# US 2018/0026807 A1 · Systems and methods for detecting and interfering with compromised devices and unauthorized device relocation in a communication network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0026807 A1 - Document ID: US20180026807A1 - Status: Published application - Kind: A1 - Application number: 15/712,347 - Filed: 2017-09-22 - Published: 2018-01-25 - Earliest claimed: 2015-03-26 - Assignees: Maxxian Technology Inc. - Applicants: Maxxian Technology Inc. - Inventors: Rene JUNEAU - Web page: https://patentgrep.com/patent/US20180026807A1 ## CPC - H04L 12/22: Arrangements for preventing the taking of data from a data transmission channel without authorisation (means for verifying the identity or the authority of a user of a secure or secret communication system H04L9/32) - H04W 4/02: Services making use of location information - H04L 63/14: {for detecting or protecting against malicious traffic} - H04W 4/029: Location-based management or tracking services - H04W 12/082: using revocation of authorisation - H04W 12/126: Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L 2463/101: applying security measures for digital rights management - H04W 12/40: Security arrangements using identity modules - H04W 12/64: using geofenced areas - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems and methods for detecting and interfering with compromised devices and unauthorized device relocation in a communication network are disclosed. The described embodiments may be deployed in a content delivery network where receivers have been compromised in a manner that renders the conditional access system (CAS) inoperative at controlling the receivers' ability to receive content. In some embodiments, alternate commands not protected by the CAS system may be used to detect hacked devices and interdict same. In some embodiments, service devices in the content delivery network may allow for detection of unauthorized device relocation. ## Claims ### Claim 1 A method of interfering with operation of a pirated computing device in a content delivery network, the pirated computing device having unauthorized access to content available on the content delivery network, the method comprising identifying the pirated computing device to be targeted for interference, the pirated computing device being associated with a secure element configured to receive commands from a control server, wherein the commands are designed to interdict the pirated computing device upon receipt of the commands, and wherein the secure element is unresponsive to the commands; transmitting an alternate command to the pirated computing device, the alternate command being different from any command of the commands that the secure element is configured to receive from the control server to interdict the pirated computing device; and upon the pirated computing device executing the alternate command, access by the pirated computing device to the content available on the content delivery network is disrupted. ### Claim 2 (depends on 1) The method of claim 1, wherein the alternate command is selected from: a reboot command and a shutdown command. ### Claim 3 (depends on 1) The method of claim 1, wherein the alternate command disrupts network connectivity of the pirated computing device to the content delivery network. ### Claim 4 (depends on 3) The method of claim 3, wherein the alternate command is selected from the group consisting of: drop Internet Protocol (IP) address, release IP address, or renew IP address. ### Claim 5 (depends on 3) The method of claim 3, wherein the alternate command inserts spurious data into records of the pirated computing device related to network addresses. ### Claim 6 (depends on 1) The method of claim 1, wherein the alternate command comprises a channel change command, and the method further comprises repeatedly transmitting the channel change command to the pirated computing device. ### Claim 7 (depends on 1) The method of claim 1, wherein the alternate command updates the channel map of the content channels accessible by the pirated computing device. ### Claim 8 (depends on 1) The method of any one of claims 1, wherein the disruption of access to content available on the content delivery network by the pirated computing device is restored upon a reset of the computing device, and the method further comprises: analyzing records of a network router to identify appearance of the pirated computing device on the content delivery network; and if such appearance is identified, re-transmitting the alternate command to the computing device. ### Claim 9 A method of interfering with operation of a pirated computing device in a content delivery network, the pirated computing device having unauthorized access to content available on the content delivery network, the method comprising: identifying the pirated computing device to be targeted for interference, the computing device being associated with a secure element configured to receive commands from a control server, wherein the commands are designed to interdict the computing device upon receipt of the commands, and wherein the secure element is unresponsive to the commands; and transmitting an alternate command to a service device on the content delivery network, the service device being different from the control server, and the service device stores data records referenced by the pirated computing device when the pirated computing device accesses the content on the content delivery network, wherein the alternate command modifies the data records; wherein upon an attempt by the pirated computing device to access the content available on the content delivery network, the referencing of the modified data records by the pirated computing