System and method for evaluating a customer premise equipment (CPE) device

Systems and methods for evaluating a customer premise equipment (CPE) device. A network element management system may send an alteration request to a configurable coaxial tap that includes a radio frequency modulator-demodulator combination. The alteration request include information that causes the configurable coaxial tap to directly examine packets that are sent to or received from the CPE device.

BACKGROUND

A theft of service (ToS) attack is a cyberattack in which a person or entity obtains access to a resource or service (e.g., bandwidth, network access, Internet Protocol (IP) services, etc.) without lawfully compensating the service provider for the use of those resources or services. Increasingly, ToS attacks are being perpetuated by nefarious actors through a variety of different types of unauthorized or illegitimate devices, such as rogue modems, orphan modems, cloned modems, persistent duplicate MAC addresses, etc. These unauthorized or illegitimate devices may cause network congestion and/or consume a significant amount of limited network resources (e.g., network bandwidth, etc.) without compensating the service provider for the use of those resources. In addition, these unauthorized or illegitimate devices are increasingly used by hackers, thieves, organized fraud rings, and other nefarious actors to launch cyber-attacks, gain remote control of devices, steal private or sensitive information, hide their true identities, or engage in other malicious activities. Accordingly, new and improved solutions that better identify and respond to unauthorized or illegitimate devices will be beneficial to internet service providers and the consumers of their services.

SUMMARY

The various aspects include method of evaluating a customer premise equipment (CPE) device, which may include receiving an alteration request in a configurable coaxial tap that includes a radio frequency modulator-demodulator combination and evaluating the CPE by the configurable coaxial tap directly examining packets that are sent to or received from the CPE device in response to the configurable coaxial tap receiving the alteration request. Some aspects may include performing, by the configurable coaxial tap, packet sniffing operations to intercept packets that are sent to or received from the CPE device. Some aspects may include demodulating, by the configurable coaxial tap, intercepted packets and storing the results in a memory. Some aspects may include decoding, by the configurable coaxial tap, demodulated packets and read data over cable service interface specification (DOCSIS) and Ethernet frames. Some aspects may include remodulating the packets and sending the remodulated packets to at least one or more of a home network that includes the CPE or a cable modem termination system (CMTS). In some aspects, sending the remodulated packets to at least one or more of the home network that includes the CPE or the CMTS may include determining whether to send the remodulated packets to the home network or to the CMTS based on traffic flow and sending the remodulated packets the home network or to the CMTS based on a result of the determination.

Further aspects may include a computing device or system (e.g., a configurable coaxial tap, etc.) having a processor configured with processor-executable instructions to perform various operations corresponding to the methods discussed above. Further aspects may include a non-transitory processor-readable storage medium having stored thereon processor-executable instructions configured to cause a computing device processor to perform various operations corresponding to the method operations discussed above. Further aspects may include a computing device having various means for performing functions corresponding to the method operations discussed above.

DETAILED DESCRIPTION

In overview, some embodiments include smart tap devices that are configured to alter the pre-equalization coefficients and/or RF communications from that which may be currently configured on the CMTS to a given CPE device in order to cause the given CPE device to alert the CMTS of impaired or altered operation. The smart tap devices (or another component in the network) may correlate the CPE device that reports the impaired or altered condition with that of the remote device configuration altering the RF communications so that a physical location of the given CPE device in question on the communications network may be determined. By knowing the physical communications network location, a physical address of the given CPE device may also be determined. The physical location and physical address of the CPE device may be used for troubleshooting network problems, locating compromised devices used in Theft-of-Service, as well as for aiding law-enforcement requests.

The term “service provider network” is used generically herein to refer to any network suitable for providing consumers with access to the Internet or IP services over broadband connections. Service provider networks may encompass both wired and wireless networks/technologies. Examples of wired network technologies and networks that may be included within a service provider network include cable networks, fiber optic networks, hybrid-fiber-cable networks, Ethernet, local area networks (LAN), metropolitan area networks (MAN), wide area networks (WAN), networks that implement the data over cable service interface specification (DOCSIS), networks that utilize asymmetric digital subscriber line (ADSL) technologies, etc. Examples of wireless network technologies and networks that may be included within a service provider network include third generation partnership project (3GPP), long term evolution (LTE) systems, third generation wireless mobile communication technology (3G), fourth generation wireless mobile communication technology (4G), fifth generation wireless mobile communication technology (5G), global system for mobile communications (GSM), universal mobile telecommunications system (UMTS), high-speed downlink packet access (HSDPA), 3GSM, general packet radio service (GPRS), code division multiple access (CDMA) systems (e.g., cdmaOne, CDMA2000™), enhanced data rates for GSM evolution (EDGE), advanced mobile phone system (AMPS), digital AMPS (IS-135/TDMA), evolution-data optimized (EV-DO), digital enhanced cordless telecommunications (DECT), Worldwide Interoperability for Microwave Access (WIMAX), wireless local area network (WLAN), Wi-Fi Protected Access I & II (WPA, WPA2), Bluetooth®, land mobile radio (LMR), and integrated digital enhanced network (iden). Each of these wired and wireless technologies involves, for example, the transmission and reception of data, signaling and/or content messages.

