INTER-GATEWAY CLONED DEVICE DETECTOR USING PROVISIONING REQUEST ANALYSIS

• US 20100043041A1
• Filed: 08/12/2008
• Published: 02/18/2010
• Est. Priority Date: 08/12/2008
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: FORD, Alan, Lee, Steve
• Granted Patent: US 7,986,690 B2
• Time in Patent Office: Days
• US Class Current: 725/111
• CPC Class Codes: H04N 21/42676 for modulating an analogue carrier signal to encode digital information or demodulating it to decode digital information, e.g. ADSL or cable modem
• CPC Class Codes: H04N 21/42684 Client identification by a unique number or address, e.g. serial number, MAC address, socket ID network arrangements, protocols or services for addressing or naming H04L61/00
• CPC Class Codes: H04N 21/6118 involving cable transmission, e.g. using a cable modem

Abstract

In one embodiment, a cloned cable modem detector is configured to assemble a table associating cable modem physical addresses to Cable Modem Termination Systems (CMTSs) according to provisioning requests forwarded from the CMTSs. When one of the provisioning requests associates a cable modem physical address with a different CMTS than an existing association in the table, the detector outputs an indication of cable modem cloning.

Claims

1. An apparatus comprising circuitry configured to:

inspect a provisioning request originating from a cable modem for a field added subsequent to transmission of the provisioning request from the cable modem;

analyze the added field for a value identifying a Cable Modem Termination System (CMTS);

determine whether a physical address for the cable modem is associated with another CMTS besides the CMTS identified by the value from the added field; and

output an indication of a cable modem cloning according to the determination.

2. The apparatus of claim 1 wherein the provisioning request is a current provisioning request and the circuitry is further configured to:

receive a plurality of previous provisioning requests, the previous provisioning requests received before the current provisioning request, the previous provisioning requests having relay fields added thereto;

map Media Access Control (MAC) addresses of cable modems to CMTSs according to information stored in the relay fields as the previous provisioning requests are received;

generate a table according to the mappings; and

compare the physical address to the generated table to determine whether the physical address for the cable modem is associated with another CMTS besides the CMTS identified by the value from the added field;

wherein if the comparison indicates that the physical address is absent from the formatted table, the circuitry adds a new mapping to the table and does not output the indication;

wherein if the comparison indicates that the physical address is present in the formatted table, the circuitry outputs the indication according to the determination.

3. The apparatus of claim 1 wherein the circuitry is further configured to:

compare a Media Access Control (MAC) address included in the added field to a MAC address included in an original portion of the provisioning request; and

filter the provisioning request if the MAC addresses are not the same.

5. The apparatus of claim 1 wherein the circuitry is further configured to:

identify a communication interface on the CMTS according to information included in the provisioning request; and

output the indication if a table associating cable modem addresses with CMTS communication interfaces indicates that the physical address is associated with another communication interface on the CMTS.

6. The apparatus of claim 1 wherein the circuitry is further operable to cause the cable modem to be reset if the indication is output.

7. The apparatus of claim 1 wherein the value is a network address and the circuitry is further configured to:

determine whether the network address is included in an equivalency list; and

output the indication only if the network address is not included in the equivalency list.

21. The apparatus of claim 1 wherein the circuitry is further configured to perform the determination by comparing the value from the added field to a table associating cable modem addresses to CMTSs, the associations in the table based on information from previously received provisioning requests.

4. The apparatus of claim 4 wherein the circuitry is further configured to add an entry for the provisioning request to a table associating cable modems and CMTSs according to whether the MAC addresses are the same.

8. An apparatus, comprising:

means for receiving, over a network, provisioning requests originating from cable modems;

means for assembling a table associating cable modem addresses with Cable Modem Termination Systems (CMTSs) according to relay fields attached to the received provisioning requests;

means for comparing information from a newly received provisioning request to the table; and

means for detecting and indicating cable modem cloning if the comparison indicates that a physical address for a cable modem is associated with more than one CMTS.

9. The apparatus of claim 8, further comprising:

means for formatting the table to associate the cable modem addresses with CMTS communication interface identifiers; and

means for detecting and indicating cable modem cloning if the comparison indicates that the physical address for the cable modem is associated with a plurality of upstream or downstream communication interfaces on a same one of the CMTSs.

10. The apparatus of claim 8, further comprising:

means for comparing information from a relay field of the newly received provisioning request to the table to identify cable modem cloning.

11. The apparatus of claim 10 wherein the relay field of the newly received provisioning request is a DHCP option 82 field added by a DHCP relay agent.

12. The apparatus of claim 8, further comprising:

means for determining whether the CMTSs associated with the cable modem are included in a subset of CMTS associated with valid cable modem movement;

wherein cable modem cloning is indicated only if the CMTSs associated with the cable modem are not included in the subset.

13. A method, comprising:

formatting a table on a computing device to associate physical addresses with gateways;

receiving, over a network, a provisioning request originating from a network device;

comparing information from the provisioning request to the table, wherein the information is extracted from a relay field included in the provisioning request; and

indicating cloning according to whether the comparison indicates that the network device is associated with more than one gateway.

14. The method of claim 13, wherein the relay field is added to the provisioning request subsequent to original transmission of the provisioning request, the relay field added by one of the gateways.

15. The method of claim 14, wherein the relay field includes an IP address of one of the gateways.

16. The method of claim 15, further comprising:

analyzing the formatted table to identify an entry containing a physical address that is identical to an originating physical address contained in the provisioning request;

comparing the IP address from the relay field to an IP address in the identified entry; and

indicating cloning if the IP addresses do not match.

17. The method of claim 16, further comprising:

determining whether the IP addresses are included in a list of equivalent IP addresses; and

indicating cloning if the IP addresses are absent from the equivalency list.

18. The method of claim 17 wherein the provisioning request is a broadcast DHCP discover relayed to a network device used for the analysis, comparison, and indication.

19. The method of claim 18, further comprising configuring the gateways to forward received DHCP discovers to an address corresponding to the network device.

20. The method of claim 19 wherein the gateways are Cable Modem Termination Systems (CMTSs).