Method and system for in-field recovery of security when a certificate authority has been compromised

1. A computer-implemented method, comprising:

identifying an update to security information used by a plurality of customer premise equipment network access devices;

generating a plurality of configuration files for distribution to respective customer premise equipment network access devices responsive to the update;

including certificate credential information within the configuration files, wherein the certificate credential information is encrypted or signed using a plurality of device private keys respectively associated with each of the customer premise equipment network access devices; and

sending a particular configuration file from the plurality configuration files over a service operator network to a particular customer premise equipment network access device from the plurality of customer premise equipment network access devices in response to the particular customer premise equipment network access device attempting to join the service operator network, the particular configuration file being a configuration file from the plurality of configuration files which uses the certificate credential information encrypted or signed using a device private key associated with the particular customer premise equipment network access device to which the particular configuration file is being sent.

2. The computer-implemented method of claim 1 , wherein the plurality of customer premise equipment network access devices comprise one of cable modems or digital subscriber line modems.

3. The computer-implemented method of claim 1 , wherein a manufacturing certificate authority retrieves the device private key associated with the customer premise equipment network access devices from a secure database for storing the plurality of device private keys.

4. The computer-implemented method of claim 1 , further comprising:

adding a reissued code verification certificate and manufacturer certificate renewal credential information to the plurality of configuration files, the reissued code verification certificate being operable to be used to verify the authenticity of a reissued root certificate based on the manufacturer certificate renewal credential information, thereby causing the customer premise equipment network access devices to download a new software image from a server based upon the authenticity of the reissued root certificate.

5. The computer-implemented method of claim 2 , wherein cable modems include telephony and data modems.

6. The computer-implemented method of claim 4 , wherein the new software image contains a manufacturer certificate.

7. The computer-implemented method of claim 4 , further comprising:

rebooting the particular customer premise equipment network access device using the new software image;

downloading a reissued device certificate;

verifying the reissued device certificate using a new manufacturer certificate contained in the new software image; and

storing the reissued device certificate into a memory of the particular customer premise equipment network access device.

8. The computer-implemented method of claim 6 , wherein the new software image is securely downloaded.

9. The computer-implemented method of claim 7 , further comprising overwriting an existing device certificate from the memory of the particular customer premise equipment network access device.

10. The computer-implemented method of claim 8 , wherein a secure software download is used to securely download the new software image based on the reissued code verification certificate.

11. A computer-implemented method, comprising:

writing certificate credential information into a configuration file, wherein the certificate credential information is signed using a private device key uniquely associated with a particular network access device from among a plurality of network access devices;

sending the configuration file to the network access device in response to a request for the configuration file received during registration of the network access device with a service operator network;

verifying the configuration file at the network access device based on the credential information and signature; and

overwriting an existing device certificate stored in memory of the network access device.

12. The computer-implemented method of claim 11 , wherein the existing device certificate is overwritten with null data.

13. The computer-implemented method of claim 11 , further comprising:

downloading a new software image to the device from a server based on a server address contained in the configuration file, the new software image comprising an operating system code update.

14. The computer-implemented method of claim 11 , wherein the credential information includes manufacturer certificate renewal credential information.

15. The computer-implemented method of claim 11 , wherein the network access device comprises a cable modem or an embedded multimedia terminal adapter.

16. The computer-implemented method of claim 11 , wherein the network access device comprises a digital subscriber line modem.

17. The computer-implemented method of claim 13 , wherein the new software image includes a manufacturer certificate.

18. The computer-implemented method of claim 13 , wherein the new software image is securely downloaded using the certificate credential information from the configuration file.

19. The computer-implemented method of claim 17 , further comprising:

rebooting the network access device using the new software image;

determining that the existing device certificate has been overwritten;

downloading a new device certificate;

verifying the new device certificate using the new manufacturer certificate contained in the new software image; and

storing the new device certificate into a device memory.

20. The computer-implemented method of claim 18 , wherein a secure software download mechanism is used to securely download the new software image.