Method to block unauthorized network traffic in a cable data network
View Patent ↗The present invention teaches methods and systems for subscriber blocking of unauthorized network traffic in a cable data network. The cable modem termination system (CMTS) incorporates a data gateway agent that filters unauthorized traffic thereby eliminating consumption based subscribers from being responsible for related service charges. Embodiments incorporate the use of packet filtering, hybrid stateful packet filtering, content filtering, application layer filtering and time based filtering. Greater acceptance of consumption based billing is achieved by having the filter settings directed by the subscriber.
1. A system for providing data filtering from a data network comprising:
a data network termination device comprising a packet counter, wherein the packet counter determines a number of packets sent to a subscriber device from the packet counter (herein, “downstream packets”) via the data network and a number of packets originating from the subscriber device and sent to the packet counter (herein, “upstream packets”) via the data network;
a data gateway agent, wherein the packet counter is accessible to the data gateway agent; and
a datastore accessible to the data gateway agent for storing a data transfer rule selected by a subscriber, wherein the selected data transfer rule comprises packet filtering criteria selected by the subscriber, and
wherein the data gateway agent comprises instructions that cause the gateway agent to:
receive a packet prior to receipt of the packet by the packet counter;
access the data transfer rule stored in the datastore;
apply the packet filtering criteria to the packet to determine whether the packet violates the data transfer rule;
send a notice to the subscriber when the packet violates the data transfer rule;
receive a request to reverse the determination made by the data gateway agent regarding the packet;
reverse the determination made by the data gateway agent regarding the packet in response to the request;
modify in response to the request one or more packet filtering criteria of the data transfer rule applied to the packet; and
apply the data transfer rule as modified to subsequent determinations of the data gateway agent.
2. The system of claim 1 , wherein the data gateway agent comprises further instructions that cause the gateway agent to:
receive a notice of a receipt of unwanted packets;
generate a new data transfer rule comprising one or more packet filtering criteria that when applied to the unwanted packets would result in a determination made by the data gateway agent that the unwanted packets violate the new data transfer rule; and
save the new data transfer rule in the datastore.
3. The system of claim 1 , wherein the data gateway agent further comprises instructions that cause the gateway agent to:
forward the packet to the packet counter for counting when the packet does not violate the data transfer rule; and
apply a corrective measure to the packet when the packet violates the data transfer rule.
4. The system of claim 1 ,
wherein the data transfer rule is directed to a downstream UDP packet, and wherein the packet filtering criteria comprise whether the downstream UDP packet corresponds to an upstream UDP entry in a second datastore;
wherein the data gateway agent further comprises instructions that cause the gateway agent to:
receive upstream UDP packets from the subscriber device;
create the upstream UDP entry in the second datastore for each upstream UDP packet received,
receive a downstream UDP packet; and
determine that the downstream UDP packet violates the data transfer rule when the downstream UDP packet does not correspond to the upstream UDP entry in the second datastore.
5. The system of claim 1 , wherein the packet filtering criteria comprise determining whether the packet is directed to a particular port and wherein the packet violates the data transfer rule when the packet is directed to the particular port.
6. The system of claim 1 , wherein the packet filtering criteria comprise determining whether the packet comprises a particular protocol identifier and wherein the packet violates the data transfer rule when the packet is directed to the particular protocol identifier.
7. The system of claim 1 ,
wherein the data transfer rule is directed to a downstream TCP packet,
wherein the data gateway agent further comprises instructions that cause the gateway agent to:
receive downstream TCP packets; and
determine whether a downstream TCP packet has a SYN flag set and an ACK flag cleared,
wherein the packet filtering criteria comprise whether the downstream TCP packet has the SYN flag set and the ACK flag cleared, and
wherein the downstream TCP packet violates the data transfer rule when the TCP packet has the SYN flag set and the ACK flag cleared.
8. The system of claim 1 , wherein the packet filtering criteria comprise packet payload criteria and wherein the packet violates the data transfer rule when the packet includes one or more of the payload criteria.
9. The system of claim 8 , wherein the packet is an upstream packet and the packet payload criteria are selected from the group consisting of subscriber personal information, a telephone number, a social security number, a driver's license number, a credit card number, and location information.
10. The system of claim 1 , wherein the packet filtering criteria comprise time criteria and wherein the packet violates the data transfer rule when the packet is received during a preset time period.
