Title of Invention: APPARATUS AND METHODS FOR DEVICE AUTHORIZATION IN A PREMISES NETWORK Abstract: Apparatus and methods for enabling protected premises networking capabilities. In one embodiment, a white list of devices authorized to access a premises network and a black list of device riot authorized to access a premises network are utilized. The black and white lists may be stored at a database in communication with an authorization manager or may be stored at the manager itself. When a client device is connected to a premise, the manager determines, based on the premises and/or device identity, whether the device is entitled to access. The authorization manager makes this determination based on whether the device is on the white or black list. If the device is on neither list, the manager may add the device to the white list upon appropriate verification. The manager may also facilitate removal of a device from the white list to the black list upon request or automatically. Detailed Description: RELATED APPLICATIONS This application is related to co-owned and co-pending U.S. application Ser. No. 12/______ filed contemporaneously herewith on Nov. 2, 2009 and entitled “Protected Premises Network Apparatus and Methods”, incorporated herein by reference in its entirety. COPYRIGHT A portion of the disclosure of this patent document contains material that is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all copyright rights whatsoever. BACKGROUND OF THE INVENTION 1. Field of Invention The present invention relates generally to the field of content and/or data delivery over a network. More particularly, the present invention is related to apparatus and methods for ensuring the distribution of programming content, media, data and other information services to only authorized devices within user premises (e.g., residence, enterprise, etc.) network. 2. Description of Related Technology Recent advances in digital information processing have made a range of services and functions available for delivery to consumers at their premises for very reasonable prices or subscription fees. These services and functions include digital broadcast programming (movies, etc.), digital video-on-demand (VOD), personal video recorder (PVR), Internet Protocol television (IPTV), digital media playback and recording, as well high speed internet access and IP-based telephony (e.g., VoIP). Other services available to network users include access to and recording of digital music (e.g., MP3 files), as well local area networking (including wire-line and wireless local area networks) for distributing these services throughout the user's premises, and beyond. Currently, in the context of content delivery networks such as cable and satellite networks, many of these services are provided and delivered to the user via a variety of different equipment environments including, inter alia, cable modems and computers, set-top boxes, digital video recorders (DVRs), PSTNs, cellular telephones/smartphones, PDAs, and portable digital music devices such as the Apple iPod™. Additionally, the services associated with such technology are typically provided by multiple vendors including e.g., a cable or satellite service provider (e.g., MSO), cellular service provider (CSP), wireless service provider (WSP), VoIP service provider, music download service, Internet service provider (ISP), PSTN telephone service, etc. Many of the aforementioned services may be provided to users using Internet protocol (IP) based mechanisms. These mechanisms may comply with open consumer electronics (CE) industry standards such as, inter alia, Universal Plug and Play (UpnP), Consumer Electronics Association (CEA) 2014, Digital Living Network Alliance (DLNA), and Multimedia over Coax Alliance (MoCA), which allow devices to connect seamlessly and to simplify the implementation of networks in a premises (data sharing, communications, and entertainment). Within a content delivery network, there has been an appreciable increase in the use of devices having IP based content and data delivery capabilities, including retail devices or devices which are not particularly owned or managed by an MSO delivering the content and/or data. Still further, IP based delivery mechanisms are often susceptible to non-consumer devices or nomadic IP devices surreptitiously gaining access to services. Current methods for providing secure content delivery are only available for devices which have been leased to the user from the network operator (e.g., MSO). There are currently no mechanisms for controlling access to content at customer retail devices via a premises network (e.g., limiting access only to the devices of authorized subscribers of the MSO, whether leased or retail devices). Accordingly, there is a need for methods and apparatus to protect video and data services on a premises network from being accessed by unauthorized devices, whether they be MSO-provided or leased, or retail. Specifically, methods and apparatus are needed for ensuring that only authorized devices gain access to services, and that unauthorized devices are detected quickly and efficiently and prevented. Exemplary methods and apparatus would additionally provide a mechanism to revoke a device's ability to access content. SUMMARY OF THE INVENTION The present invention satisfies the foregoing needs by providing, inter alia, improved apparatus and methods for device authorization in a premises network. In a first aspect of the invention, an apparatus for limiting access to a premises network is disclosed. In one embodiment, the apparatus comprises at least one first interface, at least one second interface, a storage apparatus, and a processor configured to run one or more computer applications thereon. At least one of the one or more computer applications comprises an application for authorizing a plurality of client devices to access the premises network and at least one other one of the one or more computer applications comprises an application for revoking access to the premises network by identified ones of the plurality of client devices. In one variant, the apparatus comprises a headend entity of the content delivery network, the first interface comprises an interface to the content delivery network by which the apparatus may interface with the plurality of client devices, and the second interface comprises an interface to a plurality of apparatus at a headend of the content delivery network. In another variant, the plurality of client devices are authorized by placing a unique identifier associated with individual ones of the