Any references to terminology and/or technical details related to an individual wired or wireless communications standard or technology are for illustrative purposes only, and not intended to limit the scope of the claims to a particular communication system or technology unless specifically recited in the claim language.

The term “computing system” may be used generically herein to refer to any electronic device that includes a programmable processor, memory and circuitry for providing the functionality described herein. As such, a computing system may include any one or all of modems, routers, network switches, network bridges, residential gateways (RG), access nodes (AN), bridged residential gateway (BRG), fixed mobile convergence products, home networking adapters and Internet access gateways that enable consumers to access communications service providers' services, satellite or cable set top boxes, laptop computers, rack mounted computers, routers, cellular telephones, smart phones, personal or mobile multi-media players, personal data assistants (PDAs), customer-premises equipment (CPE), personal computers, tablet computers, smart books, palm-top computers, desk-top computers, wireless electronic mail receivers, multimedia Internet enabled cellular telephones, wireless gaming controllers, streaming media players (for example, ROKU™) smart televisions, digital video recorders (DVRs), and similar electronic devices which include a programmable processor and memory and circuitry for providing the functionality described herein.

The term “user equipment (UE)” may be used herein to refer to any one or all of satellite or cable set top boxes, laptop computers, rack mounted computers, routers, cellular telephones, smart phones, personal or mobile multi-media players, personal data assistants (PDAs), customer-premises equipment (CPE), personal computers, tablet computers, smart books, palm-top computers, desk-top computers, wireless electronic mail receivers, multimedia Internet enabled cellular telephones, wireless gaming controllers, streaming media players (such as, ROKU™), smart televisions, digital video recorders (DVRs), modems, routers, network switches, residential gateways (RG), access nodes (AN), bridged residential gateway (BRG), fixed mobile convergence products, home networking adapters and Internet access gateways that enable consumers to access communications service providers' services and distribute them around their house via a local area network (LAN), and similar electronic devices which include a programmable processor and memory and circuitry for providing the functionality described herein.

The terms “theft of service device” and “TOS device” may be used interchangeably herein to refer to a device that allows a person or entity to obtain access to a network resource or service without lawfully compensating the service provider network.

The term “illegitimate device” is used herein to refer to a media access control (MAC) address or device (e.g., cable modem, etc.) that is not being used or operated in accordance with standards, policies or rules set forth by a service provider network. For example, an illegitimate device may be an unauthorized device that uses the resources or services of the service provider network without proper authorization from the service provider network and/or without lawfully compensating the service provider network. An illegitimate device may also be a device that is authorized to use the resources or services of the service provider network, but which has been hijacked or is otherwise not being used or operated in accordance with standards, policies or rules set forth by the service provider network.

A cable modem is a type of network bridge that provides bi-directional data communication via radio frequency channels on coaxial cable infrastructure, a hybrid fiber-coaxial (HFC), radio frequency over glass (RFoG) or other similar technologies. Cable modems are primarily used to deliver broadband Internet access in the form of cable Internet, taking advantage of the high bandwidth of a HFC or RFoG network. For ease of reference, some of the embodiments in this application are discussed with reference to a modem or cable modem. While the embodiments are particularly useful for identifying and responding to modems and other edge devices that register with a cable modem termination system (CMTS), it should be understood that the embodiments may apply to any type of computing system that uses IP connectivity. Therefore, the various embodiments disclosed in this application should not be limited in scope to modems or cable modems unless expressly recited.

Many subscribers connect to the Internet via a customer premise equipment (CPE) component/device. A CPE device may include a cable modem, digital subscriber line modem, router, switch, firewall, packet filter, wireless access point, and/or a residential gateway that provide network connectivity to home or small office network. In particular, a CPE device may allow UE devices on the local area network (LAN) to connect to a wide area network (WAN) and ultimately the Internet.

