Detection of multiple users of a network access node

• US 7,474,617 B2
• Filed: 03/04/2005
• Issued: 01/06/2009
• Est. Priority Date: 03/04/2005
• Status: Active Grant

• Current Assignee: Guest-tek Interactive Entertainment Ltd.
• Original Assignee: iBAHN General Holdings Corporation (Guest-tek Interactive Entertainment Ltd.)
• Inventors: Burns, Darrell Richard, Ehlers, Richard L., Molen, Brett Thomas, Burns, Douglass Ervan, Draper, Nichol Fife
• Primary Examiner(s): Pham; Chi H
• Assistant Examiner(s): Mills; Donald L
• Application Number:
  US11/073,428
• Publication Number:
  US 20060198311A1
• Time in Patent Office: 1,404 Days
• Field of Search: 370229-232, 370/235, 370/252, 370/253, 370464-467, 370/469, 709223-225, 709/232, 726/6, 726/7, 726/11, 726/22, 726/23
• US Class Current: 370/232
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

Techniques are described for detecting use of a network access node by multiple users to gain access to a network. Packets are received from a network device in communication with the network access node. The packets are evaluated with reference to a plurality of metrics. Each of the metrics is independently representative of an estimated number of user devices from which the packets originate.

Claims

1. A computer-implemented method for detecting use of a network access node by multiple users to gain access to a network, comprising:

receiving packets from a network device in communication with the network access node;

evaluating the packets with reference to a plurality of metrics, each of the metrics being independently representative of an estimated number of user devices from which the packets originate that are using the network access node to gain access to the network; and

determining that the estimated number of user devices using the network access node to gain access to the network exceeds an authorized number of user devices for the network access node with reference to a combination of the metrics.

2. The method of claim 1 wherein the plurality of metrics are associated with a particular MAC address, and comprises one or more of a number of TCP connections associated with the particular MAC address, a number of POP3 connections associated with the particular MAC address, a number of SMTP connections associated with the particular MAC address, a number of raw socket connections associated with the particular MAC address, a number of VPNs associated with the particular MAC address, a number of browser applications associated with the particular MAC address, a number of operating systems associated with the particular MAC address, a number of different cookies associated with the particular MAC address, or a number of different probe responses associated with the particular MAC address.

3. The method of claim 2 wherein the number of TCP connections, the number of POP3 connections, and the number of SMTP connections are each determined with reference to the particular MAC address, a TCP port number, and a destination IP address.

4. The method of claim 2 wherein the number of browser applications is determined with reference to the particular MAC address and one or more of HTML header information or HTTP header information.

5. The method of claim 2 wherein the number of cookies is determined by retrieving previously transmitted unique cookies from the user devices associated with the particular MAC address.

6. The method of claim 2 wherein the number of different probe responses is determined by transmitting a plurality of Netbios probes to the user devices associated with the particular MAC address.

7. The method of claim 2 wherein the number of TCP connections associated with the particular MAC address comprises concurrently open TCP connections.

8. The method of claim 1 wherein the each of the plurality of metrics in the combination of metrics has a weight associated therewith.

9. The method of claim 1 wherein the combination of metrics comprises fewer than all of the plurality of metrics.

10. The method of claim 1 wherein the plurality of metrics comprises first and second subsets, and wherein determining that the estimated number exceeds the authorized number comprises making a preliminary determination that the estimated number exceeds the authorized number with references to the first subset of metrics and, in response to the preliminary determination, making a final determination that the estimated number exceeds the authorized number with reference to the second subset of metrics.

11. The method of claim 10 wherein making the preliminary determination comprises tracking a number of connections for at least one type of traffic.

12. The method of claim 10 wherein making the final determination comprises detecting a plurality of different cookies associated with a particular MAC address.

13. The method of claim 1 further comprising generating a notification when the estimated number exceeds the authorized number.

14. The method of claim 13 wherein the notification comprises one or more of an email, a text message, a page, or a phone call.

15. The method of claim 13 wherein generating the notification comprises transmitting a message to personnel associated with the network.

16. The method of claim 13 wherein generating the notification comprises transmitting a message to a specific one of the estimated number of user devices associated with the network access node.

17. The method of claim 16 further comprising facilitating purchase of network access for at least some of the estimated number of user devices via the specific one of the user devices.

18. The method of claim 1 further comprising terminating access to the network by the network device when the estimated number exceeds the authorized number.

19. The method of claim 1 further comprising obtaining information from the network device relating to the user devices.

20. The method of claim 19 wherein obtaining information comprises reading addresses of the user devices stored on the network device.

21. A network, comprising:

a network access node for facilitating access to the network by a first network device;

a second network device which is operable to detect use of the network access node and the first network device by multiple users to gain access to the network, the second network device being operable to receive packets from the first network device via the network access node, and evaluate the packets with reference to a plurality of metrics, each of the metrics being independently representative of an estimated number of user devices from which the packets originate that are using the network access node to gain access to the network, the second network device further being operable to determine that the estimated number of user devices using the network access node to gain access to the network exceeds an authorized number of user devices for the network access node with reference to a combination of the metrics.

22. The network of claim 21 wherein the second network device comprises a gateway device, and wherein the network access node comprises one of a wireless access node and a wired access node.

23. The network of claim 21 wherein the first network device comprises one of a router and a proxy server.