plurality of client devices into a list of authorized devices. The unique identifier may comprise at least one of a MAC address or an IP address. The list of authorized devices may further comprise an identifier associated with the premises network. In another variant, access to the premises network by the identified ones of the plurality of client devices comprises placing a unique identifier associated with the identified ones of the plurality of client devices onto a list of unauthorized devices, and the unique identifiers associated with the identified ones of the plurality of client devices are placed on the list of unauthorized devices by an authorized user of the premises network. In yet another variant, the storage apparatus is configured to store at least a plurality of information regarding individual ones of the plurality of client devices authorized and not authorized to access the premises network. In another variant, the apparatus is further configured to communicate with a database for storing at least a plurality of information regarding individual ones of the plurality of client devices authorized and not authorized to access the premises network. In still another variant, the content delivery network comprises a cable television or satellite network, the premises network comprises a MoCA-compliant network comprising installed coaxial cable within the premises, and the apparatus is disposed at a headend of the cable or satellite network. In yet another variant, the content delivery network is utilized to provide content to the plurality of client devices using internet protocol (IP)-based delivery mechanisms. In a second aspect of the invention, a consumer premises equipment (CPE) for use in a content delivery network (e.g., cable network) is disclosed. In one embodiment, the CPE comprises an RF front-end interface, at least one back-end interface, a storage apparatus, and a processor configured to run at least one application thereon, the application configured to: authorize first ones of a plurality of client devices to access a premises network, and revoke access to the premises network by second ones of the plurality of client devices. In one variant, the at least one back end interface comprises an interface to the plurality of client devices in the premises network. In another variant, the storage apparatus comprises one or more databases having information relating to individual ones of the plurality of client devices being authorized and not authorized to access the premises network. The authorization of the first ones of the plurality of client devices may comprise reviewing the one or more databases for the first ones of the client devices and determining based at least in part on the information, that the first ones of the plurality of client devices are authorized to access the premises network. The revocation of the second ones of the plurality of client devices may comprise adding information relating to the second ones of the client devices to the one or more databases, the added information indicating that the second ones of the plurality of client devices are not authorized to access the premises network. In yet another variant, the CPE is further in communication with at least one database comprising a list of client devices which are authorized to access the premises network, and a list of client devices which are not authorized to access the premises network, the authorization comprises searching the at least one database to determine on which of the lists the first ones of the plurality of client devices are listed, and the revocation comprises adding the second ones of the plurality of client devices to the list of client devices which are not authorized to access the premises network. In a further variant, the at least one application comprises a distributed application, having at least one component thereof run at a headend entity of the cable network. The premises network may comprise a MoCA-compliant premises network. Lastly, in one variant, content is delivered to the CPE from the content delivery network via IP protocol. In a third aspect of the invention, method of providing access to a premises network is disclosed. In one embodiment, the method comprises receiving information identifying at least one client device and at least one premises network, updating one or more lists of devices to include the entered information, receiving a request for access to the at least one premises network from the at least one client device connected thereto, and in response to the request, granting or denying access to the at least one premises network to the at least one client device. In one variant, the information identifying the at least one client device comprises a MAC address associated with the at least one client device; and the information identifying the at least one premises network comprises a subscriber account number, and the act of updating comprises adding the MAC address and the subscriber account number one of the one or more lists. The request may comprise at least the MAC address associated with the at least one client device and the subscriber account number. In another variant, the one or more lists comprising at least a white list of authorized devices, and a black list of unauthorized devices. The method may further include searching the white list and the black list using at least the information identifying at least one client device and at least one premises network. The act of granting or denying access may be based at least in part on whether the at least one client device is found on the white or the black list. In yet another variant, the act of granting access to the at least one premises network comprises presenting the at least one client device a user interface for accessing data and content. The user interface for accessing data and content may comprise an electronic programming guide (EPG). In another variant, the act of denying access to the at least one premises network comprises presenting the at least one client device a message indicating a reason for the denial of access. In yet another variant, the act of updating further comprises apprising at least one headend billing entity of the addition of the at least one client device to the listing of authorized devices for the at least one premises network. In another variant, the method further comprises verifying the information identifying at least one client device and at least one premises network. In a further variant, the premises network comprises a MoCA-compliant home network. In a fourth