The various embodiments improve the performance, efficiency and functioning of the service provider network and the components/devices that are included in, utilize, or benefit from the service provider network.

FIG.1is a simplified example of a network100that may be used to implement the various embodiments. In the example illustrated inFIG.1, the network100includes a local area network (LAN)101that includes user equipment (UE)102devices, a customer premise equipment (CPE)106component/device, and a wireless extender or access point108. The UE102devices may be coupled to the CPE106component/device via wired and/or wireless communication links. The CPE106may include a cable modem (CM) that is coupled to a digital subscriber line access multiplexer (DSLAM) or a cable modem termination system (CMTS)110. The CM in the CPE106component/device may be a network bridge that provides bi-directional data communication via radio frequency channels on a hybrid fiber-coaxial (HFC) and/or radio frequency over glass (RFoG) infrastructure.

The CMTS110may be configured to facilitate high speed communications between the CPE106and the components within a service provider network114, which allow the UE102devices to send and receive information to and from the Internet116. The CMTS110component may be deployed in a headend or hubsite which serves thousands of homes or LANs101.

The service provider network114may include and/or may be coupled to a data analytics system118suitable or analyzing and storing information. The service provider network114may also include various network components for providing consumers with access to the Internet116or IP services over broadband connections. For example, the service provider network114may include a subscriber management component configured to store subscriber information and/or perform various subscription management operations, a policy component configured to determine and/or enforce various rules and policy decisions, a datacenter component, a virtual machine component, etc.

FIG.2illustrates a system200in which the upstream communication signals between a CPE106and CMTS110are impaired. In the example illustrated inFIG.2, the CPE106transmits a main RF signal in the upstream path towards the CMTS110. As the signal propagates through the coaxial cable, the signal experiences a coupling loss, isolation, impedance mismatch, micro-reflection, etc. For example, corrosion on a center seizure screw where the coax cable enters an RF amplifier or a physical tap202amay cause some of the RF energy from the CPE106to propagate on the downstream and eventually hit physical tap202b. The physical tap202bmay include components that prevent upstream signals from passing on the downstream, which may cause the original signal to be reflected back towards the CMTS110. As a result, the CMTS will receive an impaired signal206that includes both the main signal and a reflected signal.

To mitigate against such impairments, the CMTS110may be configured to evaluate the communication signals received from the CPE106to determine whether the signal is impaired and/or identify the cause (e.g., tilt, roll-off, in-channel standing waves, etc.) of an impairment (e.g., micro-reflections, group delay, etc.). The CMTS110may periodically inform or instruct the CPE106to pre-distort its signal to cancel out the effects of that impairment. For example, the CMTS110may instruct the CPE106to send a modified signal so that when pre-equalization data from the CPE106is received by the CMTS110, the received signal is much closer to an ideal signal.

In some embodiments, the system200may also include DOCSIS proactive network maintenance (PNM) component that allows the service provider to identify faults before service is impacted for the subscriber at LAN101. The PNM component may use pre-equalization data from CPEs106to identify upstream impairments (e.g., micro-reflections, group delay, etc.) that could impact service. The PNM component may evaluate the pre-equalization coefficients to identify the CMTS110components that include CPE106devices that are compensating for impairments like micro-reflections and group delay.

As mentioned above, a CMTS110may inform or instruct a CPE106to distort (or pre-distort) its signal to cancel out the effects of an impairment, and a PNM component may identify the CMTS110components that include CPE106devices that are compensating for impairments.

A single CMTS110may serve thousands of homes, LANs101or CPEs106. Many service providers have visibility into the CMTS110, but not the individual CPEs106. Some service providers, such as multiple-system operators (MSOs), may have visibility into the CPEs106, but not into which taps correlate with which CPEs106. For these and other reasons, it may be challenging to identify the physical locations of specific CPEs106serviced by a CMTS110(e.g., based solely on the physical location of the CMTS110, etc.).

Some embodiments may include smart tap devices, which may be configured to alter the pre-equalization coefficients and/or RF communications from that which is configured on the CMTS to a given CPE device. By altering the pre-equalization coefficients and/or RF communications, the smart tap devices may cause their corresponding CPE devices to alert their associated CMTS of impaired or altered operation. The smart tap devices (or another component in the network) may correlate the CPE device that reports the impaired or altered condition with that of the configuration of the remote device configuration altering the RF communications so that physical location of the CPE device in question on the communications network can be determined. By knowing the physical communications network location, a physical address may be determined. This can be useful for troubleshooting network problems, locating compromised devices used in Theft-of-Service, as well as for aiding law-enforcement requests.

