Hierarchical cable modem clone detection

• US 7,957,305 B2
• Filed: 08/16/2006
• Issued: 06/07/2011
• Est. Priority Date: 08/16/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Singh, Hemant, Zeng, Shengyou
• Primary Examiner(s): Jagannathan; Melanie
• Application Number:
  US11/465,107
• Publication Number:
  US 20080126540A1
• Time in Patent Office: 1,756 Days
• Field of Search: 709/225, 370/252, 370/329, 370/389, 370/401
• US Class Current: 370/252
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 12/2801 Broadband local area networks
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 61/5046 Resolving address allocation conflicts; Testing of addresses testing when self-assigning an address H04L61/5092
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04N 21/25841 involving the geographical location of the client retrieval from the Internet by querying based on geographical locations G06F16/9537; arrangements for identifying locations of receiving stations in broadcast systems H04H60/51; location of the user terminal in data switching networks H04L67/52; services making use of the location of users or terminals in wireless networks H04W4/02; locating users or terminals in wireless networks H04W64/00

Abstract

A hierarchical cable modem clone detection system: A cable modem clone detection system uses a cable modem media access control (MAC) address and physical location information such as information relating to a cable interface, upstream and downstream port numbers, fiber node information, and load balancing group descriptors to determine if a cable modem is a clone. The hierarchical approach first make a clone determination at a cable modem termination system, then at a regional operations center and finally at a network operations center.

Claims

1. A method, comprising:

detecting if a cable modem seeking connection (CM-SC) to a first cable modem termination system (CMTS) has the same media access control (MAC) address as any cable modems previously registered (PR-CM) on said first CMTS,

if said CM-SC has the same MAC address as a PR-CM, determining if the location of the CM-SC is the same as a last-known location of the PR-CM, wherein the location of the CM-SC is specified by the cable interface on which the CM-SC appears and at least one of the US port on the interface that services the CM-SC, the DS port on the interface that services the CM-SC, the Fiber Node (FN) serving the CM-SC, and the Load Balancing (LB) group descriptor of the CM-SC on the CMTS, and

if said locations differ, sending a ping to the last-known location of said PR-CM, whereby

if said PR-CM responds to said ping, it is determined that said CM-SC is a clone based on two different cable modems, the CM-SC and the PR-CM, having the same MAC address but existing in two different physical locations simultaneously, and

if said PR-CM does not respond to said ping, it is determined that said CM-SC is in fact said PR-CM at a new location.

2. The method of claim 1 including, if the MAC address of said CM-SC is not the same as the MAC address of any PR-CM,

determining if said CM-SC has the same MAC address as cable modems previously registered in a first region (CM-PR-R) that includes said first CMTS and at least one other CMTS,

if said CM-SC has the same MAC address as a CM-PR-R, determining if the location of said CM-SC is the same as a last-known location of the CM-PR-R, and

if said locations differ, sending a ping to the last-known location of said CM-PR-R to determine if said CM-SC is the CM-PR-R or if said CM-SC is a clone modem.

3. The method of claim 2 wherein, if the MAC address of said CM-SC is not the same as the MAC address of any CM-PR-R, said method includes:

determining if said CM-SC has the same MAC address as cable modems previously registered in a network (CM-PR-N) that includes said first region and at least one other region,

if said CM-SC has the same MAC address as the CM-PR-N, determining if the location of said CM-SC is the same as a last-known location of the CM-PR-N, and

if said locations differ, sending a ping to the last-known location of said CM-PR-N to determine if said CM-SC is the CM-PR-N or if said CM-SC is a clone modem.

4. The method in claim 1 wherein said last-known location of said PR-CM is specified by the cable interface on which the PR-CM appears and includes at least one from the following group:

the US and DS ports on the interface that service the PR-SC,

the Fiber Node (FN) serving the PR-SC, and

the Load Balancing (LB) group descriptor of the PR-SC on the CMTS.