device interferes with access to the content available on the content delivery network by the pirated computing device. ### Claim 10 (depends on 9) The method of claim 9, wherein the alternate command comprises a network command that disrupts network connectivity of the pirated computing device to the content delivery network. ### Claim 11 (depends on 9) The method of claim 9, wherein the service device comprises a network router and the alternate command is transmitted to the network router to de-allocate a network address previously allocated to the pirated computing device. ### Claim 12 (depends on 9) The method of claim 9, wherein the data records stored by the service device comprises a blacklist registry for computing devices that are denied access to the content available on the content delivery network, and the alternate command comprises adding an identifier of the pirated computing device to the blacklist registry. ### Claim 13 (depends on 9) The method of claim 9, wherein the data records stored by the service device comprises identifiers for computing devices that are permitted to access the content available on the content delivery network, and the alternate command comprises deleting an identifier of the pirated computing device from the data records. ### Claim 14 An inspection device comprising a processor and a memory storing instructions which, when executed by the processor causes the processor to perform operations comprising: identifying the pirated computing device to be targeted for interference, the pirated computing device being associated with a secure element configured to receive commands from a control server, wherein the commands are designed to interdict the pirated computing device upon receipt of the commands, and wherein the secure element is unresponsive to the commands; transmitting an alternate command to the pirated computing device, the alternate command being different from any command of the commands that the secure element is configured to receive from the control server to interdict the pirated computing device; and upon the pirated computing device executing the alternate command, access by the pirated computing device to the content available on the content delivery network is disrupted. ### Claim 15 A computer readable medium storing instructions for execution by a processor of an inspection device, wherein when the instructions are executed by the processor, the processor performs operations comprising: identifying the pirated computing device to be targeted for interference, the pirated computing device being associated with a secure element configured to receive commands from a control server, wherein the commands are designed to interdict the pirated computing device upon receipt of the commands, and wherein the secure element is unresponsive to the commands; transmitting an alternate command to the pirated computing device, the alternate command being different from any command of the commands that the secure element is configured to receive from the control server to interdict the pirated computing device; and upon the pirated computing device executing the alternate command, access by the pirated computing device to the content available on the content delivery network is disrupted. ### Claim 16 An inspection device comprising a processor and a memory storing instructions which, when executed by the processor causes the processor to perform operations comprising: identifying the pirated computing device to be targeted for interference, the computing device being associated with a secure element configured to receive commands from a control server, wherein the commands are designed to interdict the computing device upon receipt of the commands, and wherein the secure element is unresponsive to the commands; and transmitting an alternate command to a service device on the content delivery network, the service device being different from the control server, and the service device stores data records referenced by the pirated computing device when the pirated computing device accesses the content on the content delivery network, wherein the alternate command modifies the data records; wherein upon an attempt by the pirated computing device to access the content available on the content delivery network, the referencing of the modified data records by the pirated computing device interferes with access to the content available on the content delivery network by the pirated computing device. ### Claim 17 A computer readable medium storing instructions for execution by a processor of an inspection device, wherein when the instructions are executed by the processor, the processor performs operations comprising identifying the pirated computing device to be targeted for interference, the computing device being associated with a secure element configured to receive commands from a control server, wherein the commands are designed to interdict the computing device upon receipt of the commands, and wherein the secure element is unresponsive to the commands; and transmitting an alternate command to a service device on the content delivery network, the service device being different from the control server, and the service device stores data records referenced by the pirated computing device when the pirated computing device accesses the content on the content delivery network, wherein the alternate command modifies the data records; wherein upon an attempt by the pirated computing device to access the content available on the content delivery network, the referencing of the modified data records by the pirated computing device interferes with access to the content available on the content delivery network by the pirated computing device.