Apparatus and methods for device authorization in a premises network
Apparatus and methods for enabling protected premises networking capabilities. In one embodiment, a white list of devices authorized to access a premises network and a black list of device not authorized to access a premises network are utilized. The black and white lists may be stored at a database in communication with an authorization manager or may be stored at the manager itself. When a client device is connected to a premise, the manager determines, based on the premises and/or device identity, whether the device is entitled to access. The authorization manager makes this determination based on whether the device is on the white or black list. If the device is on neither list, the manager may add the device to the white list upon appropriate verification. The manager may also facilitate removal of a device from the white list to the black list upon request or automatically.
1. Computer readable apparatus comprising a non-transitory storage medium, said non-transitory storage medium comprising at least one computer program having a plurality of instructions, said plurality of instructions configured to, when executed on a processing apparatus:
receive data representative of a request for access to at least one premises network from at least one computerized client device;
evaluate a list of authorized devices and a list of unauthorized devices;
grant or deny said request for said access to said at least one premises network to said at least one computerized client device based at least in part on a result of said evaluation; and
when said request is granted:
generate, at a computerized entity of a content distribution network, an identifier configured to allow said at least one computerized client device to access said at least one premises network; and
deliver said identifier to said at least one computerized client device;
wherein said identifier is further configured to enable said at least one computerized client device to share, via said at least one premises network, digitally rendered content with one or more other computerized client devices based at least on said identifier being provided to said one or more other computerized client devices.
2. The computer readable apparatus of claim 1 , wherein said plurality of instructions are further configured to, when executed on said processing apparatus, enable an addition of said at least one computerized client device to either list, said enablement based at least on said evaluation indicative of said at least one computerized client device not being on either said list of authorized devices or said list of unauthorized devices.
3. The computer readable apparatus of claim 2 , wherein said addition of at least one computerized client device to either of said list of authorized devices or said list of unauthorized devices comprises addition of descriptive information regarding said at least one computerized client device to said list of authorized devices or said list of unauthorized devices.
4. The computer readable apparatus of claim 3 , wherein said addition of said descriptive information regarding said at least one computerized client device to either of said list of authorized devices or said list of unauthorized devices comprises verification of said descriptive information against pre-stored information.
5. The computerized apparatus of claim 1 , wherein said generation of said identifier is based at least in part on information identifying said at least one premises network.
6. The computerized apparatus of claim 5 , wherein said at least one identifier corresponding to said at least one computerized client device comprises a password.
7. Computerized apparatus for provision of access to a premises network, comprising:
processor apparatus;
network interface apparatus in data communication with said processor apparatus; and
storage apparatus in data communication with said processor apparatus, said storage apparatus comprising at least one computer program configured to, when executed on said processor apparatus:
receive at least one identifier corresponding to at least one computerized client device and at least one identifier corresponding to at least one premises network;
receive data representative of a request for access to said at least one premises network from said at least one computerized client device;
search one or more lists of identifiers corresponding to individual ones of a plurality of computerized client devices for said at least one identifier corresponding to said at least one computerized client device, said one or more lists identifying said individual ones of said plurality of computerized client devices as being authorized or unauthorized to receive access to said at least one premises network;
based at least in part on said search, grant or deny access to said at least one premises network to said at least one computerized client device; and
when said access is granted, form a trusted domain (TD) for said at least one computerized client device, said TD configured to maintain at least one security policy within said at least one computerized client device and one or more other computerized client devices in data communication with said at least one computerized client device via said at least one premises network.
8. The computerized apparatus of claim 7 , wherein
said computerized apparatus comprises a headend entity of a content delivery network; and wherein said computerized apparatus further comprises:
an interface configured to enable data communication with said at least one computerized client device and said one or more other computerized client devices via said content delivery network.
9. The computerized apparatus of claim 7 , wherein:
said one or more lists comprise a list of identifiers corresponding to authorized devices; and
said at least one computerized client device is granted access via an addition of said at least one identifier corresponding to said at least one computerized client device on said list of identifiers corresponding to said authorized devices.
10. The computerized apparatus of claim 7 , wherein said storage apparatus is configured to store said one or more lists of identifiers.
11. The computerized apparatus of claim 7 , wherein said at least one computer program is further configured to, when executed on said processor apparatus:
communicate with a remotely disposed storage entity, said remotely disposed storage entity configured to store said one or more lists of identifiers corresponding to said individual ones of said plurality of computerized client devices.
12. The computerized apparatus of claim 7 , wherein:
said computerized apparatus comprises a headend entity selected from the group consisting of: (i) a cable television network and (ii) a satellite network; and
said at least one premises network comprises a Multimedia Over Coax Alliance (MoCA)-compliant coaxial cable network.
13. The computerized apparatus of claim 7 , wherein said at least one computer program is further configured to, when executed on said processor apparatus: revoke access to said at least one premises network for at least one of said one or more other client devices.
14. The computerized apparatus of claim 13 , wherein said revocation of said access comprises utilization of an algorithm to evaluate said one or more lists of identifiers for one or more identifiers corresponding to devices exhibiting at least one predefined suspicious or prohibited behavior.
15. The computerized apparatus of claim 7 , wherein said at least one computer program is further configured to, when executed on said processor apparatus: (i) cause display at said at least one computerized client device of information descriptive of said one or more other computerized client devices, and (ii) enable a user of said at least one computerized client device to revoke access to said at least one premises network for said one or more other computerized client devices.
16. Computerized apparatus for control of access to a premises network, said computerized apparatus comprising:
processor apparatus;
network interface apparatus in data communication with said processor apparatus; and
storage apparatus in data communication with said processor apparatus, said storage apparatus comprising at least one computer program configured to, when executed on said processor apparatus:
authorize a plurality of computerized client devices to access said premises network; and
revoke access to said premises network for at least one of said plurality of computerized client devices, said at least one of said plurality of computerized client devices identified via use of at least one cryptographic hash of at least one unique identifier respectively associated with said at least one of said plurality of computerized client devices.
17. The computerized apparatus of claim 16 , wherein
said computerized apparatus comprises a headend entity of a managed content delivery network, said managed content delivery network configured to provide digitally rendered content to said plurality of computerized client devices using one or more Internet Protocol (IP)-based transports; and wherein said computerized apparatus further comprises:
a data interface configured to enable data communication with said plurality of computerized client devices via said managed content delivery network.
18. The computerized apparatus of claim 16 , wherein said authorization of said plurality of computerized client devices comprises placement of said one or more unique identifiers respectively associated with individual ones of said plurality of computerized client devices into a list of authorized devices.
19. The computerized apparatus of claim 18 , wherein said at least one unique identifier comprises at least one Media Access Control (MAC) address respectively associated with said at least one of said plurality of computerized client devices.
20. The computerized apparatus of claim 16 , wherein said premises network comprises a Multimedia Over Coax Alliance (MoCA)-compliant network comprising installed coaxial cable within a premises, and said computerized apparatus is disposed at a headend of a cable or satellite network configured to deliver digitally rendered content to said one or more computerized client devices within said premises network.
21. The computerized apparatus of claim 16 , wherein said revocation initiated via a request, from a computerized client device of an authorized user of said premises network, to revoke said access, and said at least one computer program is further configured to, when executed on said processor apparatus: add data identifying said at least one of said plurality of computerized client devices into a data structure associated with unauthorized devices.