There are a number of DOCSIS-specific specifications designed to address this problem:
Only provisioning solutions that dynamically generate DOCSIS and PacketCable configuration files on-demand can include features such as IP verification and TFTP server timestamp. Furthermore, in addition to the above specifications, further security measures should be considered for an extra level of protection against cable modem cloning.
It is more secure to generate dynamic files than static files as the unique file names can’t be used in file replay attacks. In addition to the unique file name, the IP address assigned to a device must be verified to download the file.
Why is this useful? Consider someone sniffing the network to see what is being downloaded (for example, a file called gold.bin). The person may assume this file is a gold-service package and they might attempt to download it. To prevent this from occurring, the file is stored in a short-term cache and the DHCP server assigns an IP to the device, along with the unique file. As a result, if a device with the wrong IP tries to download the file, it will not succeed.
Dynamic file generation also offers operators a simple and secure way to change the MIC setting (also known as a Shared Secret). This is because any given CMTS may generate hundreds or even thousands of unique configuration files for devices. Without dynamic file configuration, an operator would need to manually rebuild every unique configuration file to change the Shared Secret, whereas a device provisioning solution that supports dynamic file generation gives operators the ability to make one central change.
Limiting the number of IPs that the DHCP service can give to CPEs behind a modem can prevent more basic forms of service theft. For example, a DOCSIS provisioning service that includes IP limiting will restrict a legitimate subscriber from allowing a neighbor or friend who does not live in the household from accessing the service.
This feature prevents the cable modem to move around the network illegitimately. It is designed for use in one cluster, rather than multiple, and may be useful in regions where there are legal restrictions about moving service from one point to another.
This is a security feature that aims to increase the availability of the provisioning system by preventing DHCP Denial of Service (DoS) attacks. For instance, if someone attempts to attack an operator and tries to cause problems with the provisioning system, denial of service is in place to prevent this. The feature works by detecting the DoS attack and the related device, and then dropping all DHCP packets/traffic associated with the attack.
This feature authorizes hosts on the network in order to allow the transmission of IP packets. The CMTS checks with the provisioning system to ensure the IP is legitimate and if the DHCP service authorizes the IP, the packet can go through. If the IP is not authorized, the packet is not transmitted.
The CMTS snoops DHCP packets to build IP-to-cable modem mapping to ensure there is an entry for every IP given out. If this data is out-of-sync, for example due to a CMTS reboot, the CMTS can obtain this information from the provisioning service via lease query to built the table.
An additional measure for more comprehensive protection is to store, track, and manage leases in a central solution that integrates directly with the provisioning solution. This makes it much simpler to keep track of lease information in large networks where there may be multiple provisioning servers in use.
This gives operators the ability to catch any modem that attempts to be cloned and prevents that clone from appearing anywhere else in the network. Even in the case of a full cloning where the BPI+ specification misses the fraudulent modem, a central repository of lease data will detect fraudulent cloning even if the MAC certificate is cloned.
Overall, a comprehensive device provisioning solution with security features can protect your network from cloned devices trying to access service for free, or problem devices from launching denial of service attacks. You should be able to configure these features to suit your needs, whether it is to deny service to any suspicious device or take it to a walled garden.
The last thing you need is a barrage of fraudulent devices accessing your service for free, affecting not only your bottom line, but also potentially the quality of service of your legitimate customers. Want to learn more? Discover how a Tier 1 North American service provider eliminated 88% of CPE cloning with a comprehensive device provisioning solution that included security mechanisms.