FIG.3illustrates an activity diagram of a system300configured to determine the physical location of a CPE106to within one hundred (100) or one hundred and fifty (150) feet. In the example illustrated inFIG.3, the system300includes a data analytics system302, a data repository304, a network element management system (NEMS)306, a CMTS110, a configurable coaxial tap202, and a given CPE106.

In operation320, the NEMS306may send a CMTS service group RF configuration to the CMTS110. The CMTS service group RF configuration may include information identifying the characteristics of devices that share a common impairment. The NEMS306may poll the CMTS110to identify or evaluate all the modems that may be connected to the CMTS110and determine or evaluate the corresponding service group to which those modems are connected. Further, in some embodiments, the smart tap may include a modem that is configured to gather telemetry from the smart tap device. The smart tap modem may also be known to CMTS110, and a correlation may be built as to CMTS service group →modems and smart taps. In some embodiments, as part of operation320, the NEMS306may send a message to the smart tap to cause the smart tap to slightly impair one port at a time. The NEMS306may then re-poll the CMTS110to identify which modem has the corresponding impairment that was signaled to the smart tap. A new correlation may be built to show the relationship between the CMTS service group, smart tap identifier and the modem IP/MAC address. For example, the NEMS306may generate a modem to tap correlation information structure that includes information field/value that correlates a CMTS service group with a smart tap identifier and a modem IP/MAC address.

In operations322and324, the CMTS110and CPE106may perform various operations to establish network connectivity.

In operation326, the CMTS110may store information identifying the CPE106in the data repository304.

In operation328, the NEMS306may send an alteration request to the configurable coaxial tap202to alter the characteristics of the tap202and/or manipulate the RF characteristics of the CPE106.

In some embodiments, the NEMS306may send the alteration request in response to determining that tap202has been installed and/or in response to determining that a new CPE106has come online via the tap202. In some embodiments, the NEMS306may send the alteration request periodically (e.g. daily, weekly, monthly, etc.). In some embodiments, the NEMS306may send the alteration request based on utilization triggers. For example, the NEMS306may monitor bandwidth usage (e.g., via other components in the network) and/or set a bandwidth utilization trigger, and send the alteration request in response to detecting a trigger event or in response to determining that the bandwidth usage levels exceed a threshold value.

In operation330, the NEMS306may store the alteration request or information regarding the alteration of the characteristics of the tap202in the data repository304.

In operation block329and/or operation332, the CPE106may commence detecting and reporting impaired operation to the CMTS110, which may forward the reports to the NEMS306for storing in the data repository304.

In operation334, the NEMS306may send an un-alteration request to the configurable coaxial tap202to undo the alterations of the characteristics of the tap202and/or to correct or undo the manipulated RF characteristics of the CPE106. By impairing the modem and returning the modem back to normal operation, the system may better verify that the modem to tap correlation is correct. The NEMS306system and/or the data analytics systems may track each occurrence to help validate the tap to modem correlation.

In operation336, the NEMS306may store an un-alteration request and/or information regarding the un-alteration of the characteristics of the tap202in the data repository304.

In operation block335and/or operation338, the CPE106may commence reporting full/normal operation to the CMTS110, which may forward the reports to the NEMS306for storing in the data repository304.

In operations340and344, the data analytics system302and data repository304may communicate and perform various operations to analyze the collected/stored information, generate or update modem-tap-port correlations, and store the generated/updated modem-tap-port correlations in memory. The information may be cross referenced with a theft of service analytics engine. The analytics engine may evaluate all the modem MAC information and DHCP information that is configured on the network in order to determine potential theft of service modems. The tap to modem correlation may be reference to identify the physical location of potential theft. If there is a law enforcement officer (LEO) order on a particular MAC/IP, the tap to modem correlation may be used in conjunction with billing information on the physical location. If that particular modem is theft of service, then the tap to modem correlation may be used to identify the physical location within100-150foot radius.