aspect of the invention, computer readable apparatus comprising a medium configured to store a computer program is disclosed. In one embodiment, the computer program, when executed: receives a request for access to at least one premises network from at least one client device connected thereto, searches a list of authorized devices and a list of unauthorized devices, and grants or denies access to the at least one premises network to the at least one client device based at least in part on a result of the search. In one variant, the computer program is further configured to, if the at least one device is not found at either the list of authorized devices or the list of unauthorized devices, enable the user to add the at least one device to either list. The at least one device may be added to either of the list of authorized devices or the list of unauthorized devices by the addition of descriptive information regarding the at least one device the list of authorized devices or the list of unauthorized devices. In another variant, the computer program is further configured to, prior to receipt of the request, enable a user to add descriptive information regarding the at least one device to either of the list of authorized devices or the list of unauthorized devices. The addition of the descriptive information regarding the at least one device to either of the list of authorized devices or the list of unauthorized devices may comprise verification of the descriptive information against pre-stored information In a fifth aspect of the invention, a method of ensuring protected access to cable television network content to a MoCA-compliant premises network is disclosed. In one embodiment, the method comprises: receiving a request from a user device for access to the content from the premises network, determining whether the user device is specifically authorized to access the content via the premises network, if the user device is specifically authorized to access the content via the premises network, providing access thereto, the access to the content being provided via installed coaxial cable installed within the premises, if the user device is not specifically authorized to access the content via the premises network, determining whether the user device is specifically unauthorized to access the content via the premises network, if the user device is specifically unauthorized to access the content via the premises network, denying access thereto, and if the user device is not specifically authorized and not specifically unauthorized to access the content via the premises network: requesting a user of the user device provide a MAC address of the user device and a subscriber account number associated with the network premises, verifying the provided MAC address and the subscriber account number, and authorizing the user device to access the content via the network. In one variant, the act of determining whether the user device is specifically authorized to access the premises network comprises searching a list of authorized devices, and the act of determining whether the user device is specifically unauthorized to access the premises network comprises searching a list of unauthorized devices. Other features and advantages of the present invention will immediately be recognized by persons of ordinary skill in the art with reference to the attached drawings and detailed description of exemplary embodiments as described below. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a functional block diagram illustrating an exemplary HFC cable network configuration useful with the present invention. FIG. 1a is a functional block diagram illustrating one exemplary HFC cable network headend configuration useful with the present invention. FIG. 1b is a functional block diagram illustrating one exemplary local service node configuration useful with the present invention. FIG. 1c is a functional block diagram illustrating one exemplary broadcast switched architecture (BSA) network useful with the present invention. FIG. 1d is a functional block diagram illustrating one exemplary packetized content delivery network architecture useful with the present invention. FIG. 2 is a functional block diagram illustrating a first embodiment of a network architecture for providing device authorization in a premises network according to the present invention. FIG. 2a is a block diagram illustrating one embodiment of a white list and a black list for use in the present invention. FIG. 2b is a block diagram illustrating another embodiment of a white list and a black list for use in the present invention. FIG. 2c is a functional block diagram illustrating another embodiment of a network architecture for providing device authorization in a premises network according to the present invention. FIG. 3a is a logical flow diagram illustrating one embodiment of the method for authorizing a device in a protected premises network according to the invention. FIG. 3b is a logical flow diagram illustrating a second embodiment of the method for authorizing a device in a protected network according to the invention. FIG. 3c is a logical flow diagram illustrating a third embodiment of the method for authorizing a device in a protected network according to the invention. FIG. 4a is a logical flow diagram illustrating one embodiment of the method for revoking authorization of a device in a protected premises network according to the present invention. FIG. 4b is a logical flow diagram illustrating a second embodiment of the method for revoking authorization of a device in a protected network according to the present invention. FIG. 5 is a functional block diagram of one embodiment of an authorization manager for use in the present invention. FIG. 6 is a functional block diagram of one embodiment of a premises device for use in the present invention. FIG. 6a is a functional block diagram illustrating an exemplary NID for use in the present invention. DETAILED DESCRIPTION OF THE INVENTION Reference is now made to the drawings wherein like numerals refer to like parts throughout. As used herein, the term “application” refers generally to a unit of executable software that implements a certain functionality or theme. The themes of applications vary broadly across any number of disciplines and functions (such as on-demand content management, e-commerce transactions, brokerage transactions, home entertainment, calculator etc.), and one application may have more than one theme. The unit of executable software generally runs in a predetermined environment; for example, the unit