process. The security and registration established by the first device is leveraged allowing other devices on the network to be registered and authenticated for services corresponding to the same account as the first device without requiring user input of authentication and/or other information. ## Claims ### Claim 1 A communications method, the method comprising: operating a first customer premise device, having a security association with a network device, to detect a second device on a local customer premise network on which said first customer premise device is located, said second device not having a security association with the network device; operating the first customer premise device to communicate information regarding said second device to said network device; operating the first customer premise device to receive security information intended for said second device from said network device; operating the network device to update a first customer record, in which the first customer premise device is associated with a first customer account, to associate said second device with the first customer account; and operating the first customer premise device to provide said security information to said second device to thereby create a security association between said network device and said second device. ### Claim 2 (depends on 1) The method of claim 1, wherein said local customer premise network is located at a first customer premises; and wherein said network device is located outside said first customer premises. ### Claim 3 (depends on 1) The method of claim 1, wherein said first customer account corresponds to a first customer premise where said first customer premise device and said local customer premise network are located; and wherein operating the network device to update a first customer record, in which the first customer premise device is associated with a first customer account, to associate said second device with the first customer account includes indicating in the first customer record that the second device, in addition to the first customer premise device, is entitled to receive services corresponding to the first customer account in accordance with a contract between a first customer and a service provider. ### Claim 4 (depends on 1) The method of claim 1, further comprising: prior to operating the first customer premise device to detect said second device, creating said security association between said first customer premise device and said network device based on at least one of: i) first device identification information and information indicating that the first customer premise device is authorized to be used with the first customer account corresponding to the first customer premise (e.g. as in the case where a particular device is leased or provided by the service provider who also operates the network device) or ii) based on account identification information and authentication information provided by said first customer premise device to the network device. ### Claim 5 (depends on 3) The method of claim 3, further comprising: operating the first customer premise device to add the second device to a list of registered devices which the first customer premise device knows are attached to the local customer premise network. ### Claim 6 (depends on 5) The method of claim 5, further comprising: operating the first customer premise device to detect an additional new device on the local customer premise network; operating the first customer premise device to prompt a user to indicate that the additional new device should be registered as corresponding to the first customer account; and operating the first customer premise device to take action based on user input received in response to said prompt. ### Claim 7 (depends on 6) The method of claim 6, wherein taking action based on user input received in response to said prompt includes: determining from user input that the customer does not want to register the additional new device with the first customer account; and adding the additional new device to a list of detected devices that the customer does not want to add to a list of registered devices corresponding to the first customer account. ### Claim 8 (depends on 6) The method of claim 6, wherein taking action based on user input received in response to said prompt includes: determining from user input that the customer wants to register the additional new device with the first customer account; and operating the first customer premise device to communicate a registration request including information corresponding to the additional new device to the network device requesting registration for the additional new device. ### Claim 9 (depends on 8) The method of claim 8, wherein taking action based on user input received in response to said prompt further includes: operating the first customer premise device to receive security information intended for said additional new device from said network device; and operating the first customer premise device to provide said security information intended for said additional new device to said additional new device to thereby create a security association between said network device and said new additional device. ### Claim 10 A communications system, comprising: a first customer premise device, having a security association with a network device, including a processor configured to: detect a second device on a local customer premise network on which said first customer premise device is located, said second device not having a security association with the network device; communicate information regarding said second device to said network device; receive security information intended for said second device from said network device; and provide said security information to said second device to thereby create a security association between said network device and said second device; and said network device, said network device including a processor configured to: update a first customer record, in which the first customer premise device is associated with a first customer account, to associate said second device with the first customer account. ### Claim 11 (depends on 10) The system of claim 10, wherein said local customer premise network is located at a first customer premises; and wherein said network device is located outside said first customer premises. ### Claim 12 (depends on 10) The system of claim 10, wherein said first customer premise device is associated in a first customer record with a first customer account, said first customer account corresponding to a first customer premise where said first customer premise device and said local customer premise network are located, system further comprising: said network device, said network device including a processor configured to update the first customer record to associate said second device with said first customer account. ### Claim 13 (depends on 12) The system of claim 12, wherein said processor of the first customer premise device is configured to create said security association between said first customer premise device and said network device based on at least one of: i) first device identification information and information indicating that the first customer premise device is authorized to be used with the first customer account corresponding to the first customer premise or ii) based on account identification information and authentication information provided by said first customer premise device to the network device. ### Claim 14 (depends on 12) The system of claim 12, wherein the processor of the first customer premise device is further configured to add the second device to a list of registered devices which the first customer premise device knows are attached to the local customer premise network. ### Claim 15 (depends on 14) The system of claim 14, wherein the processor of the first customer premise device is further configured to: detect an additional new device on the local customer premise network; prompt a user to indicate that the additional new device should be registered as corresponding to the first customer account; and take an action based on user input received in response to said prompt. ### Claim 16 (depends on 15) The system of claim 15, wherein the processor of the first customer premise device is further configured to: determine from user input received in response to said prompt if the user wants the additional new device to be registered as corresponding to the first customer account or does not want the additional new device to be registered as corresponding to the first customer account. ### Claim 17 (depends on 15) The system of claim 15, wherein the processor of the first customer premise device is further configured to: add the additional new device to a list of detected devices which are not to be registered as corresponding to the first customer account in response to determining that the user does not want the additional new device to be registered as corresponding to the first customer account. ### Claim 18 (depends on 15) The method of claim 15, wherein the processor of the first customer premise device is further configured to: communicate a registration request including information corresponding to the additional new device to the network device requesting registration for the additional new device in response to determining that the user wants the additional new device to be registered as corresponding to the first customer account. ### Claim 19 (depends on 19) The method of claim 19, wherein the processor of the first customer premise device is further configured to: receive from the network device security information and an IP address to be used by said new additional device; and forward the received security information and IP address to the new additional device. ### Claim 20 A non-transitory computer readable medium including machine executable instructions which when executed by a processor of a first customer premise device, which has a security association with a network device, causes the processor to control the first customer premise device to: detect a second device on a local customer premise network on which said first customer premise device is located, said second device not having a security association with the network device; communicate information regarding said second device to said network device; receive security information intended for said second device from said network device; and provide said security information to said second device to thereby create a security association between said network device and said second device.