Methods and system for automated ad hoc customer premise equipment bi-directional vulnerability scanning

1. A method for automated customer premise equipment (CPE) bi-directional vulnerability scanning, the method comprising:

obtaining, by an auto provisioning server, telemetry data from a cable modem termination system (CMTS) based on CPE information for a CPE for which a bi-directional vulnerability scan is to be performed;

configuring, by the auto provisioning server using the CPE information, switches to form a virtual local area network (VLAN) channel between a LAN scanner and the designated CPE;

initiating, by the auto provisioning server, bi-directional vulnerability scans at a wide area network (WAN) scanner and the LAN scanner using a stored WAN side IP address and a stored LAN side IP address, respectively; and

configuring at least one network device based on results from the bi-directional vulnerability scans of the WAN scanner and the LAN scanner.

2. The method of claim 1 , the method further comprising:

confirming, by the auto provisioning server, the CPE information with the telemetry data.

3. The method of claim 1 , wherein the CPE information includes Media Access Control (MAC) address and location information of the designated CPE.

4. The method of claim 3 , wherein the telemetry data is obtained using the MAC address of the designated CPE.

5. The method of claim 1 , the method further comprising:

generating, by the auto provisioning server, a VLAN tag from the CPE information.

6. The method of claim 5 , the method further comprising:

generating, by the auto provisioning server, a VLAN tag from location information in the CPE information.

7. The method of claim 1 , the method further comprising:

storing, by the auto provisioning server, the WAN side IP address from the telemetry data upon a successful confirmation of the CPE information.

8. The method of claim 1 , the method further comprising:

provisioning, by the auto provisioning server, the LAN scanner to obtain the LAN side Internet Protocol (IP) address from the designated CPE; and

storing, by the auto provisioning server, the LAN side IP address from the LAN scanner.

9. The method of claim 1 , the method further comprising:

generating, by the auto provisioning server, a vulnerability scan report based on results from the WAN scanner and the LAN scanner, wherein the report identifies at least one security flaw or breach.

10. A system comprising:

a controller;

a service provider facing scanner;

a customer facing scanner;

a plurality of switches;

a termination equipment;

a plurality of customer premise equipment (CPEs) in communication with the termination equipment, the service provider facing scanner, and the plurality of switches;

a scan controller in communication with the controller, the service provider facing scanner, the customer facing scanner, the plurality of switches, and the termination equipment, the scan controller configured to:

collect telemetry data from the termination equipment using a Media Access Control (MAC) address for a selected CPE from the plurality of CPEs;

determine a virtual local area network (VLAN) tag using the location information to establish, via the plurality of switches, a pathway between the customer facing scanner and the selected CPE; and

send vulnerability scan requests to the service provider facing scanner and the customer facing scanner using a service provider Internet Protocol (IP) address obtained from the termination equipment and a customer facing IP address obtained from the selected CPE, respectively; and

the controller configured to configure at least one network device based on results from the vulnerability scan requests.

11. The system of claim 10 , the scan controller configured to validate the MAC address and location information for the selected CPE with the telemetry data.

12. The system of claim 10 , the scan controller configured to store the service provider facing IP address from the telemetry data upon a successful validation of the MAC address and the location information.

13. The system of claim 10 , the scan controller configured to store the customer facing IP address from the customer facing scanner.

14. The system of claim 10 , wherein the results identify at least one security flaw or breach.

15. A method for automated bi-directional vulnerability scanning, the method comprising:

validating, by an auto provisioning server, telemetry data obtained from termination equipment associated with customer premise equipment (CPE) on which to perform a scan against CPE data provided by the CPE;

establishing, by the auto provisioning server, a path between a customer scanner and the CPE by configuring switches using a virtual local area network (VLAN) tag generated from the CPE data;

provisioning, by the auto provisioning controller, the customer scanner to obtain a customer side Internet Protocol (IP) address from the CPE;

requesting, by the auto provisioning controller, scans at a service provider scanner and the customer scanner using a service provider Internet Protocol (IP) address and a customer side IP address obtained from the CPE, respectively; and

configuring at least one network device based on results from the scans.

16. The method of claim 15 , wherein the CPE data includes Media Access Control (MAC) address and location information of the CPE.

17. The method of claim 16 , wherein the telemetry data is obtained using the MAC address of the CPE.

18. The method of claim 16 , wherein the VLAN tag is generated from the location information.

19. The method of claim 15 , wherein the service provider IP address is obtained from the telemetry data.

20. The method of claim 15 , wherein the results identify at least one security flaw or breach.