could comprise a downloadable Java Xlet™ that runs within the JavaTV™ environment. As used herein, the terms “client device” and “end user device” include, but are not limited to, set-top boxes (e.g., DSTBs), personal computers (PCs), and minicomputers, whether desktop, laptop, or otherwise, and mobile devices such as handheld computers, PDAs, personal media devices (PMDs), such as for example an iPod™, or Motorola ROKR, and smartphones. As used herein, the term “codec” refers to an video, audio, or other data coding and/or decoding algorithm, process or apparatus including, without limitation, those of the MPEG (e.g., MPEG-1, MPEG-2, MPEG-4, etc.), Real (RealVideo, etc.), AC-3 (audio), DiVX, XViD/ViDX, Windows Media Video (e.g., WMV 7, 8, or 9), ATI Video codec, or VC-1 (SMPTE standard 421M) families. As used herein, the term “computer program” or “software” is meant to include any sequence or human or machine cognizable steps which perform a function. Such program may be rendered in virtually any programming language or environment including, for example, C/C++, Fortran, COBOL, PASCAL, assembly language, markup languages (e.g., HTML, SGML, XML, VoXML), and the like, as well as object-oriented environments such as the Common Object Request Broker Architecture (CORBA), Java™ (including J2ME, Java Beans, etc.), Binary Runtime Environment (e.g., BREW), and the like. The terms “Customer Premises Equipment (CPE)” and “host device” refer to any type of electronic equipment located within a customer's or user's premises and connected to a network. The term “host device” refers generally to a terminal device that has access to digital television content via a satellite, cable, or terrestrial network. The host device functionality may be integrated into a digital television (DTV) set. The term “customer premises equipment” (CPE) includes such electronic equipment such as set-top boxes (e.g., DSTBs), televisions, cable modems (CMs), embedded multimedia terminal adapters (eMTAs), whether stand-alone or integrated with other devices, Digital Video Recorders (DVR), gateway storage devices (e.g., Furnace), and ITV Personal Computers. As used herein, the term “display” means any type of device adapted to display information, including without limitation CRTs, LCDs, TFTs, plasma displays, LEDs, incandescent and fluorescent devices. Display devices may also include less dynamic devices such as, for example, printers, e-ink devices, and the like. As used herein, the term “DVR” (digital video recorder) refers generally to any type or recording mechanism and/or software environment whereby content sent over a network can be recorded and selectively recalled. Such DVR may be dedicated in nature, or part of a non-dedicated or multi-function system. As used herein, the term “DOCSIS” refers to any of the existing or planned variants of the Data Over Cable Services Interface Specification, including for example DOCSIS versions 1.0, 1.1, 2.0 and 3.0. DOCSIS (version 1.0) is a standard and protocol for internet access using a “digital” cable network. As used herein, the term “headend” refers generally to a networked system controlled by an operator (e.g., an MSO) that distributes programming to MSO clientele using client devices. Such programming may include literally any information source/receiver including, inter alia, free-to-air TV channels, pay TV channels, interactive TV, and the Internet. As used herein, the terms “Internet” and “internet” are used interchangeably to refer to inter-networks including, without limitation, the Internet. As used herein, the terms “microprocessor” and “digital processor” are meant generally to include all types of digital processing devices including, without limitation, digital signal processors (DSPs), reduced instruction set computers (RISC), general-purpose (CISC) processors, microprocessors, gate arrays (e.g., FPGAs), PLDs, reconfigurable compute fabrics (RCFs), array processors, secure microprocessors, and application-specific integrated circuits (ASICs). Such digital processors may be contained on a single unitary IC die, or distributed across multiple components. As used herein, the terms “MSO” or “multiple systems operator” refer to a cable, satellite, or terrestrial network provider having infrastructure required to deliver services including programming and data over those mediums. As used herein, the terms “network” and “bearer network” refer generally to any type of telecommunications or data network including, without limitation, hybrid fiber coax (HFC) networks, satellite networks, telco networks, and data networks (including MANs, WANs, LANs, WLANs, internets, and intranets). Such networks or portions thereof may utilize any one or more different topologies (e.g., ring, bus, star, loop, etc.), transmission media (e.g., wired/RF cable, RF wireless, millimeter wave, optical, etc.) and/or communications or networking protocols (e.g., SONET, DOCSIS, IEEE Std. 802.3, ATM, X.25, Frame Relay, 3GPP, 3GPP2, WAP, SIP, UDP, FTP, RTP/RTCP, H.323, etc.). As used herein, the term “network interface” refers to any signal, data, or software interface with a component, network or process including, without limitation, those of the Firewire (e.g., FW400, FW800, etc.), USB (e.g., USB2), Ethernet (e.g., 10/100, 10/100/1000 (Gigabit Ethernet), 10-Gig-E, etc.), MoCA, Serial ATA (e.g., SATA, e-SATA, SATAII), Ultra-ATA/DMA, Coaxsys (e.g., TVnet™), radio frequency tuner (e.g., in-band or OOB, cable modem, etc.), WiFi (802.11a,b,g,n), WiMAX (802.16), PAN (802.15), or IrDA families. As used herein, the term “node” refers without limitation to any location, functional entity, or component within a network. As used herein, the term “QAM” refers to modulation schemes used for sending signals over cable networks. Such modulation scheme might use any constellation level (e.g. QPSK, 16-QAM, 64-QAM, 256-QAM, etc.) depending on details of a cable network. A QAM may also refer to a physical channel modulated according to the schemes. As used herein, the term “server” refers to any computerized component, system or entity regardless of form which is adapted to provide data, files, applications, content, or other services to one or more other devices or entities on a computer network. As used herein, the term “storage device” refers to without limitation computer hard drives, DVR device, memory, RAID devices or arrays, optical media (e.g., CD-ROMs, Laserdiscs, Blu-Ray, etc.), or any other devices or media capable of storing content or other information. As used herein, the term “wireless” means any wireless signal, data, communication, or