Detection of cloned identifiers in communication systems

• US 20070275718A1
• Filed: 05/21/2007
• Published: 11/29/2007
• Est. Priority Date: 05/22/2006
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Descombes, Pierre-Yves, Wassifi, Hamid, Iwulski, Eddie
• Granted Patent: US 8,010,083 B2
• Time in Patent Office: Days
• US Class Current: 455/435.100
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2203/6027 Fraud preventions
• CPC Class Codes: H04M 2207/18 wireless networks
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 3/229 Wire identification arrangements; Number assignment determination
• CPC Class Codes: H04Q 2213/13097 Numbering, addressing
• CPC Class Codes: H04Q 2213/13098 Mobile subscriber
• CPC Class Codes: H04Q 2213/13103 Memory
• CPC Class Codes: H04Q 2213/13139 Fraud detection/prevention
• CPC Class Codes: H04Q 2213/13213 Counting, timing circuits
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

According to one aspect of the present invention, there is provided a method, in a communication system having a plurality of communication devices each having a first and second identifier associated therewith at the time of a connection attempt to the network, of identifying when one of the identifiers has been cloned, the connection status of the first identifier being obtainable from a network element, comprising receiving the first and second identifiers of a communication device, determining whether one of the identifiers has been cloned, the determination being made in part through information obtained from a connection history database, and in part through information obtained from the network element.

Claims

1. A method, in a communication system having a plurality of communication devices each having a first and second identifier associated therewith at the time of a connection attempt to the network, of identifying whether one of the identifiers has been cloned, the connection status of the first identifier being obtainable from a network element, comprising:

receiving the first and second identifiers associated with a communication device;

determining whether one of the identifiers has been cloned, the determination being made in part through information obtained from a connection history database, and in part through information obtained from the network element.

2. The method of claim 1, wherein the first identifier relates to the identity of a communication device, and wherein the second identifier relates to the identifier of a subscriber.

3. The method of claim 1, wherein the step of determining comprises determining whether the first identifier has been cloned, the method further comprising:

determining from the connection history database whether the received first identifier has previously attempted to connect to the network with a second identifier other than the received second identifier, and where it is so determined, obtaining those other second identifiers;

determining from the network element whether any of the other second identifiers are currently connected to the communication system; and

determining from the connection history database, for each of the other second identifiers, whether the latest entry in connection history database is paired with the received first identifier, and if it so determined, signalling that the first identifier has been cloned.

4. The method of claim 1, wherein the step of determining comprises determining whether the second identifier has been cloned, the method further comprising:

determining from the connection history database whether the last connection attempt for the received second identifier was with a first identifier other than the received first identifier;

determining from the network element whether the received second identifier is currently connected to the communication system; and

where it is so determined, signalling that the received second identifier has been cloned.

5. The method of claim 1, further comprising storing the received first and second identifiers and a timestamp in the connection history database.

6. The method of claim 3, further comprising,

determining whether the received first and second identifiers are the genuine first and second identifiers, the determination being based on information stored in the connection history database.

7. The method of claim 6, wherein the step of storing the received identifiers further includes storing an incremental connection attempt number for the received first and second identifiers, and wherein the step of determining the genuine identifiers comprises using the stored incremental connection attempt number.

8. The method of claim 7, further comprising causing the disconnection of a mobile communication device having an identifier determined as having been cloned.

9. The method of claim 1, wherein the communication system is a mobile telephony network, wherein the communication devices are mobile stations, wherein the network element is a home location register, wherein the first identifier is an international mobile equipment identifier, IMEI, and wherein the second identifier is an international mobile subscriber identity, IMSI.

10. Apparatus, for use in a communication system having a plurality of communication devices each having a first and second identifier associated therewith at the time of a connection attempt to the network, for identifying whether one of the identifiers has been cloned, comprising:

a receiver for receiving the first and second identifiers associated with a communication device;

a first interface for accessing a network element for providing the connection status of the first identifier;

a second interface for accessing a connection history database, the connection history database being arranged for storing, in response to a connection attempt by a communication device, connection data related to the first and second identifiers associated with that communication device; and

a processor for determining whether one of the received identifiers has been cloned, the determination being made in part through data obtained from the connection history database, and in part through data obtained from the network element.