How does ISP cut the customer's internet access technically?

Question

We know that if we fail to pay our internet bill then our internet access will be cut. But how does the ISP technically cut the access?

For wired internet, do they just shut down the port where the other end of the customer router is connected to? If yes, then that must be automated -- but how do they automate that? What is the technology or protocol behind it?

But what about wireless internet, especially prepaid sim card? When you top up your prepaid sim how does it get access technically and when the credit expires how does it get cut technically? Is it somewhat similar to wifi voucher? What is the technology behind prepaid sim top up?

In what layer do they cut the access? Layer 1? Layer 2? Application layer?

Answer 1

Your question is really broad and not very specific.

I'll try to answer anyway, but i can't go into bit level detail due to time.

For wired internet - as already commented - there are different ways to terminate your access. It goes from blocking your account to physically disconnecting the wires in the central office. If your access technology is DSL, you usually have a PPPoE Session that gets terminated in the providers network. So you have login credentials that are checked everytime you connect. This can be blocked on "software level". Depending on your provider this is automated or semi automated. There might be an accounting software running that compares incoming payments versus cost/credit. If it is <= 0 then it might either turn on a red lamp and someones going to check manually and decide what happens or it automatically blocks the access and terminates your PPPOE session. This is pretty much dependent on the implementation.

In former days when there was just POTS and ISDN, field techs would be sent out to the central office exchanges (COE) to cut your wire. I guess these days are long gone in any 1st world countries with full digital telephone networks.

For mobile phones it might sound much easier but is probably more complex.

The way prepaid is handled requires further intelligence, i.e. software. Depending on your provider this software is bought from a 3rd party or developed by the provider itself and hence it's behavior is not standardized.

Also it depends if you just did not pay your invoice once, or are on 0 currency unit credit (for prepaid) or if you failed to pay mutliple times.

You can just be blocked from doing mobile originated calls, or texts, you can be blocked from transmitting data to the internet or you can be blocked completely from attaching to the network (not being able to even receive calls/texts).

What level of "blocking" is applied depends on provider/contract.

Completely blocking you is pretty easy. Your mobile phone - regardless if prepaid or post paid - has a SIM (or eSIM, or other authentication module) with cryptographic keys stored on it. You are authenticating against the network regularly. Within this process the network checks who you are and if you are allowed to do that. If you didn't pay, you are simply not allowed to attach any longer.

More difficult if you are on 0€/$ credit and you are allowed to login/attach, but you are not allowed to place calls.

For prepaid your calls/texts are usally routed via network functions that handle your prepaid contact.

Where i live, 20 yrs ago, you would top up your prepaid account to lets say 10€, then you could send 100 texts for 20 cent each and would end up with -10€ on your account, because the network would recalculate your credit only once a day. Only later they implemented real time account checks that disallowed you to go into negative credit.

So the function that handles each of your mobile originating calls/texts can decide in real time if you are allowed to actually send that text or make that call or not.

If you want more detail on how any of this works, you need to get an understanding of each of the technologies used. Buy/get a book on the topic and you can learn about the signalling of the protocols that are used to understand on which level or where access is blocked typically.

Source: 17yrs Work Experience with a major carrier (started fixed line, mostly mobile though).

Answer 2

To get a general idea, what an IT-centric central authentication database looks like and works like, try reading something on RADIUS. This protocol was originally developed for dial-up access networking = async serial telephone modems, and later ISDN TA's, calling in to an ISP to access the internet. In those days, the L2 protocol in the last mile was PPP (see e.g. the RFC1171, RFC1172, RFC1994). Nowadays, a RADIUS back-end can be used by Ethernet network switches, WiFi AP's, mobile data GGSN's (nowadays with LTE a little out, probably) and, as @aslmx has mentioned, DSL networks, where a PPP tunnel rides on top of L2 Ethernet or (historically?) on top of ATM to provide individual authentication and service. Speaking of RADIUS, there are actually several implementations of auth databases that can serve RADIUS requests from the "access gateway" equipment, and the interface for administration of the user accounts in the DB is yet another story, more on the proprietary side. In a telco company, this can easily have a machine-to-machine link to some business-side ERP software package that handles user provisioning, billing, bookkeeping etc. (or that part of the system can be entirely proprietary). At the level of RADIUS, the identity of a user is mapped to a username (login) - with support for "realms", i.e. user@realm . The realms can be used to implement user groups, or for forwarding queries to other RADIUS servers (distributed RADIUS).

The mobile networks (2G/3G/4G/5G) have their own protocol suites and authentication database implementations for individual service provisioning and auth. Maybe try some google queries for a start to get a hint of how complex those networks are. Expect to find some authentication back-end machine at the heart of the backhaul network. In the mobile network, the identity of a "subscription" is coupled to a SIM card, having a unique number called the IMSI. In packet networks on top of the 2G/3G/4G infrastructure, there are additional parameters: the APN ("Access Point Name", for practical purposes behaving more like a VPN instance) and PPP-like login+password, possibly again mapping to a RADIUS back-end...

The aforementioned mechanisms are typical for authentication of relatively small ISP customers. For larger "corporate level" customers, the network connection is often a dedicated physical circuit (or L2 virtual circuit of some kind), terminated at the ISP/telco side on a dedicated physical port of some router or switch, and perhaps not even authenticated. All the config can be (semi)manual: port enabled, L3 routing entries applied etc. Especially large corporate customers can have a dedicated infrastructure of dedicated L1/L2 links (VPN), redundant access arrangements requiring special config at the ISP side etc. Cutting access in that case can be a matter of a manual "port shutdown" at the console of a switch somewhere - but you generally do not cut access to those kinds of customers :-)