11. The system of claim 1 , wherein the data network is selected from the group consisting of a fiber network, a cable network, a hybrid fiber coaxial cable network, a wireless network, and a wired network.
12. The system of claim 1 further comprising a billing agent and wherein the billing agent is configured to receive a subscriber count trigger and to transmit a count message to the subscriber comprising a current packet count upon the receipt of the subscriber count trigger.
13. The system of claim 12 , wherein the subscriber count trigger is selected from the group consisting of an end of billing cycle, a receipt of a subscriber count request message, a subscriber count exceeding a subscriber selected trigger amount, and a subscriber count exceeding data over a cable carrier selected trigger amount.
14. The system of claim 12 wherein the billing agent is further configured to automatically transmit an electronic message identifying current subscriber data transfer counts to the subscriber upon the occurrence of the subscriber count trigger.
15. A method for providing data filtering from a data network, the method comprising:
receiving by a processor a packet prior to receipt of the packet by a packet counter, wherein the packet counter determines a number of packets sent to a subscriber device from the packet counter (herein, “downstream packets”) via the data network and a number of packets originating from the subscriber device and sent to the packet counter (herein, “upstream packets”) via the data network;
accessing by the processor a data transfer rule selected by a subscriber stored in a datastore accessible to the processor, wherein the selected data transfer rule comprises packet filtering criteria selected by the subscriber;
applying by the processor the packet filtering criteria to the packet to determine whether the packet violates the data transfer rule;
sending a notice to the subscriber of the determination regarding the packet when the packet violates the data transfer rule;
receiving a request to reverse the determination made by the processor regarding the packet;
reversing the determination made by the processor regarding the packet in response to the request;
modifying in response to the request one or more packet filtering criteria of the data transfer rule applied to the packet; and
applying the data transfer rule as modified to subsequent determinations of the processor.
16. The method of claim 15 further comprising:
receiving a notice of a receipt of unwanted packets;
generating a new data transfer rule comprising one or more packet filtering criteria that when applied to the unwanted packets would result in a determination made by the processor that the unwanted packets violate the new data transfer rule; and
saving the new data transfer rule in the datastore.
17. The method of claim 15 , wherein the method further comprises:
forwarding the packet to the packet counter for counting when the packet does not violate the data transfer rule; and
applying a corrective measure to the packet when the packet violates the data transfer rule.
18. The method of claim 15 , wherein:
the data transfer rule is directed to a downstream UDP packet, wherein the packet filtering criteria comprise whether the downstream UDP packet corresponds to an upstream UDP entry in a second datastore,
receiving by the processor a packet prior to receipt of the packet by a packet counter comprises receiving an upstream UDP packet from the subscriber device, and
the method further comprises:
creating by the processor the upstream UDP entry in a second datastore for each upstream UDP packet received;
receiving by the processor a downstream UDP packet; and
determining by the processor that the packet violates the data transfer rule when the downstream UDP packet does not correspond to the upstream UDP entry in the second datastore.
19. The method of claim 15 , wherein the packet filtering criteria comprise determining whether the packet is directed to a particular port and wherein applying by the processor the packet filtering criteria to the packet to determine whether the packet violates the data transfer rule comprises determining that the packet violates the data transfer rule when the packet is directed to the particular port.
20. The method of claim 15 , wherein the packet filtering criteria comprise determining whether the packet comprises a particular protocol identifier and wherein applying by the processor the packet filtering criteria to the packet to determine whether the packet violates the data transfer rule comprises determining that the packet violates the data transfer rule when the packet is directed to the particular protocol identifier.
21. The method of claim 15 wherein the data transfer rule is directed to a downstream TCP packet, the packet filtering criteria comprise whether the downstream TCP packet has the SYN flag set and the ACK flag cleared, and wherein applying by the processor the packet filtering criteria to the packet to determine whether the packet violates the data transfer rule comprises determining that the packet violates the data transfer rule when the TCP packet has the SYN flag set and the ACK flag cleared.
22. The method of claim 15 , wherein the packet filtering criteria comprises payload criteria and wherein applying by the processor the packet filtering criteria to the packet to determine whether the packet violates the data transfer rule comprises determining that the packet violates the data transfer rule when the packet comprises the packet payload criteria.