other interface including without limitation WiFi, Bluetooth, 3G, HSDPA/HSUPA, TDMA, CDMA (e.g., IS-95A, WCDMA, etc.), FHSS, DSSS, GSM, PAN/802.15, WiMAX (802.16), 802.20, narrowband/FDMA, OFDM, PCS/DCS, analog cellular, CDPD, satellite systems, millimeter wave or microwave systems, acoustic, and infrared (i.e., IrDA). Overview The present invention provides, inter alia, methods and apparatus for providing premises network access to individual ones of client devices. These methods and apparatus advantageously allow leased devices and customer retail devices to access content via a premises network, but limit such access only to the devices of authorized subscribers of the network operator (e.g., MSO). In one embodiment, a list of devices authorized to access a premises network (“white list”) and a list of devices not authorized to access a premises network (“black list”) are utilized to implement this functionality. A user or technician may add a device to either list, or alternatively the device may be added by a substantially automated process. For example, a user may purchase or lease client equipment, connect the equipment to the premises network, and enter identifying information regarding the device (and the network as required) to an authorization manager (AM). The authorization manager verifies the information against subscriber information stored at a billing system or other trusted data repository or source, and once verified, provides access to the premises network to the device. A device may be connected directly to a network and begin requesting content. If the device has been previously entered onto either the list of authorized devices or the list of unauthorized devices, the device is granted or denied access to content, respectively. The device seeks access in one embodiment by sending a message to an authorization manager. The authorization manager searches the lists of authorized and unauthorized devices to determine whether the requesting device should be given access to content, and if any other actions should be taken with respect to the device. The list of authorized devices (white list) and list of unauthorized devices (black list), may be stored at a database or other location in communication with the authorization manager or alternatively, may be stored at the manager entity itself. A client device's permission to access content on a particular premises network may also be revoked or modified. For example, an authorized premises network user may access a list of devices in his/her premises network. If one or more of the devices on the list of premises devices is not familiar to the user, the user may select the device(s) for removal from the premises network. After the user requesting removal is verified (e.g., authenticated), the authorization manager may remove the device(s) from the premises white list, and have the device(s) placed on a black list. When a device that has been black-listed from a premises network attempts to connect to the premises network, it will be found on the black list and access is denied. Other actions may also be taken, such as reporting the device to a security manager or other network entity for, inter alia, investigation of fraud or other surreptitious activity. Business methods involving the foregoing technology, and a computerized” rules engine” for implementing business and operational rules, are also disclosed. Detailed Description of Exemplary Embodiments Exemplary embodiments of the apparatus and methods of the present invention are now described in detail. While these exemplary embodiments are described in the context of the aforementioned hybrid fiber coax (HFC) cable or satellite system architecture having an multiple systems operator (MSO), digital networking capability, and plurality of client devices/CPE, the general principles and advantages of the invention may be extended to other types of networks and architectures, whether broadband, narrowband, wired or wireless, or otherwise, the following therefore being merely exemplary in nature. It will also be appreciated that while described generally in the context of a consumer (i.e., home) end user domain or premises, the present invention may be readily adapted to other types of environments (e.g., commercial/enterprise, government/military, etc.) as well. Myriad other applications are possible. It is further noted that while described primarily in the context of a system with 6 MHz RF channels, the present invention is applicable to literally any network topology or paradigm (whether wireline, wireless, or optical, of hybridizations thereof), and any frequency/bandwidth, such as for example 8 MHz channels. Furthermore, as referenced above, the invention is in no way limited to traditional cable system frequencies (i.e., below 1 GHz), and in fact may be used with systems that operate above 1 GHz band in center frequency or bandwidth, to include without limitation so-called ultra-wideband systems. It will further be appreciated that while the exemplary embodiments presented herein are described in the context of services that may include multicast and unicast data, the present invention is applicable to other types of services that include multicast transmission of data delivered over a network having multiple physical channels or even virtual or logical channels. Other features and advantages of the present invention will immediately be recognized by persons of ordinary skill in the art with reference to the attached drawings and detailed description of exemplary embodiments as described below. Network— FIG. 1 illustrates a typical content delivery network configuration with which the apparatus and methods of the present invention may be used. The various components of the network 100 include (i) one or more data and application origination points 102; (ii) one or more content sources 103, (iii) one or more application distribution servers 104; (iv) one or more VOD servers 105, and (v) customer premises equipment (CPE) 106. The distribution server(s) 104, VOD servers 105 and CPE(s) 106 are connected via a bearer (e.g., HFC) network 101. A simple architecture comprising one of each of the aforementioned components 102, 104, 105, 106 is shown in FIG. 1 for simplicity, although it will be recognized that comparable architectures with multiple origination points, distribution servers, VOD servers, and/or CPE devices (as well as different network topologies) may be utilized consistent with the invention. For example, the headend architecture of FIG. 1a (described in greater detail below) may