HIERARCHICAL CABLE MODEM CLONE DETECTION

• US 20080126540A1
• Filed: 08/16/2006
• Published: 05/29/2008
• Est. Priority Date: 08/16/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: SINGH, HEMANT, ZENG, SHENGYOU
• Granted Patent: US 7,957,305 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 12/2801 Broadband local area networks
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 61/5046 Resolving address allocation conflicts; Testing of addresses testing when self-assigning an address H04L61/5092
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04N 21/25841 involving the geographical location of the client retrieval from the Internet by querying based on geographical locations G06F16/9537; arrangements for identifying locations of receiving stations in broadcast systems H04H60/51; location of the user terminal in data switching networks H04L67/52; services making use of the location of users or terminals in wireless networks H04W4/02; locating users or terminals in wireless networks H04W64/00

Abstract

A hierarchical cable modem clone detection system: A cable modem clone detection system uses a cable modem media access control (MAC) address and physical location information such as information relating to a cable interface, upstream and downstream port numbers, fiber node information, and load balancing group descriptors to determine if a cable modem is a clone. The hierarchical approach first make a clone determination at a cable modem termination system, then at a regional operations center and finally at a network operations center

Claims

1. ) A method comprising the steps of:

detecting if a cable modem seeking connection (CM-SC) to a first cable modem termination system (CMTS) has the same media access control (MAC) address as any cable modems previously registered (PR-CM) on said first CMTS,

if said CM-SC has the same MAC address as a PR-CM, determining if the location of CM-SC is the same as that of the PR-CM, and

if said locations differ, sending a ping to the location of said PR-CM, whereby if said PR-CM responds to said ping, it is determined that said CM-SC is a clone and if said PR-CM does not respond to said ping, it is determined that said CM-SC is in fact said PR-CM at a new location.

2. ) The method of claim 1 including, if the MAC address of said CM-SC is not the same as the MAC address of any PR-CM,

determining if said CM-SC has the same MAC address as cable modems previously registered in a first region (CM-PR-R) that includes said first CMTS and at least one other CMTS,

if said CM-SC has the same MAC address as a CM-PR-R, determining if the location of said CM-SC is the same as that of the CM-PR-R, and

if said locations differ, sending a ping to the location of said CM-PR-R to determine if said CM-SC is the CM-PR-R or if said CM-SC is a clone modem.

3. ) The method of claim 2 wherein, if the MAC address of said CM-SC is not the same as the MAC address of any CM-PR-R, said method includes,

determining if said CM-SC has the same MAC address as cable modems previously registered in a network (CM-PR-N) that includes said first region and at least one other region,

if said CM-SC has the same MAC address as the CM-PR-N, determining if the location of said CM-SC is the same as that of the CM-PR-N, and

if said locations differ, sending a ping to the location of said CM-PR-N to determine if said CM-SC is the CM-PR-N or if said CM-SC is a clone modem.

4. ) The method in claim 1 wherein said location of said CM-SC includes at least one from the group:

(a) the cable interface on which the CM-SC appears,

(b) the US and DS ports on the interface that service the CM-SC,

(c) the Fiber Node (FN) serving the CM-SC, and

(d) the Load Balancing (LB) group descriptor of the CM-SC on the CMTS.

5. ) The method in claim 1 wherein said location of said PR-CM includes at least one from the group:

(a) the cable interface on which the PR-CM appears,

(b) the US and DS ports on the interface that service the PR-SC,

(c) the Fiber Node (FN) serving the PR-SC, and

(d) the Load Balancing (LB) group descriptor of the PR-SC on the CMTS.

6. ) The method of claim 1 including storing in said CMTS the MAC address and location of the PR-CMs on said CMTS.

7. ) The method recited in claim 1 including, determining if a load balancing operation has changed the interface location of a PR-CM, and if so updating the location of said PR-CM.

8. ) The method recited in claim 1 including, determining if a Upstream Channel Change (UCC) command or if a Downstream Channel Change (DCC) command has changed the interface location of a PR-CM, and if so updating the location of said PR-CM.

9. ) The method recited in claim 1 including, determining any action has changed the interface location of a PR-CM, and if so updating the location of said PR-CM.

10. ) A method comprising:

storing in a memory associated with a cable modem termination system (CMTS) the media access control (MAC) address and location of cable modems previously registered on said CMTS system,

determining the current MAC address and the current location of a cable modem that attempts to connect to said CMTS system,

determining if any of said previously registered cable modems had the same MAC address as said current MAC address, and if a previously registered cable modem had the same address as said current MAC address,

retrieving from said memory the location of the previously registered cable modems that had the same MAC address as said current MAC address, and

comparing the location of the previously registered cable modems that had the same MAC address as said current MAC address to said current location and if said compared addresses differ,

sending a ping to the location of said previously registered cable modem to determine if two modems with the same MAC address are connected to said CMTS or if said PR-CM has moved to a new location.