5. The method of claim 1 including storing in said CMTS the MAC address and last-known location of the PR-CMs on said CMTS.

6. The method recited in claim 1 including, determining if a load balancing operation has changed an interface location of a PR-CM, and if so updating the last-known location of said PR-CM.

7. The method recited in claim 1 including, determining if a Upstream Channel Change (UCC) command or if a Downstream Channel Change (DCC) command has changed an interface location of a PR-CM, and if so updating the last-known location of said PR-CM.

8. The method recited in claim 1 including, determining any action has changed an interface location of a PR-CM, and if so updating the last-known location of said PR-CM.

9. A method, comprising:

storing in a memory associated with a cable modem termination system (CMTS) a media access control (MAC) address and a last-known location of cable modems previously registered (PR-CMs) on said CMTS system,

determining a current MAC address and a current location of a cable modem that attempts to connect to said CMTS system, wherein the current location is specified by at least one of a port on an interface that services the cable modem, a Fiber Node (FN) serving the cable modem, and a Load Balancing (LB) group descriptor on said CMTS system,

determining if any of said previously registered cable modems had said current MAC address,

retrieving from said memory the last-known location of the previously registered cable modems that had said current MAC address, and

comparing the last-known location of a previously registered cable modem that had said current MAC address to said current location and, if said compared addresses differ,

sending a ping to the last-known location of said previously registered cable modem and determining whether a load balancing flag is set to determine if two different modems with said current MAC address are simultaneously connected to said CMTS or if said PR-CM has moved to a new location.

10. The method recited in claim 9 where said CMTS is one of a group of CMTSs in a region that includes a plurality of CMTSs, each CMTS having an ID (CMTS-ID) and said region having a Regional Operating Center (ROC), comprising:

storing in a memory associated with said ROC (ROC-MEM) a media access control (MAC) address and the CMTS-ID of cable modems previously registered on CMTSs in said ROC (CM-PR-R),

determining if any of said CM-PR-R had said current MAC address,

retrieving from said ROC-MEM the CMTS-ID of a CM-PR-R that had said current MAC address, and

having the CMTS with said retrieved CMTS-ID compare a last-known location of the CM-PR-R that had said current MAC address to said current location and, if said compared addresses differ,

sending a ping to the last-known location of said CM-PR-R to determine if two different modems with said current MAC address are connected to said ROC.

11. The method recited in claim 10 where said ROC is one of a group of ROCs in a network that includes a plurality of ROCs, each ROC having an ID (R-ID) and said region having a Network Operating Center (NOC), the steps of

storing in a memory associated with said NOC (NOC-MEM) the media access control (MAC) address and R-ID of cable modems previously registered on said NOC (CM-PR-N),

determining if any of said CM-PR-N had said current MAC address,

retrieving from said NOC-MEM the R-ID of said a CM-PR-N that had said current MAC address, and

having said NOC with said R-ID compare a last-known location of the CM-PR-N that had said current MAC address to said current location and, if said compared addresses differ,

sending a DOCSIS ping to the last-known location of said CM-PR-N to determine if two different modems with said current MAC address are connected to said NOC.

12. A method to detect a cloned cable modem, comprising:

establishing a connection from a particular cable modem to a cable modem termination system (CMTS), said CMTS storing media access control (MAC) addresses of modems to which connections are established and associated last-known physical location of modems whose MAC address is stored;

checking if a MAC address for said particular cable modem is stored in said CMTS; and

if said MAC address is stored in said CMTS, determining if an associated physical location of said particular cable modem is the same as a last-known physical location of a modem having the same MAC address stored in said CMTS, wherein the associated physical location is specified by a cable interface and at least one of an upstream port on the interface, a downstream port on the interface, a fiber node serving the cable modem, and a load balancing group descriptor on the cable modem termination s stem and, responsive to determining that the associated physical location of said particular cable modem is the same as the last-known physical location of the modem having the same MAC address stored in said CMTS, sending a ping to the last-known physical location of the modem having the same MAC address stored in said CMTS,

whereby a determination can be made as to whether or not said particular cable modem may be a clone based at least in part on at least one of the sending and a determination as to whether a load balancing flag is set.

