System and method for detecting and reporting cable modems with duplicate media access control addresses
View Patent ↗The detection of devices with duplicate media access controller (MAC) addresses in a cable network. A cable modem (CM) having a MAC address is connected by the cable network to a cable modem termination system (CMTS) having a gateway interface address. A centralized storage of historical cable modem MAC address/giaddr pair data is used to identify cable modems (CM's) that report duplicate MAC addresses. A server tracks the CM MAC address/giaddr pair data of all CM requests that it receives and stores the MAC address/giaddr pair data into a datastore (such as a database). When a CM seeks to access the network, the server looks into the datastore to determine whether the CM MAC address of the CM has previously been stored with a different associated giaddr, which would imply that there are multiple CMs attached to different CMTSs where the CMs share the same MAC address. If such duplication is detected, a appropriate remedial response is taken.
1. A method for detecting unauthorized access of a cable system by a cable modem, the method comprising:
receiving at a cable modem termination system (CMTS), a MAC address proffered by a cable modem seeking to register with the cable system;
forming a proffered MAC address/giaddr pair by combining the gateway interface address of the CMTS with the proffered MAC address;
comparing components of the proffered MAC address/giaddr pair to the components of each of one or more MAC address/giaddr pairs stored in a datastore;
making a determination whether the proffered MAC address/giaddr pair and any of the one or more stored MAC address/giaddr pairs satisfy a matching criteria comprising a same MAC address component and a different gateway interface address component; and
in the event the proffered MAC address/giaddr pair and any of the one or more stored MAC address/giaddr pairs satisfy the matching criteria, selecting a remedial response, wherein the remedial response comprises denying the modem registration with the cable system.
2. The method for detecting unauthorized access of a cable system by a cable modem of claim 1 , wherein the datastore comprises a central database.
3. The method for detecting unauthorized access of a cable system by a CM of claim 1 , wherein the datastore comprises a distributed database.
4. The method for detecting unauthorized access of a cable system by a CM of claim 1 , wherein the cable system comprises a DHCP server linked to the CMTS and wherein the DHCP server makes the determination with respect to the matching criteria.
5. The method for detecting unauthorized access of a cable system of claim 1 , wherein the remedial response further comprises sending an advisory message to a network manager, and recording the event in a log file.
6. The method for detecting unauthorized access of a cable system by a CM of claim 1 , wherein the method further comprises in the event that the proffered MAC address/giaddr pair and any of the one or more stored MAC address/giaddr pairs do not satisfy the matching criteria, storing the proffered MAC address/giaddr pair in the datastore.
7. A method for detecting unauthorized access of a cable system by a cable modem, wherein the cable system comprises a plurality of regional cable networks, the method comprising:
receiving at a cable modem termination system (CMTS) a MAC address proffered by a cable modem seeking to register with the one of the plurality of regional cable networks;
forming a proffered MAC address/giaddr pair by combining the gateway interface address of the CMTS with the proffered MAC address;
comparing components of the proffered MAC address/giaddr pair to the components of each of one or more MAC address/giaddr pairs stored in a regional datastore; and
making a first determination whether the proffered MAC address/giaddr pair and any of the one or more regionally stored MAC address/giaddr pairs satisfy a matching criteria comprising a same MAC address component and a different gateway interface address component;
in the event the proffered MAC address/giaddr pair and any of the one or more stored MAC address/giaddr pairs satisfy the matching criteria, selecting a regional remedial response, wherein the regional remedial response comprises denying the modem registration with the cable system;
in the event that the proffered MAC address/giaddr pair and any of the one or more regionally stored MAC address/giaddr pairs do not satisfy the matching criteria, comparing the components of the proffered MAC address/giaddr pair to the components of each of one or more stored MAC address/giaddr pairs stored in a central datastore, wherein the central datastore comprises regionally stored MAC address/giaddr pairs from each of the regional datastores;
making a second determination whether the proffered MAC address/giaddr pair and any of the one or more centrally stored MAC address/giaddr pairs satisfy the matching criteria; and
in the event the proffered MAC address/giaddr pair and any of the one or more centrally stored MAC address/giaddr pairs satisfy the matching criteria, selecting a central remedial response, wherein the central remedial response comprises denying the modem registration with the cable system.
8. The method for detecting unauthorized access of a cable system of claim 7 , wherein the regional datastore and the central datastore each comprise a central database.
9. The method for detecting unauthorized access of a cable system of claim 7 , wherein the regional datastore and the central datastore each comprise a distributed database.
10. The method for detecting unauthorized access of a cable system of claim 7 , wherein the at least one of the plurality of regional cable networks further comprises a DHCP server linked to the CMTS and wherein the DHCP server makes the determination with respect to the first matching criteria.
11. The method for detecting unauthorized access of a cable system of claim 7 , the method further comprising in the event the proffered MAC address/giaddr pair and any of the one or more of centrally stored MAC address/giaddr pairs does not satisfy the matching criteria, storing the proffered MAC address/giaddr pair in the regional datastore and the central datastore.
12. The method for detecting unauthorized access of a cable system of claim 7 , wherein the regional remedial response further comprises sending a regional advisory message to a network manager, and recording a regional event in a log file and wherein the central remedial response further comprises sending central advisory message to the network manager, and recording a central event in the log file.
