System and method for detecting and reporting cable network devices with duplicate media access control addresses
View Patent ↗The detection of devices with duplicate media access controller (MAC) addresses in a cable network. A cable network device (CND) having a MAC address is connected by the cable network to a cable modem termination system (CMTS) having a gateway interface address. A centralized storage of historical cable modem MAC address/giaddr tuple data is used to identify CNDs that report duplicate MAC addresses. The cable network tracks the CND MAC address/giaddr tuple data of all CND requests that it receives and stores the MAC address/giaddr tuple data into a datastore (such as a database). When a CND seeks to access the network, the cable network looks into the datastore to determine whether the CND MAC address of the CND has previously been stored with a different associated giaddr, which would imply that there are multiple CNDs attached to different CMTSs where the CNDs share the same MAC address. If such duplication is detected, an appropriate remedial response is taken.
1. A method for detecting unauthorized access of a cable system by a cable network device (CND), the method comprising:
receiving at a cable modem termination system (CMTS) a DHCP request from a CND seeking access to the cable system, wherein the DHCP request comprises a MAC address;
forming a proffered identifier by combining the gateway interface address of the CMTS with the proffered MAC address;
comparing the proffered identifier to preauthorized identifiers in a datastore;
granting the CND temporary access to the cable system when the proffered identifier matches one of the preauthorized identifiers;
requesting from the CND a confirmation identifier;
comparing the CND confirmation identifier sent from the CND to confirmation identifiers stored in the datastore; and
granting the CND access to the cable system when the confirmation identifier matches one of the stored confirmation identifiers.
2. The method of claim 1 further comprising selecting a remedial response when the proffered identifier does not match a preauthorized identifier.
3. The method of claim 2 , wherein the remedial response is selected from the group consisting of denying the CND access to the network, sending an advisory message to a network administrator, and recording a proffered identifier in a log file.
4. The method of claim 1 , wherein the preauthorized identifiers are MAC address-gateway interface address tuples of authorized CNDs.
5. The method of claim 1 , wherein the datastore comprises a central database.
6. The method of claim 1 , wherein the datastore comprises a distributed database.
7. The method of claim 1 , wherein the cable system comprises a DHCP server linked to the CMTS and wherein the comparing the proffered identifier to preauthorized identifiers in a datastore and the comparing the CND confirmation identifier sent from the CND to confirmation identifiers stored in the datastore are performed by the DHCP server.
8. The method of claim 1 , wherein the cable system comprises a detection server linked to the CMTS and wherein the comparing the proffered identifier to preauthorized identifiers in a datastore and the comparing the CND confirmation identifier sent from the CND to confirmation identifiers stored in the datastore are performed by the detection server.
9. A system for detecting unauthorized access of a cable system by a cable network device (CND) comprising:
a CND seeking access to the cable network;
a CMTS, wherein the CMTS is configured for:
receiving a DHCP request comprising a MAC address of the CND seeking access to the cable network; and
forming a proffered identifier by combining a gateway interface address of the CMTS with the CND MAC address; and
a detection server linked to a datastore, wherein the detection server is configured for:
receiving the proffered identifier from the CMTS;
comparing the proffered identifier to preauthorized identifiers in a datastore;
granting the CND temporary access to the cable system when the proffered identifier matches one of the preauthorized identifiers;
requesting from the CND a confirmation identifier;
comparing the CND confirmation identifier sent from the CND to confirmation identifiers stored in the datastore; and
granting the CND access to the cable system when the confirmation identifier matches one of the stored confirmation identifiers.
10. The system of claim 9 further comprising selecting a remedial response when the proffered identifier does not match a preauthorized identifier.
11. The system of claim 10 , wherein the remedial response is selected from the group consisting of denying the CND access to the network, sending an advisory message to a network administrator, and recording a proffered identifier in a log file.
12. The system of claim 9 , wherein the preauthorized identifiers are MAC address-gateway interface address tuples of authorized CNDs.
13. The system of claim 9 , wherein the datastore comprises a central database.
14. The system of claim 9 , wherein the datastore comprises a distributed database.
15. The system of claim 9 , wherein the detection server comprises a DHCP server.