The modem-tap-port correlations may be used to identify, either by deduction or induction, the physical location of legitimate attached cable modems, as well as the rogue devices. The legitimate devices will have entries in the billing systems, whereas rogue devices will not. Cloned devices will show up as multiple entries in the Data Repository, but not in the billing system. These rogue devices may be isolated and located by using the tap-connector information with the physical (mailing or GPS address) of known good devices. Some additional processing, likely a combination of both computational and “analog” investigative techniques performed by humans will be needed to fill in the blanks. Periodic sweeps of the network could also be used to determine and locate bad actors that are using rogue devices that have altered the drop connection to change the connector on the configurable coaxial tap.

Unlike conventional solutions in which components in the service provider network may only determine the location of a CMTS that services a rogue or irregular CPE device, the various embodiment modem-tap-port correlations disclosed herein allow the components in the service provider network to determine the tap to which CPE device is attached. Since taps are typically dropped within 100-150 feet of the CPE device, rather than simply determining the general region/area (e.g., within 10, 15, 20, 30 miles) in which a rogue/irregular device operates, the embodiments allow the components in the service provider network to identify the street on which the CPE is located.

FIG.4illustrates an activity diagram of alternative operations in a system400configured to determine the physical location of a CPE106to within one hundred (100) or one hundred and fifty (150) feet. In the example illustrated inFIG.4, the system400includes a data analytics system302, a data repository304, a network element management system (NEMS)306, a CMTS110, a configurable coaxial tap202, and a CPE106. The configurable coaxial tap202may include a modulator-demodulator and/or a packet sniffer/decoder.

With reference toFIGS.3and4, in operations320-326, the system may perform the same operations discussed above with reference toFIG.3. In operation402, the configurable coaxial tap202may store information identifying the CM/CPE106along with tap connection information in the data repository304. In operations340and344, the data analytics system302and the data repository304may communicate and perform various operations to analyze the collected/stored information, generate or update modem-tap-port correlations, and store the generated/updated modem-tap-port correlations in memory. Modulating and/or demodulating and packet sniffing at the tap may provide operators another point in the network to execute LEO orders on packet interception.

FIG.5illustrates a system500that may be configured to perform the operations discussed above with reference toFIG.4. In the example illustrated inFIG.5, the system500includes a plurality of CPE devices106a-106d, a CMTS110, configurable coaxial tap202, an RF combining network502, and a DOCSIS cable modem504. The configurable coaxial tap202may include a reporting subsystem506, a packet decoder508, and a DOCSIS modulator and demodulator510. The reporting subsystem506may be communicatively coupled to the DOCSIS cable modem504. The RF combining network502may be communicatively coupled to the plurality of CPE devices106a-106d, DOCSIS cable modem504, and CMTS device110. The plurality of CPE devices106a-106dmay be coupled to the DOCSIS modulator and demodulator510via a switch512.

In some embodiments, the reporting subsystem506may be included within or communicatively coupled to a data center (e.g., regional data center, etc.) or backoffice. In some embodiments, the configurable tap202may be communicatively coupled to the reporting subsystem506and/or backoffice where data could be stored for further analytical analysis.

The DOCSIS modulator and demodulator510may include modulators, such as an Analog to Digital Converter (ADC) and/or a Digital to Analog Converter (DAC), that modulate/demodulate the signal. This allows the packet coder508or DOCSIS analyzer to decode the DOCSIS frame and header to read the device's MAC and IP address.

In some embodiments, from the CMTS110within a headend, there may be a RF combining network502to transmitter/receivers to a node552that is part of a hybrid fiber-coaxial (HFC) plant550. Logically behind the node, there may be amplifiers554and taps (e.g., configurable coaxial tap202). Each tap port may be communicatively coupled to DOCSIS cable modem504and/or CPE devices106a-d.

FIG.6illustrates an example architecture of a configurable coaxial tap202suitable for implementing the various embodiments. The configurable coaxial tap202may include an application processor602, a coprocessor604, memory606, a cable modem608, a network processor610, an interconnection/bus component612, a radio frequency (RF) digital switch614, a power supply616and a voltage regulator618.

In the example illustrated inFIG.6, the configurable coaxial tap202includes two radio frequency (RF) main line ports620a,620b(also sometime called “trunk ports”) and four RF drop ports630a-630d. In some embodiments, the configurable coaxial tap202may include four (4) different RF main line ports (trunk ports).

The ports620a,620bmay attach to the hard line of the hybrid fiber-coaxial (HFC) plant and/or feed other configurable coaxial taps in cascade. The RF drop ports630a-630dmay service up to four homes directly, typically up to 150 feet.