be used. The data/application origination point 102 comprises any medium that allows data and/or applications (such as a VOD-based or “Watch TV” application) to be transferred to a distribution server 104. This can include for example a third party data source, application vendor website, CD-ROM, external network interface, mass storage device (e.g., RAID system), etc. Such transference may be automatic, initiated upon the occurrence of one or more specified events (such as the receipt of a request packet or ACK), performed manually, or accomplished in any number of other modes readily recognized by those of ordinary skill The application distribution server 104 comprises a computer system where such applications can enter the network system. Distribution servers are well known in the networking arts, and accordingly not described further herein. The VOD server 105 comprises a computer system where on-demand content can be received from one or more of the aforementioned data sources 102 and enter the network system. These servers may generate the content locally, or alternatively act as a gateway or intermediary from a distant source. The CPE 106 includes any equipment in the “customers' premises” (or other locations, whether local or remote to the distribution server 104) that can be accessed by a distribution server 104. Referring now to FIG. 1a, one exemplary embodiment of a headend architecture useful with the present invention is described. As shown in FIG. 1a, the headend architecture 150 comprises typical headend components and services including billing module 152, subscriber management system (SMS) and CPE configuration management module 154, cable-modem termination system (CMTS) and OOB system 156, as well as LAN(s) 158, 160 placing the various components in data communication with one another. It will be appreciated that while a bar or bus LAN topology is illustrated, any number of other arrangements as previously referenced (e.g., ring, star, etc.) may be used consistent with the invention. It will also be appreciated that the headend configuration depicted in FIG. 1a is high-level, conceptual architecture and that each MSO may have multiple headends deployed using custom architectures. The exemplary architecture 150 of FIG. 1a further includes a multiplexer-enerypter-modulator (MEM) 162 coupled to the HFC network 101 adapted to process or condition content for transmission over the network. The distribution servers 164 are coupled to the LAN 160, which provides access to the MEM 162 and network 101 via one or more file servers 170. The VoD servers 105 are coupled to the LAN 160 as well, although other architectures may be employed (such as for example where the VoD servers are associated with a core switching device such as an 802.3z Gigabit Ethernet device). As previously described, information is carried across multiple channels. Thus, the headend must be adapted to acquire the information for the carried channels from various sources. Typically, the channels being delivered from the headend 150 to the CPE 106 (“downstream”) are multiplexed together in the headend as previously described, and sent to neighborhood hubs (FIG. 1b) via a variety of interposed network components. It will also be recognized, however, that the multiplexing operation(s) need not necessarily occur at the headend 150 (e.g., in the aforementioned MEM 162). For example, in one variant, at least a portion of the multiplexing is conducted at a BSA switching node or hub (see discussion of FIG. 1c provided subsequently herein). As yet another alternative, a multi-location or multi-stage approach can be used, such as that described in U.S. patent applications Ser. No. 11/048,334, entitled “APPARATUS AND METHODS FOR MULTI-STAGE MULTIPLEXING IN A NETWORK” incorporated herein by reference in its entirety, which discloses inter alia improved multiplexing apparatus and methods that allow such systems to dynamically compensate for content (e.g., advertisements, promotions, or other programs) that is inserted at a downstream network node such as a local hub, as well as “feed back” and “feed forward” mechanisms for transferring information between multiplexing stages. Content (e.g., audio, video, data, files, etc.) is provided in each downstream (in-band) channel associated with the relevant service group. To communicate with the headend or intermediary node (e.g., hub server), the CPE 106 may use the out-of-band (OOB) or DOCSIS channels and associated protocols. The OCAP 1.0, 2.0, 3.0 (and subsequent) specification provides for exemplary networking protocols both downstream and upstream, although the invention is in no way limited to these approaches. It will also be recognized that the multiple servers (broadcast, VoD, or otherwise) can be used, and disposed at two or more different locations if desired, such as being part of different server “farms”. These multiple servers can be used to feed one service group, or alternatively different service groups. In a simple architecture, a single server is used to feed one or more service groups. In another variant, multiple servers located at the same location are used to feed one or more service groups. In yet another variant, multiple servers disposed at different location are used to feed one or more service groups. “Switched” Networks— FIG. 1c illustrates an exemplary “switched” network architecture also useful with the present invention. While a so-called “broadcast switched architecture” or BSA network is illustrated in this exemplary embodiment, it will be recognized that the present invention is in no way limited to such architectures. Switching architectures allow improved efficiency of bandwidth use for ordinary digital broadcast programs. Ideally, the subscriber is unaware of any difference between programs delivered using a switched network and ordinary streaming broadcast delivery. FIG. 1c shows the implementation details of one exemplary embodiment of this broadcast switched network architecture. Specifically, the headend 150 contains switched broadcast control and media path functions 190, 192; these element cooperating to control and feed, respectively, downstream or edge switching devices 194 at the hub site which are used to selectively switch broadcast streams to various service groups. A BSA server 196 is also disposed at the hub site, and implements functions related to switching and bandwidth conservation (in conjunction with a management entity 198 disposed at the headend). An optical transport ring 197 is utilized to distribute the dense wave-division multiplexed (DWDM) optical