23. The method of claim 22 , wherein the packet is an upstream packet and the payload criteria are selected from the group consisting of subscriber personal information, a telephone number, a social security number, a driver's license number, a credit card number, and location information.
24. The method of claim 15 , wherein the packet filtering criteria comprise time criteria and wherein applying by the processor the packet filtering criteria to the packet to determine whether the packet violates the data transfer rule comprises determining that the packet violates the data transfer rule when the packet is received during a preset time period.
25. The method of claim 15 , wherein the data network is selected from the group consisting of a fiber network, a cable network, a hybrid fiber coaxial cable network, a wireless network, and wired network.
26. The method of claim 15 , wherein the method further comprises configuring a billing agent to receive a subscriber count trigger and to transmit a count message to the subscriber comprising a current packet count upon the receipt of the subscriber count trigger.
27. The method of claim 15 , wherein the subscriber count trigger is selected from the group consisting of an end of billing cycle, a receipt of a subscriber count request message, a subscriber count exceeding a subscriber selected trigger amount, and a subscriber count exceeding data over a cable carrier selected trigger amount.
28. The method of claim 15 further comprising configuring a billing agent to automatically transmit an electronic message identifying current subscriber data transfer counts to the subscriber upon the occurrence of the subscriber count trigger.
29. The method of claim 15 , wherein the selected data transfer rule comprises two or more packet filtering criteria selected by the subscriber, wherein the data transfer rule establishes a sequence in which the two or more packet filtering criteria are to be applied, wherein if the packet passes a prior packet filtering criterion the sequence establishes a next packet filtering criterion to be applied and wherein the packet does not violate the data transfer rule if the packet passes all of the packet filtering criteria of the sequence, and wherein applying by the processor the packet filtering criteria to the packet to determine whether the packet violates the data transfer rule comprises applying the two or more packet filtering criteria according to the sequence.
30. The method of claim 29 , wherein the sequence established in the data transfer rule for applying the packet filtering criteria is selected from the group consisting of a sequence in which a first packet-filtering criterion is an IP protocol filtering criterion; a sequence in which a first filtering criterion is a URL filtering criterion; a sequence in which a first filtering criterion is a port number; a sequence in which a first filtering criterion is followed by a payload content filtering criterion; a sequence in which a last filtering criterion is a source address; and a sequence in which a last filtering criterion is a destination address.
31. The system of claim 1 , wherein the selected data transfer rule comprises two or more packet filtering criteria selected by the subscriber, wherein the data transfer rule establishes a sequence in which the two or more packet filtering criteria are to be applied, wherein if the packet passes a prior filtering criterion the sequence establishes a next filtering criterion to be applied and wherein the packet does not violate the data transfer rule if the packet passes all of the packet filtering criteria of the sequence, and wherein the instruction to apply the packet filtering criteria to the packet to determine whether the packet violates the data transfer rule comprises applying the two or more packet filtering criteria according to the sequence.
32. The system of claim 31 , wherein the sequence established in the data transfer rule for applying the packet filtering criteria is selected from the group consisting of a sequence in which a first filtering criterion is an IP protocol filtering criterion; a sequence in which a first filtering criterion is a URL filtering criterion; a sequence in which a first filtering criterion is a port number; a sequence in which a first filtering criterion is followed by a payload content filtering criterion; a sequence in which a last filtering criterion is a source address; and a sequence in which a last filtering criterion is a destination address.
33. A system for providing data filtering from a data network comprising:
a data network termination device comprising a packet counter, wherein the packet counter determines a number of packets sent to a subscriber device from the packet counter (herein, “downstream packets”) via the data network and a number of packets originating from the subscriber device and sent to the packet counter (herein, “upstream packets”) via the data network; and
a data gateway agent, wherein the packet counter is accessible to the data gateway agent;
a datastore accessible to the data gateway agent for storing a data transfer rule selected by a subscriber, wherein the selected data transfer rule comprises packet filtering criteria selected by the subscriber,
wherein the data gateway agent comprises instructions that cause the gateway agent to:
receive a packet prior to receipt of the packet by the packet counter;
access the data transfer rule stored in the datastore;
apply the packet filtering criteria to the packet to determine whether the packet violates the data transfer rule; and
send a notice to the subscriber when the packet violates the data transfer rule.