The configurable coaxial tap202may be configured to remotely monitor all of the ports620a-630dboth in the upstream and downstream frequencies. Through software, each ports620a-630dmay have a dynamic filter and/or the ability to filter out unwanted ingress. Because each port620a-630dis connected to the RF digital switch614, each port620a-630dmay have a power spectral density threshold set on each port620a-630dand each port620a-630dmay have the ability to frequency shift from input to output. The digital switch614may also perform amplification, so that the entire HFC plant would not require traditional amplification.

The interconnection/bus component612which may include an array of reconfigurable logic gates and/or implement a bus architecture (e.g., CoreConnect, AMBA, etc.). Communications may also be provided by advanced interconnects, such as high performance networks-on chip (NoCs).

In addition to the components illustrated inFIG.6, the configurable coaxial tap202may include analog circuitry and custom circuitry for managing sensor data, wireless data transmissions, and for performing other specialized operations, such as processing IP data packets. The configurable coaxial tap202may include system components and resources, such as a power supply616, a voltage regulator618, oscillators, phase-locked loops, peripheral bridges, data controllers, memory controllers, system controllers, access ports, timers, and other similar components used to support the processors and software clients (e.g., a web browser) running on a computing device. The configurable coaxial tap202may include an input/output module for communicating with external resources and/or include circuitry to interface with peripheral devices, such as electronic displays, wireless communication devices, external memory chips, etc.

Each of the processors (e.g., processors602,604,608,610, etc.) may include one or more cores, and each processor/core may perform operations independent of the other processors/cores. For example, in some embodiments, the network processor may include a packet processor (e.g., P4 programmable packet processor) suitable for processing IP data packets. In some embodiments, the processors may be implemented via an application specific integrated circuits (ASIC). In some embodiments, the processors may be implemented via a customized integrated circuit (IC) (e.g., customized for a particular routing use, etc.).

In addition to the configurable coaxial tap202discussed above, the various embodiments may be implemented in a wide variety of computing systems, which may include a single processor, multiple processors, multicore processors, or any combination thereof.

FIG.7illustrates an example system700architecture that may be used in network components (e.g., configurable coaxial tap202, network element management system306, etc.) configured in accordance with various embodiments. In the example illustrated inFIG.7, the system700includes a clock/reset component702, a peripheral component interconnect (PCI) component704, a central processing unit (CPU) media access control (MAC) component706, a direct memory access (DMA) engine component708, and a control and configuration component710. The system700includes a plurality of processing blocks712that implement a switch architecture that could be partitioned and/or controlled by the various embodiments. In the illustrated example, the processing blocks712each include or utilize a receiver MACs component714, an ingress pipeline component716, a traffic manager component718, an egress pipeline component720, and a transmission MAC component722.

FIGS.8A and8Billustrate methods800,850that may be performed by one or more components (e.g., smart configurable coaxial tap202and/or a network element management system306, etc.) to determine the location of a CPE device in accordance with some embodiments.

With reference toFIG.8A, in block802, a component (e.g., network element management system306) may send an alteration request to the configurable coaxial tap to alter the characteristics of the configurable coaxial tap202and/or to manipulate the radio frequency (RF) characteristics of a customer premise device (CPE)106coupled to the configurable coaxial tap202. In some embodiments, in block802, the component may send the alteration request to a configurable coaxial tap that includes a radio frequency modulator-demodulator combination, and the alteration request may cause the configurable coaxial tap to directly examine packets that are sent to or received from the CPE device.

In block804, the component may send alteration information to a data repository304. In block806, the component may receive impaired operation reports from a cable modem termination system110and send/relay the received impaired operation reports to the data repository304. In block808, the component may send an un-alteration request (i.e.,334) to the configurable coaxial tap202to undo the alterations to the characteristics of the configurable coaxial tap and/or to correct or undo the manipulated RF characteristics of the CPE106. In block810, the component may send un-alteration information (i.e.,336) to the data repository304. In block812, the component may receive restored operation reports from the cable modem termination system110and send the restored operation reports to the data repository304.

With reference toFIG.8B, in block852, a component may receive an impairment report from a cable modem or a customer premise device (CPE)106. In block854, the component may identify executions of impairment actions by configurable taps202. In block856, the component may generate modem-tap-port correlations, such as by time aligning a reported impairment with an identified execution of the impairment action. In some embodiments, the component may generate the modem-tap-port correlations based on any or all of information identifying the CPE106, alteration information, impaired operation reports, un-alteration information, and/or restored operation reports.

