System and Method for Affecting the Behavior of a Network Device in a Cable Network

• US 20090198804A1
• Filed: 04/15/2009
• Published: 08/06/2009
• Est. Priority Date: 08/06/2004
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Original Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Inventors: Webb, William, Dillon, Michael, Danforth, Andrew
• Granted Patent: US 8,239,506 B2
• Time in Patent Office: Days
• US Class Current: 709/221
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic

Abstract

A subscriber access control system (SACS) configures a network device connected to cable network to affect the behavior of that device. The SACS comprises a rules engine and a datastore that stores the current state of subscribers known to the SACS and historical request information. When the SACS receives a request to quarantine a device, it assigns attributes to a subscriber record accessed by a DHCP server to affect the configuration and behavior of that device. The actual behavior of the quarantined device is determined by the presence of the attribute and the value of the attribute.

Claims

1. A method for affecting the behavior of a network device comprising:

creating at the network device a renewal message requesting renewal of an IP address lease;

directing the renewal message from the network device through a cable modem to a cable modem termination system (CMTS);

inserting at the CMTS the cable modem MAC address into the renewal message;

sending the renewal message to a lease management server;

detecting at the lease management server the presence of the cable modem MAC address in the renewal message;

in response to the presence of the cable modem MAC address, accessing from the lease management server a configuration record associated with the network device;

detecting the presence of a behavior attribute of the network device in the configuration record; and

sending the behavior attribute in a lease renewal message to the network device to produce a desired behavior when the behavior attribute is present in the configuration record.

2. The method of claim 1, wherein the lease management server is a DHCP server.

3. The method of claim 1, wherein the network device is a customer premises equipment connected to the cable modem.

4. The method of claim 3, wherein the customer premises equipment is selected from the group consisting of a media terminal adapter, a computer, a router, a wireless access point, a firewall, and a network address translation server.

5. The method of claim 1, the method further comprising:

renewing the lease of the network device when the behavior attribute is not present in the configuration record.

6. The method of claim 1, wherein the behavior attribute is associated with a quarantine state of the network device and wherein sending the behavior attribute in a lease renewal message to the network device comprises sending the network device a DNS proxy server IP address to redirect a DNS request from the network device to the DNS proxy server.

7. The method of claim 1, wherein the behavior attribute is associated with a quarantine state of the network device and wherein sending the behavior attribute in a lease renewal message to the network device comprises sending the network device a quarantine boot file identifier, and wherein the method further comprises:

instructing the network device to reboot;

sending the quarantine boot file associated with the boot file identifier to the network device; and

configuring the network device using the quarantine boot file.

8. The method of claim 7, wherein configuring the network device using the quarantine boot file comprises configuring the network device to permit the network device to only send packets to IP addresses identified in an upstream filter set and to only receive packets from IP addresses identified in a downstream filter set.

9. The method of claim 1, wherein the behavior attribute is associated with a quarantine state of the network device and wherein sending the behavior attribute in a lease renewal message to the network device comprises:

sending the network device a quarantine boot file identifier;

determining whether the network device is engaged in a communication session;

when the network device engaged is not engaged in communication session,

instructing the network device to reboot to acquire the quarantine boot file associated with the boot file identifier;

sending the quarantine boot file to the network device, wherein the network device is configured using the quarantine boot file; and

when the network device engaged is engaged in communication session,

determining when the communication session is terminated;

instructing the network device to reboot after the communication session is terminated to acquire the quarantine boot file associated with the boot file identifier; and

sending the quarantine boot file to the network device, wherein the network device is reconfigured using the quarantine boot file.

10. The method of claim 8, wherein the communication session is selected from the group consisting of a voice over IP session and a multimedia session.

11. The method of claim 1 further comprising:

acquiring a quarantine request directed to a subscriber;

determining a current state of the subscriber, wherein a subscriber state comprises a quarantined state and an unquarantined state;

determining a desired subscriber state as indicated by the quarantine request;

accessing a configuration record associated with the network device;

creating a quarantine attribute associated with the desired behavior of the network device and adding the quarantine attribute to the configuration record when the current subscriber state is unquarantined and the desired subscriber state is quarantined; and

removing the quarantine attribute from the quarantined configuration record when the current subscriber state is quarantined and the desired subscriber state is unquarantined.