signals to each hub in an efficient fashion. Co-owned and co-pending U.S. patent application Ser. No. 09/956,688 filed Sep. 20, 2001 and entitled “Technique for Effectively Providing Program Material in a Cable Television System”, incorporated herein by reference in its entirety, describes one exemplary broadcast switched digital architecture useful with the present invention, although it will be recognized by those of ordinary skill that other approaches and architectures may be substituted. In addition to “broadcast” content (e.g., video programming), the systems of FIGS. 1a and 1c (and 1d discussed below) also deliver Internet data services using the Internet protocol (IP), although other protocols and transport mechanisms of the type well known in the digital communication art may be substituted. One exemplary delivery paradigm comprises delivering MPEG-based video content, with the video transported to user PCs (or IP-based STBs) over the aforementioned DOCSIS channels comprising MPEG (or other video codec such as H.264 or AVC) over IP over MPEG. That is, the higher layer MPEG—or other encoded content is encapsulated using an IP protocol, which then utilizes an MPEG packetization of the type well known in the art for delivery over the RF channels. In this fashion, a parallel delivery mode to the normal broadcast delivery exists; i.e., delivery of video content both over traditional downstream QAMs to the tuner of the user's STB or other receiver device for viewing on the television, and also as packetized IP data over the DOCSIS QAMs to the user's PC or other IP-enabled device via the user's cable modem. Referring again to FIG. 1c, the IP packets associated with Internet services are received by edge switch 194, and forwarded to the cable modem termination system (CMTS) 199. The CMTS examines the packets, and forwards packets intended for the local network to the edge switch 194. Other packets are discarded or routed to another component. The edge switch 194 forwards the packets receive from the CMTS 199 to the QAM modulator 189, which transmits the packets on one or more physical (QAM-modulated RF) channels to the CPE. The IP packets are typically transmitted on RF channels that are different that the RF channels used for the broadcast video and audio programming, although this is not a requirement The CPE 106 are each configured to monitor the particular assigned RF channel (such as via a port or socket ED/address, or other such mechanism) for IP packets intended for the subscriber premises/address that they serve. “Packetized” Networks— While the foregoing network architectures described herein can (and in fact do) carry packetized content (e.g., IP over MPEG for high-speed data or Internet TV, MPEG2 packet content over QAM for MPTS, etc.), they are often not optimized for such delivery. Hence, in accordance with another embodiment of the present invention, a “packet optimized” delivery network is used for carriage of the packet content (e.g., IPTV content). FIG. 1d illustrates one exemplary implementation of such a network, in the context of a 3GPP IMS (LP Multimedia Subsystem) network with common control plane and service delivery platform (SDP), as described in U.S. provisional patent application Ser. No. 61/256,903 entitled “METHODS AND APPARATUS FOR PACKETIZED CONTENT DELIVERY OVER A CONTENT DELIVERY NETWORK, previously incorporated herein. Such a network provides significant enhancements in terms of common control of different services, implementation and management of content delivery sessions according to unicast or multicast models, etc.; however, it is appreciated that the various features of the present invention are in no way limited to any of the foregoing architectures. Premises Networking Architecture— Referring now to FIG. 2, one embodiment of a network topology for providing device authorization in a premises network according to the present invention is illustrated. As shown, the network headend 150 communicates with a plurality of client devices or consumer premises equipment (CPE) 106 via an HFC network 101. It is appreciated that in one embodiment, the premises network may include or be a network compliant with Multimedia Over Coax Alliance (MoCA) standards as disclosed in e.g., MoCA Specifications v10, February 2006; MoCA Specifications v1.1 Extensions, May 2007; and IEEE802.1 AVB WG Specifications, each of which is incorporated by reference herein in its entirety. It is farther appreciated that the network topology may comprise a Next Generation Home Architecture (NGHA) type architecture for delivering voice, video and data services. The NGHA terminates the plant specific protocols and distributes services using Internet Protocol (IP) based mechanisms. These mechanisms may advantageously comply with the previously mentioned open CE standards such as e.g., UPnP, CEA 2014, and DLNA, while still providing content security and access restrictions to non-customer devices or nomadic IP devices prohibiting these from gaining access to services in a network. The network headend 150 (see also FIG. 1a) communicates with the CPE 106 via an intermediary HFC network 101 (and a hub), and via the premises network where installed (not shown). The “last mile” connection to the customer's premises is typically via coaxial cable, but in some instances, fiber optic cable replaces coaxial cable as in a fiber-to-the-home (FTTH) implementation. So-called “fiber-to-the-curb” or FTTC optical implementations may also be used. The terminating coaxial cable is routed into the customer premises, and is connected to one or more CPE 106. Typically, program channel content is transmitted downstream from the cable headend 150 or a BSA switching node over in-band frequencies, and internet (e.g., Internet) content is transmitted from the cable modem termination system (CMTS) over DOCSIS frequencies. The CPE 106 receives signals from the network via the coaxial cable, demodulates the signals, converts the demodulated signals into digital signals if required, and transmits the digital signals to a display device (e.g., television) or other apparatus. These signals may also be distributed via e.g., a back-end interface to DVRs, personal media devices (PMDs), and the like (not shown). The CPE 106 may further comprise a cable modem which receives signals from the network, demodulates the signals from the CMTS, converts the demodulated signals into digital signals if required, and transmits the digital signals to a computerized device (e.g., personal computer) or series of computers in a premises local area network (LAN). As