In block858, the component may receive billing information from the billing system. In block860, the component may use received billing information to determine whether the cable modem/CPE device106is a known device (i.e., legitimate device) or an unknown device (i.e., rouge device). In optional block862, the component may use received billing information and the generated modem-tap-port correlations to determine the physical address of the cable modem/CPE device106.

In some embodiments, the configurable coaxial tap202may be configured to create an impairment (e.g., micro-reflections, group delay, etc.) scenario. In some embodiments, this may be accomplished by lowering transmit levels, for example, so the modem will need to “step down” in modulation order. In other embodiments, this may be accomplished by blocking some subset of OFDM subcarriers to impair performance, etc. In some embodiments, the configurable coaxial tap202may be configured to create the impairment in response to receiving an alteration request (e.g., as part of the operations in block802, etc.).

In some embodiments, the network element management system306may be augmented with functionally that allows it to be able to address, configure, and control the tap devices (e.g., the configurable coaxial tap202, etc.).

In some embodiments, the network element management system306may be configured to control the radio frequency (RF) performance characteristics of the smart tap (configurable coaxial tap202) to reveal the physical location of the attached device (e.g., as part of the operation in block862, etc.). In some embodiments, the smart-tap may include a RF modulator-demodulator combination that could be used to directly examine the packets sent and received from a target cable modem. This may be used to determine the connected port, but can also be used as a direct monitoring device suitable for legal-intercept purposes.

In some embodiments, the network element management system306may be configured to coordinate the scheduling of the impairments.

In some embodiments, the system may further include a data repository that is configured to store the scheduling and reports of the impairments.

In some embodiments, the system may further include a data analytics system configured to analyze logs, files, memories, etc. that store the impairment(s) being set/reported/unset/unreported.

In some embodiments, each CMTS may include one or more CMTS ports. Each CMTS port may include one or more configurable coaxial taps202. Each configurable coaxial tap202may include one or more tap ports.

In some embodiments, the system may be configured so that for each tap port of each tap of each CMTS port of each CMTS, the system aligns the cable modem reporting impairment issue that is time-aligned with the execution of the impairment action by the configurable coaxial tap202. This may need to be repeated continuously or multiple time so as to settle out simultaneous legitimate impairments, perhaps using differing impairment scenarios. Additionally, the data analytics system may correlate with a billing system to locate known versus unknown devices as well as correlation with physical addresses.

FIG.8Cillustrates a method870of evaluating a CPE device in accordance with some embodiments. Method870may be performed by any or all of the components (e.g., smart configurable coaxial tap202, a network element management system306, etc.) discussed in this application.

In block872, a configurable coaxial tap202that includes a radio frequency modulator-demodulator combination may receive an alteration request from a network element management system306. Alternatively or in addition, in block872, a processor in the network element management system306may send an alteration request to a configurable coaxial tap202that includes a radio frequency modulator-demodulator combination. In some embodiments, the alteration request may include information suitable for causing the configurable coaxial tap202to directly examine packets that are sent to or received from the CPE device.

In response to receiving the alteration request, in block874the configurable coaxial tap202may directly examine packets that are sent to or received from the CPE device. In block876the configurable coaxial tap202may perform packet sniffing operations to intercept packets that are sent to or received from the CPE device. In block878, the configurable coaxial tap202may demodulate intercepted packets and store the demodulated results in memory. In block880, the configurable coaxial tap202may decode demodulated packets and read DOCSIS and Ethernet frames. In block882, the configurable coaxial tap202may re-modulate the packets. In block884, the configurable coaxial tap202may send the modulated packets to either the home network or back towards the CMTS (e.g., depending on the traffic flow, etc.).

That is, because there is a modulator/demodulator inside the configurable coaxial tap202, the entire RF spectrum may be demodulated (e.g., in blocks874-878, etc.) and sent to the packet decoder in order to read the DOCSIS and Ethernet frames (e.g., in block880, etc.). After inspection the packets are modulator, and sent either to the home or back towards the CMTS depending on the traffic flow (e.g., in block884, etc.).

Conventional taps typically do not include compute, modulator/demodulators or packet decoders within them. As a result, conventional solutions may not perform the operations of method870at the configurable coaxial tap202. Rather, they are limited to implementing any such functional back at the headend either in the CMTS or just north of the CMTS.

In addition, because conventional taps do not include an RF modulator, there isn't a way to inspect the traffic flow. These conventional devices are simply passive devices with no intelligence within them.