12. An IP address lease management system comprising:

a cable modem termination system (CMTS);

a network;

a network device;

a cable modem;

a datastore, wherein the datastore comprises records, and

a lease management server,

wherein the datastore is accessible to the lease management server,

wherein the network device is connected to the cable modem, wherein the cable modem cooperates with the CMTS via a network, and wherein the network device is configured for;

creating a renewal message requesting renewal of an IP address of the network device;

directing the renewal message from the network device to the CMTS; and

wherein the CMTS is configured for;

receiving the renewal message from the network device;

inserting the cable modem MAC address into the renewal message; and

sending the renewal message to the lease management server; and

wherein the lease management server is configured for;

receiving the renewal message from the CMTS;

detecting the presence of the cable modem MAC address in the renewal message;

in response to the presence of the cable modem MAC address, accessing a record associated with the network device in the datastore;

detecting the presence of a behavior attribute of the network device in the configuration record; and

sending the network the behavior attribute in a lease renewal message to the network device when the behavior attribute is present in the configuration record.

13. The system of claim 12, wherein the lease management server is a DHCP server.

14. The system of claim 12, wherein the network device is a customer premises equipment connected to the cable modem.

15. The system of claim 14, wherein the customer premises equipment is selected from the group consisting of a media terminal adapter, a computer, a router, a wireless access point, a firewall, and a network address translation server.

16. The system of claim 12, wherein the lease management server is further configured for renewing the lease of the network device when the behavior attribute is not present in the configuration record.

17. The system of claim 12, wherein the behavior attribute of is associated with a quarantine state of the network device and comprises a DNS proxy server IP address for redirecting a DNS request from the network device to a DNS proxy server.

18. The system of claim 12, wherein the behavior attribute of the network device is associated with a quarantine state of the network device and comprises a quarantine boot file identifier, wherein the system further comprises a subscriber access control system, and wherein the subscriber access control system is configured for:

instructing the network device to reboot; and

sending the quarantine boot file associated with the boot file identifier to the network device,

wherein the network device is configured using the quarantine boot file.

19. The system of claim 18, wherein the quarantine boot file comprises network filters which when configured on the network device causes the network device to only send packets to IP addresses identified in an upstream filter set and to only receive packets from IP addresses identified in a downstream filter set.

20. The method of claim 12 wherein the behavior attribute of the network device is associated with a quarantine state of the network device and comprises a quarantine boot file identifier, wherein the system further comprises a subscriber access control system, and wherein the subscriber access control system is configured for:

sending the network device a quarantine boot file identifier;

determining whether the network device is engaged in a communication session;

when the network device engaged is not engaged in communication session,

instructing the network device to reboot to acquire the quarantine boot file associated with the boot file identifier; and

sending the quarantine boot file to the network device, wherein the network device is configured using the quarantine boot file; and

when the network device engaged is engaged in communication session,

determining when the communication session is terminated;

instructing the network device to reboot after the communication session is terminated to acquire the quarantine boot file associated with the boot file identifier; and

sending the quarantine boot file to the network device, wherein the network device is reconfigured using the quarantine boot file.

21. The system of claim 20, wherein the communication session is selected from the group consisting of a voice over IP session and a multimedia session.

22. The system of claim 12 further comprising a subscriber access control system and wherein the subscriber access control system is configured for:

acquiring a quarantine request directed to a subscriber;

determining a current state of the subscriber, wherein a subscriber state comprises a quarantined state and an unquarantined state;

determining a desired subscriber state as indicated by the quarantine request;

accessing a configuration record associated with the network device;

p1 creating a quarantine attribute associated with the desired behavior of the network device and adding the quarantine attribute to the configuration record when the current subscriber state is unquarantined and the desired subscriber state is quarantined; and

removing the quarantine attribute from the quarantined configuration record when the current subscriber state is quarantined and the desired subscriber state is unquarantined.