13. A system for detecting unauthorized access of a cable network by a cable modem, the system comprising:
a CMTS adapted to:
receive a MAC address of a CM seeking to register with the cable system; and
form a proffered MAC address/giaddr pair by combining a gateway interface address of the CMTS with the MAC address; and
a detection server linked to a datastore, the detection server adapted to:
receive the proffered MAC address/giaddr pair from the CMTS;
compare the components of the proffered MAC address/giaddr pair to the components of each of one or more stored MAC address/giaddr pairs stored in the datastore; and
determine whether the proffered MAC address/giaddr pair and any of the one or more stored MAC address/giaddr pairs satisfy a matching criteria comprising a same MAC address component and a different gateway interface address component; and
in the event the proffered MAC address/giaddr pair and any of the one or more stored MAC address/giaddr pairs satisfy the matching criteria, select a remedial response, wherein the remedial response comprises denying the modem registration with the cable system.
14. The system of claim 13 , wherein the datastore comprises a central database.
15. The system of claim 13 , wherein the datastore comprises a distributed database.
16. The system of claim 13 , wherein the remedial response further comprises sending an advisory message to a network manager and recording the event in a log file.
17. The system of claim 13 , wherein the detection server is further adapted to, in the event the proffered MAC address/giaddr pair and any of the one or more stored MAC address/giaddr pairs do not satisfy the matching criteria, store the proffered MAC address/giaddr pair in the datastore.
18. The system of claim 13 , wherein the detection server comprises a DHCP server.
19. A system for detecting unauthorized access of a cable network comprising a plurality of regional cable networks by a cable modem the system comprising:
a CMTS adapted to:
receive a MAC address of a cable modem seeking to register with one of the plurality of regional cable networks; and
form a proffered MAC address/giaddr pair by combining a gateway interface address of the CMTS with the MAC address; and
a regional detection server linked to a regional datastore, the regional detection server adapted to:
receive the proffered MAC address/giaddr pair from the CMTS;
compare the components of the proffered MAC address/giaddr pair to the components of each of one or more stored MAC address/giaddr pairs stored in the regional datastore; and
determine whether the proffered MAC address/giaddr pair and any of the one or more regionally stored MAC address/giaddr pairs satisfy a matching criteria comprising a same MAC address component and a different gateway interface address component; and
in the event the proffered MAC address/giaddr pair and any of the one or more regionally stored MAC address/giaddr pairs satisfy the matching criteria, select a regional remedial response, wherein the regional remedial response comprises denying the modem registration with the cable system;
in the event that the proffered MAC address/giaddr pair and any of the one or more regionally stored MAC address/giaddr pairs do not satisfy the first matching criteria, send the proffered MAC address/giaddr pair to a central detection server; and
the central detection server linked to a central datastore, the central detection server adapted to:
compare the components of the proffered MAC address/giaddr pair to the components of each of one or more stored MAC address/giaddr pairs stored in the central datastore, wherein the central datastore comprises regionally stored MAC address/giaddr pairs from each of the regional datastores;
determine whether the proffered MAC address/giaddr pair and any of the one or more centrally stored MAC address/giaddr pairs satisfy the matching criteria;
in the event the proffered MAC address/giaddr pair and any of the one or more centrally stored MAC address/giaddr pairs satisfy the matching criteria, select a central remedial response, wherein the central remedial response comprises denying the modem registration with the cable system.
20. The system of claim 19 , wherein the regional datastore and the central datastore each comprise a central database.
21. The system of claim 19 , wherein the regional datastore and the central datastore each comprise a distributed database.
22. The system of claim 19 , wherein the regional detection server comprises a DHCP server.
23. The system of claim 19 , wherein the regional remedial response further comprises sending a regional advisory message to a network manager and recording a regional event in a log file and where the central remedial response further comprises sending a central advisory message to the network manager and recording a central event in the log file.
24. The system of claim 19 , wherein the central detection server is further adapted to, in the event the proffered MAC address/giaddr pair and any of the one or more centrally stored MAC address/giaddr pairs do not satisfy the matching criteria, store the proffered MAC address/giaddr pair in the regional datastore and the central datastore.
25. A method for detecting unauthorized access of a cable system by a cable modem, the method comprising:
receiving at a cable modem termination system (CMTS) a MAC address of a cable modem seeking to register with the cable system;
forming a proffered MAC address/giaddr pair by combining the gateway interface address of the CMTS with the proffered MAC address;
comparing components of the proffered MAC address/giaddr pair to components of preauthorized identifiers in a datastore;
in the event the components of the proffered MAC address/giaddr pair matches the components of a preauthorized identifier, granting the cable modem temporary registration with the cable system;
requesting from the cable modem a confirmation identifier; and
in the event the confirmation identifier is received from the cable modem, granting the cable modem registration with the cable system.
26. The method for detecting unauthorized access of a cable system by a cable modem of claim 25 , the method further comprising in the event the proffered MAC address/giaddr pair does not matches a preauthorized identifier, selecting a remedial response.
27. The method for detecting unauthorized access of a cable system by a cable modem of claim 25 , the method further comprising in the event the confirmation identifier is not received, terminating the temporary registration with the cable system.