13. The method of claim 12 further comprising establishing internet protocol connectivity through a server and sending information to the server to detect a clone.

14. The method of claim 13 wherein the information includes an internet protocol address identifying a link address of a cable interface where a dynamic host configuration protocol client message is received from the cable modem, a new upstream and downstream port that the cable modem has moved to for load balancing, a clone detection sub option indicating if the cable modem termination system has performed clone detection, and a physical location sub option including the physical location information.

15. The method of claim 14 further comprising sending the media access control address of the cable modem, the link address of the cable interface, and physical location information for the cable modem to a regional operations center to detect clones at the regional operations center level.

16. A method of detecting whether a cable modem seeking connection (CM-SC) to a cable modem termination system (CMTS) is a clone, comprising:

storing in said CMTS a MAC address and a last-known location for each of a plurality of cable modems previously registered with said CMTS (PR-CM),

determining a MAC address and a location of said CM-SC, wherein the location of the CM-SC is specified by the cable interface on which the CM-SC appears and at least one of the US port on the interface that services the CM-SC, the DS port on the interface that services the CM-SC, the Fiber Node (FN) serving the CM-SC, and the Load Balancing (LB) group descriptor of the CM-SC on the CMTS,

comparing the location of said CM-SC to the last-known location of any PR-CM having the same MAC address as said CM-SC, and

if said locations differ, sending a ping to the last-known location of said PR-CM,

whereby if said PR-CM responds to said ping, it is determined that said CM-SC is a clone based on two different cable modems, the CM-SC and the PR-CM, having the same MAC address but existing in two different physical locations simultaneously, and whereby if said PR-CM does not respond to said ping, it is determined that said CM-SC is in fact said PR-CM at a new location.

17. The method recited in claim 16 wherein said ping is a ping that verifies the DOCSIS path of said CM-SC.

18. A system, comprising:

a cable modem termination system (CMTS) that includes a memory to store the MAC address and last-known location of cable modems previously registered (PR-CM) on said CMTS, and

a processor to (a) determine a MAC address and location of a cable modem seeking connection (CM-SC) to said CMTS, wherein the location of the CM-SC is specified by a cable interface and at least one of a US port on the interface, a DS port on the interface, a Fiber Node (FN) serving the cable modem, and a Load Balancing (LB) group descriptor on the CMTS, (b) compare the location of said CM-SC to the last-known location of any PR-CM having the same MAC address as said CM-SC, and (c) if said locations differ, sending a ping to the last-known location of said PR-CM,

whereby, if said PR-CM responds to said ping and if a load balancing flag is set, it is determined that said CM-SC is a clone and, if said PR-CM does not respond to said ping, it is determined that said CM-SC is in fact said PR-CM at a new location.

19. The system recited in claim 18 wherein if the MAC address of said CM-SC does not match the MAC address of any PR-CM, said processor is adapted to send the MAC address and location of said CM-SC to a Regional Operating Center (ROC) serving said CMTS.

20. The system recited in claim 19 wherein said ROC includes a memory to store a MAC address and a last-known location of cable modems previously registered in the region of said ROC (PR-CM-R), and a processor to (a) compare the location of said CM-SC to the last-known location of any PR-CM-R having the same MAC address as said CM-SC, and (c) if said locations differ, having the CMTS serving the region of said PR-CM-R send a ping to the last-known location of said PR-CM-R,

whereby, if said PR-CM-R responds to said ping, it is determined that said CM-SC is a clone and, if said PR-CM-R does not respond to said ping, it is determined that said CM-SC is in fact said PR-CM-R at a new location.