Method and apparatus for authentication and identity management of communicating devices

Patent metadata

Field	Value
Publication number	US-9820146-B2
Application number	US-201514737983-A
Country	US
Kind code	B2
Filing date	Jun 12, 2015
Priority date	Jun 12, 2015
Publication date	Nov 14, 2017
Grant date	Nov 14, 2017

Abstract

Aspects of the subject disclosure may include, for example, receiving, from a second waveguide system, electromagnetic waves at a physical interface of a transmission medium that propagate without utilizing an electrical return path where the electromagnetic waves are guided by the transmission medium and where the electromagnetic waves have a non-optical frequency range, and authenticating the second waveguide system according to an authentication protocol based on authentication information contained in the electromagnetic waves. Other embodiments are disclosed.

First claim

What is claimed is:

1. A first waveguide system comprising:
a processor; and
a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising:
receiving, from a second waveguide system, first electromagnetic waves at a physical interface of a transmission medium, wherein the first electromagnetic waves propagate on an outer surface of the transmission medium without requiring an electrical return path, wherein the first electromagnetic waves are guided by the transmission medium, and wherein the first electromagnetic waves have a non-optical frequency range; and
authenticating the second waveguide system according to an authentication protocol based on first authentication information conveyed by the first electromagnetic waves, wherein the second waveguide system is an adjacent communication node to the first waveguide system in a wired network, and wherein the authentication protocol comprises a peer-to-peer handshake protocol.

2. The first waveguide system of claim 1 , wherein the processor comprises a plurality of processors operating in a distributed processing environment and the operations further comprise:
responsive to a successful first authentication of the second waveguide system, storing a first authentication token in the memory, wherein the first authentication token expires after a first time period.

3. The first waveguide system of claim 2 , wherein the operations further comprise:
determining an expiration of the first time period of the first authentication token;
receiving, from the second waveguide system, second electromagnetic waves at the physical interface of the transmission medium that propagate without requiring the electrical return path, wherein the second electromagnetic waves are guided by the transmission medium, and wherein the second electromagnetic waves have the non-optical frequency range;
responsive to the expiration of the first time period, performing a second authentication of the second waveguide system according to the authentication protocol based on second authentication information conveyed by the second electromagnetic waves; and
responsive to the second authentication of the second waveguide system being successful, storing a second authentication token in the memory, wherein the second authentication token expires after a second time period.

4. The first waveguide system of claim 1 , wherein the wired network comprises power lines.

5. The first waveguide system of claim 1 , wherein the first waveguide system operates as an edge element and wherein the second waveguide system operates as a non-edge element.

6. The first waveguide system of claim 1 , wherein the operations further comprise:
responsive to a successful first authentication of the second waveguide system, providing a notification to a network server indicating the successful first authentication.

7. The first waveguide system of claim 1 , wherein the operations further comprise:
accessing topology information associated with a network path along the wired network comprising power lines, and wherein the authenticating of the second waveguide system includes validating a location of the second waveguide system along the network path according to the topology information.

8. The first waveguide system of claim 1 , wherein the operations further comprise:
accessing a network modification request associated with a network path along the wired network comprising power lines, and wherein the authenticating of the second waveguide system includes validating a deployment of the second waveguide system along the network path according to the network modification request.

9. The first waveguide system of claim 1 , wherein the operations further comprise:
accessing inventory information associated with a network path along the wired network comprising power lines, and wherein the authenticating of the second waveguide system includes validating a deployment of the second waveguide system along the network path according to an identification included in the inventory information.

10. A method comprising:
determining, by a first waveguide system, that a second waveguide system is positioned between the first waveguide system and a third waveguide system in a network comprising a plurality of waveguide systems, wherein operations of the plurality of waveguide systems comprise receiving electromagnetic waves at a physical interface of a transmission medium, wherein the electromagnetic waves propagate on an outer surface of the transmission medium without requiring an electrical return path, wherein the electromagnetic waves are bound to the transmission medium, and wherein the electromagnetic waves have a non-optical frequency range; and
communicating, by the first waveguide system with the third waveguide system, to perform a mutual authentication, wherein the mutual authentication validates that the first and third waveguide systems are adjacent communication nodes to the second waveguide system.

11. The method of claim 10 , further comprising:
storing, by the first waveguide system, an authentication token corresponding to a first authentication of the second waveguide system by the first waveguide system, wherein the authentication token expires after a time period.

12. The method of claim 11 , wherein the first waveguide system is a root node for a group of non-edge elements and a group of terminal nodes in the network, the group of non-edge elements comprising waveguide systems of the plurality of waveguide systems, the group of terminal nodes comprising customer premises equipment, wherein the second and third waveguide systems are non-edge elements of the group of non-edge elements, and wherein the first authentication performed between the first and second waveguide systems comprises:
receiving, by the first waveguide system from the second waveguide system, identification information and an encryption key;
accessing topology information for the network; and
validating an identity and a location of the second waveguide system according to the identification information, the encryption key, and the topology information.

13. The method of claim 12 , further comprising providing a topology message to a network server responsive to the validating of the identity and the location of the second waveguide system, wherein the topology message validates the topology information stored by the network server.

14. The method of claim 11 , wherein the determining that the second waveguide system is positioned between the first waveguide system and the third waveguide system is based on a fingerprint analysis of received electromagnetic waves from the second waveguide system, topology information received from a network server, or a combination thereof, and further comprising:
monitoring the time period of the authentication token; and
responsive to an expiration of the time period, communicating, by the first waveguide system with the second waveguide system, to perform a second authentication of the second waveguide system.

15. A machine-readable storage device comprising instructions, which when executed by a processor cause the processor to perform operations comprising:
detecting that a first network device is operating in a network comprising a plurality of network devices;
determining a type of the first network device; and
responsive to a determination that the type of the first network device is an edge element, validating a deployment of the first network device by:
accessing an inventory database,
based on a search of th

Assignees

• At & T Ip I Lp
• At & T Ip I Lp

Inventors

• Gross David
• Lackey Joshua
• Levy Donald E
• Piqueras Jover Roger
• Ramachandran Jayaraman
• Serban Cristina

Classifications

• H04L63/0846

  using time-dependent-passwords, e.g. periodically changing passwords · CPC title

• H04L63/0869

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title

• H04B3/52 Primary

  Systems for transmission between fixed stations via waveguides · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• Y04S40/20

  Information technology specific aspects, e.g. CAD, simulation, modelling, system security · CPC title