Methods and system for automated ad hoc customer premise equipment bi-directional vulnerability scanning

1. A method for automated customer premise equipment (CPE) bi-directional vulnerability scanning, the method comprising:

receiving, by an auto provisioning server, CPE information for a designated CPE to initiate a bi-directional vulnerability scan;

obtaining, by the auto provisioning server, telemetry data from a cable modem termination system (CMTS) based on the CPE information;

configuring, by the auto provisioning server using the CPE information, switches to form a virtual local area network (VLAN) channel between a LAN scanner and the designated CPE;

provisioning, by the auto provisioning server, the LAN scanner to obtain a LAN side Internet Protocol (IP) address from the designated CPE;

initiating, by the auto provisioning server, vulnerability scans at a wide area network (WAN) scanner and the LAN scanner using a stored WAN side IP address and a stored LAN side IP address, respectively;

generating, by the auto provisioning server, a vulnerability scan report based on results from the WAN scanner and the LAN scanner; and

configuring at least one network device based on the report.

2. The method of claim 1 , the method further comprising:

verifying, by the auto provisioning server, the CPE information with the telemetry data.

3. The method of claim 1 , wherein the CPE information includes Media Access Control (MAC) address and location information of the designated CPE.

4. The method of claim 3 , wherein the telemetry data is obtained using the MAC address of the designated CPE.

5. The method of claim 3 , the method further comprising:

generating, by the auto provisioning server, a VLAN tag from the CPE information.

6. The method of claim 5 , wherein the VLAN tag is generated based on the location information.

7. The method of claim 1 , the method further comprising:

storing, by the auto provisioning server, a WAN side IP address from the telemetry data upon a successful verification of the CPE information.

8. The method of claim 7 , the method further comprising:

storing, by the auto provisioning server, a LAN side IP address from the LAN scanner.

9. The method of claim 1 , wherein the report identifies at least one security flaw or breach.

10. A system comprising:

a controller;

a service provider facing scanner;

a customer facing scanner;

a plurality of switches;

a termination equipment;

a plurality of customer premise equipment (CPEs) in communication with the termination equipment, the service provider facing scanner, and the plurality of switches;

a scan controller in communication with the controller, the service provider facing scanner, the customer facing scanner, the plurality of switches, and the termination equipment, the scan controller configured to:

obtain from the controller a selected CPE from the plurality of CPEs and Media Access Control (MAC) address and location information associated with the selected CPE;

obtain telemetry data from the termination equipment using the MAC address;

validate the MAC address and location information with the telemetry data;

generate a virtual local area network (VLAN) tag using the location information to establish, via the plurality of switches, a pathway between the customer facing scanner and the selected CPE upon a successful validation;

provision the customer facing scanner to obtain a customer facing side Internet Protocol (IP) address from the selected CPE;

send vulnerability scan requests to the service provider facing scanner and the customer facing scanner using a service provider IP address obtained from the termination equipment and the customer facing IP address, respectively; and

generate a vulnerability scan report based on results from the service provider scanner and the customer facing scanner; and

the controller configured to configure at least one network device based on the report.

11. The system of claim 10 , the scan controller configured to configure the plurality of switches using the VLAN tags.

12. The system of claim 10 , the scan controller configured to store a service provider facing IP address from the telemetry data upon a successful validation of the MAC address and the location information.

13. The system of claim 10 , the scan controller configured to store a customer facing IP address from the customer facing scanner.

14. The system of claim 10 , wherein the report identifies at least one security flaw or breach.

15. A method for automated bi-directional vulnerability scanning, the method comprising:

obtaining, by an auto provisioning controller, a customer premise equipment (CPE) on which to perform a scan and associated CPE data;

validating, by the auto provisioning server, the CPE data against telemetry data obtained from termination equipment associated with CPE;

generating, by the auto provisioning server, a virtual local area network (VLAN) tag using the CPE data;

establishing, by the auto provisioning server, a path between a customer scanner and the CPE by configuring switches using the VLAN tag;

provisioning, by the auto provisioning controller, the customer scanner to obtain a customer side Internet Protocol (IP) address from the CPE;

requesting, by the auto provisioning controller, scans at a service provider scanner and the customer scanner using a service provider IP address and the customer side IP address, respectively;

generating, by the auto provisioning controller, a vulnerability scan report based on results from the service provider scanner and the customer scanner; and

configuring at least one network device based on the report.

16. The method of claim 15 , wherein the CPE data includes Media Access Control (MAC) address and location information of the CPE.

17. The method of claim 16 , wherein the telemetry data is obtained using the MAC address of the CPE.

18. The method of claim 16 , wherein the VLAN tag is generated from the location information.

19. The method of claim 15 , wherein the service provider IP address is obtained from the telemetry data.

20. The method of claim 15 , wherein the report identifies at least one security flaw or breach.