11. ) The method recited in claims 10 where said CMTS is one of a group of CMTS'"'"'s in a region that includes a plurality of CMTSs, each CMTS having an ID (CMTS-ID) and said region having a Regional Operating Center (ROC), the steps of:

storing in a memory associated with said ROC (ROC-MEM) the media access control (MAC) address and the CMTS-ID of cable modems previously registered on CMTS'"'"'s in said ROC (CM-PR-R),

determining if any of said CM-PR-R had the same MAC address as said current MAC address, and if a CM-PR-R had the same address as said current MAC address,

retrieving from said ROC-MEM the CMTS-ID of the CM-PR-R that had the same MAC address as said current MAC address, and

having the CMTS with said retrieved CMTS-ID compare the location of the CM-PR-R that had the same MAC address as said current MAC address to said current location and if said compared addresses differ,

sending a ping to the location of said CM-PR-R to determine if two modems with the same MAC address are connected to said ROC.

12. ) The method recited in claims 10 where said ROC is one of a group of ROCs in a network that includes a plurality of ROC'"'"'s, each ROC having an ID (R-ID) and said region having a Network Operating Center (NOC), the steps of:

storing in a memory associated with said NOC (NOC-MEM) the media access control (MAC) address and R-ID of cable modems previously registered on said NOC (CM-PR-N),

determining if any of said CM-PR-N had the same MAC address as said current MAC address, and if a CM-PR-N had the same address as said current MAC address,

retrieving from said NOC-MEM the R-ID of said CM-PR-N that had the same MAC address as said current MAC address, and

having said NOC with said R-ID compare the location of the CM-PR-N that had the same MAC address as said current MAC address to said current location and if said compared addresses differ,

sending a DOCSIS ping to the location of said CM-PR-N to determine if two modems with the same MAC address are connected to said NOC.

13. A method to detect a cloned cable modem comprising:

establishing a connection from a particular cable modem to a cable modem termination system (CMTS), said CMTS storing medial access control (MAC) addresses of modems to which connects are established and the associated physical location modems whose MAC address is stored;

checking if a MAC address for said particular cable modem and an associated physical location is stored in said CMTS;

if said MAC address is stored in said CMTS, determining if the associated physical location of said particular cable modem is the same as the physical location stored of the same MAC address stored in said CMTS,

whereby a determination can be made as to whether or not said particular modem may be a clone.

14. The method of claim 13 wherein the physical location includes one or more of:

a cable interface, an upstream port on the interface, a downstream port on the interface, a fiber node serving the cable modem and a load balancing group descriptor on the cable modem termination system.

15. The method of claim 13 further comprising, establishing internet protocol connectivity through a server and sending information to the server to detect a clone.

16. The method of claim 13 wherein the information includes an internet protocol address identifying a link address of a cable interface where a dynamic host configuration protocol client message is received from the cable modem, a new upstream and downstream port that the cable modem has moved to for load balancing, a clone detection sub option indicating if the cable modem termination system has performed clone detection, and a physical location sub option including the physical location information.

17. The method of claim 16 further comprising sending the media access control address of the cable modem, the link address of the cable interface, and physical location information for the cable modem to a regional operations center to detect clones at the regional operations center level.

18. A method of detecting if a cable modem seeking connected (CM-SC) to a CMTS is a clone comprising the steps of:

storing is said CMTS the MAC address and location of cable modems registered with said CMTS (PR-CM),

determining the MAC address and location of said CM-SC,

comparing the location of said CM-SC to the location of any PR-CM having the same MAC address as said CM-SC,

if said locations differ, sending a ping to the location of said PR-CM,

whereby if said PR-CM responds to said ping, it is determined that said CM-SC is a clone and if said PR-CM does not respond to said ping, it is determined that said CM-SC is in fact said PR-CM at a new location.

19. ) The method recited in claim 19 wherein said ping is a ping that verifies the DOCSIS path of said CM-SC.

20. ) A system including,

a cable modem termination system (CMTS) that includes a memory to store the MAC address and location of cable modems previously registered (PR-CM) on said CMTS,

a processor to (a) determine the MAC address and location of cable modems seeking connection (CM-SC) to said CMTS, (b) compare the location of said CM-SC to the location of any PR-CM having the same MAC address as said CM-SC, and (c) if said locations differ, sending a ping to the location of said PR-CM,

whereby if said PR-CM responds to said ping, it is determined that said CM-SC is a clone and if said PR-CM does not respond to said ping, it is determined that said CM-SC is in fact said PR-CM at a new location.

21. ) The system recited in claim 20 wherein if the MAC address of said CM-SC does not match the MAC address of any PR-CM, said processor is adapted to send the MAC address and location of said CM-SC to a Regional Operating Center (ROC) serving said CMTS.

22. ) The system recited in claim 21 wherein said ROC includes a memory to store the MAC address and location of cable modems previously registered in the region of said ROC (PR-CM-R), and a processor to (a) compare the location of said CM-SC to the location of any PR-CM-R having the same MAC address as said CM-SC, and (c) if said locations differ, having the CMTS serving the region of said PR-CM-R send a ping to the location of said PR-CM-R,

whereby if said PR-CM-R responds to said ping, it is determined that said CM-SC is a clone and if said PR-CM-R does not respond to said ping, it is determined that said CM-SC is in fact said PR-CM-R at a new location.