There are number of benefits to the various embodiments disclosed herein that include a radio frequency modulator-demodulator combination and/or a packet decoder in a configurable coaxial tap. For example, including such components in a tap allow for positively identifying the device in the home without having to manipulate the RF characteristics between the device. By manipulating the RF, there is a chance of slightly impacting performance of the customer. However there may be a potential impact by mod/demod and packet inspecting in the tap too, which could potentially increase latency for the packet. In addition, by mod/demodulating at the configurable coaxial tap, the RF signal may be regenerated. This may result in a signal having a high fidelity signal coming out of the tap. With a higher fidelity signal, higher order modulation profiles may be run to the modem.

Various embodiments (including, but not limited to, embodiments discussed above with reference toFIGS.1A-8B) may be implemented on any of a variety of commercially available computing devices, such as the computing device900illustrated inFIG.9. Such a computing device900may include a processor901coupled to volatile memory902and a large capacity nonvolatile memory, such as a disk drive903. The computing device900may also include network access ports906coupled to the processor901for establishing data connections with a network connection circuit904and a communication network (e.g., IP network) coupled to other communication system network elements.

The processors discussed in this application may be any programmable microprocessor, microcomputer or multiple processor chip or chips that can be configured by software instructions (applications) to perform a variety of functions, including the functions of the various embodiments described above. In some devices, multiple processors may be provided, such as one processor dedicated to wireless communication functions and one processor dedicated to running other applications. Typically, software applications may be stored in the internal memory before they are accessed and loaded into the processors. The processors may include internal memory sufficient to store the application software instructions. In many devices, the internal memory may be a volatile or nonvolatile memory, such as flash memory, or a mixture of both. For the purposes of this description, a general reference to memory refers to memory accessible by the processors including internal memory or removable memory plugged into the device and memory within the processors themselves. Additionally, as used herein, any reference to a memory may be a reference to a memory storage and the terms may be used interchangeable.

Referring toFIGS.1-9and according to various embodiments of the present disclosure, a method of evaluating a customer premise equipment (CPE) device may be provided. An embodiment method may include the steps of receiving an alteration request in a configurable coaxial tap that includes a radio frequency modulator-demodulator combination; and evaluating the CPE by the configurable coaxial tap directly examining packets that are sent to or received from the CPE device in response to the configurable coaxial tap receiving the alteration request.

In an embodiment, the method of evaluating a CPE may further include the step of performing, by the configurable coaxial tap, packet sniffing operations to intercept packets that are sent to or received from the CPE device. In an embodiment, the method of evaluating a CPE may further include the step of demodulating, by the configurable coaxial tap, intercepted packets and storing the results in a memory. In an embodiment, the method of evaluating a CPE may further include the step of decoding, by the configurable coaxial tap, demodulated packets and read data over cable service interface specification (DOCSIS) and Ethernet frames. In an embodiment, the method of evaluating a CPE may further include the steps of remodulating the packets; and sending the remodulated packets to at least one or more of: a home network that includes the CPE; or a cable modem termination system (CMTS). In an embodiment method, sending the remodulated packets to at least one or more of the home network that includes the CPE or the CMTS may include: determining whether to send the remodulated packets to the home network or to the CMTS based on traffic flow; and sending the remodulated packets the home network or to the CMTS based on a result of the determination.

Referring toFIGS.1-9and according to various embodiments of the present disclosure, a configurable coaxial tap may be provided that includes: a radio frequency modulator-demodulator combination; and a processor coupled to the radio frequency modulator-demodulator combination, where the processor is configured with processor-executable software instructions to: receive an alteration request; and evaluate a customer premise equipment (CPE) by directly examining packets that are sent to or received from the CPE device in response receiving the alteration request.

In an embodiment, the processor may be configured to perform packet sniffing operations to intercept packets that are sent to or received from the CPE device. In another embodiment, the processor may be configured to demodulate intercepted packets and store the results in a memory. In another embodiment, the processor may be configured to decode the demodulated packets and read data over cable service interface specification (DOCSIS) and Ethernet frames. In another embodiment, the processor may be configured to: remodulate the packets; and send the remodulated packets to at least one or more of: a home network that includes the CPE; or a cable modem termination system (CMTS). In another embodiment, the processor may be configured to send the remodulated packets to at least one or more of the home network or to the CMTS by: determining whether to send the remodulated packets to the home network or to the CMTS based on traffic flow; and sending the remodulated packets the home network or to the CMTS based on a result of the determination.