illustrated, numerous entities are located at the cable network headend 150 of the exemplary network of FIG. 2. For example, a content provisioning system (CPS) 202 comprising an authorization manager 200 and application server 206, and a billing system 204, may be disposed at the headend 150 of the network. As will be discussed in greater detail below, the headend entities work together to provide authentication/authorization and verification of CPE 106 as the CPE 106 request access to content provided from the CPS 202. The CPS 202 comprises one or more entities responsible for providing data and content to the CPE 106. The CPS 202 may be used to collectively refer to one or more of the headend entities discussed above with respect to FIGS. 1-1d, and may further include additional entities or processes discussed herein below. According to one embodiment, the CPS 202 utilizes an authorization manager 200 to determine whether a device is authorized to receive content before access to data/content is permitted. The authorization manager 200 may be implemented as one or more software applications run at headend entity (e.g., an entity of the CPS 202), or alternatively at the CPE 106, or even as a distributed application (e.g., with a “server” or headend portion that is in process communication with a “client” portion disposed on one or more CPE 106 at the premises). The authorization manager 200 is adapted to manage access to data and content, and receives requests for content from various ones of the CPE 106 (or a proxy thereof, such as a converged premises device or gateway (not shown)). In response to a request, the authorization manager 200 determines whether the device 106 is on a “black list” 201 of devices not allowed to access services, on a “white list” 203 of devices 106 allowed to access services, or on neither list. CPE 106 listed on the white list 203 or black list 201 may be listed by a unique device identifier (such as MAC address, IP address, cryptographic hash (e.g., of the MAC address), or other identifier) and/or by premises which the device 106 is entitled to receive service from (such as by subscriber account number, physical address, IP address, etc.). In one example, when a request for content access is received, the manager 200 may use the MAC address associated with the request in order to determine whether the device 106 is on either of the lists 201, 203. In one embodiment, if the device 106 is on a black list 201, the device 106 is denied access to data and content; and if the device 106 is on a white list 203, the authorization manager 200 facilitates access to the content, such as by providing the CPE 106 access to a user interface for the distribution of data and/or content. This “go/no-go” logic can be modified or implemented according to any number of different schemes, such as where different access privileges or rules are applied to different device classes (or even based on individual device IDs). If the authorization manager 200 is not able to find the CPE. 106 on either of the lists 201, 203, the CPE 106 may be added to a subscriber premises white list 203 as will be discussed below. Newly added devices 106 must be verified before content may be provided thereto. Devices 106 may also be removed from a white list 203 or black list 201 as needed, or their privileges modified. In one embodiment, the white lists 203 and black lists 201 discussed above each comprise a plurality of lists held in a database, each of the individual white lists 203 and black lists 201 being premises-specific (and/or subscriber-specific, such as for example implementing parental control functions, or where the premises has two or more distinct living units or subscribers). As illustrated in FIG. 2a, for example, a white list 203 for a first premises, Premises 1, is stored according to premises identification information 212. In one embodiment, the premises identification information 212 comprises a subscriber account number as issued by the MSO. Each of the device entries 214a, 214b, 214c . . . 214n representing CPE 106 allowed to access content in Premises 1 is listed on the white list 203. In one variant, the white list device entries 214a, 214b, 214c . . . 214n are listed on the white list 203 by a MAC address, IP address, or other device 106 identifier, so as to facilitate searching of the lists by a search algorithm. Other schemes may be used as well. FIG. 2a also illustrates an exemplary black list 201 for the first premises, Premises 1. As shown, the black list 201 is stored according to the premises identification information 212 (such as subscriber account number). The black list 201 lists device entries 222a, 222b, 222c . . . 222n which represent CPE 106 that are prohibited from gaining access to content in the premises network. The devices 106 of the black list 201 may be listed by MAC address, EP address or other unique identifier, as with the white list. However, it will be appreciated that the white and black lists may be heterogeneous in form or organization; in fact, it may be desirous to organize or structure the two lists differently so as to leverage certain functions within the CPS or billing system. Moreover, it will be appreciated that two or more white lists and/or black lists may be associated with a given premises or subscriber. For instance, a first white list might be used during certain periods of time (e.g., “prime time”), and second list used during other periods so as to implement MSO or content source policies. The manager 200 may be adapted to store a white list 203 and a black list 201 for each of the user premises (or subscribers) serviced by the manager 200, or any subsets thereof (e.g., by zip code, association with a network distribution node, etc.). The lists 201, 203 may then be searched based on subscriber premises information (such as a subscriber account number) and/or by device 106 identification (such as a MAC address or IP address) in order to identify whether a particular device 106 is correlated to an entry on either a white list
{'app_number': None, 'application_number': '<application-reference appl-type="utility">\n<document-id>\n<country>US</country>\n<doc-number>16154615</doc-number>\n<date>20181008</date>\n</document-id>\n</application-reference>', 'doc_number': None, 'publication_number': '<publication-reference>\n<document-id>\n<country>US</country>\n<doc-number>20190109850</doc-number>\n<kind>A1</kind>\n<date>20190411</date>\n</document-id>\n</publication-reference>', 'source_file': './application/2019/ipa190411.xml', 'source_data': 'USPTO-Application'}