SYSTEM AND METHOD FOR IDENTIFYING MOBILE COMMUNICATION DEVICES

• US 20130137451A1
• Filed: 11/30/2011
• Published: 05/30/2013
• Est. Priority Date: 11/30/2011
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: KOSSEIFI, Mario, MEREDITH, Sheldon, FIX, Jeremy
• Granted Patent: US 8,831,629 B2
• Time in Patent Office: Days
• US Class Current: 455/456.1
• CPC Class Codes: H04L 2463/146 Tracing the source of attacks
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 12/72 Subscriber identity
• CPC Class Codes: H04W 4/023 using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A method includes detecting, at a device coupled to a network, a communication transmitted over the network. The method includes determining whether the communication is associated with an unauthorized data request, and, in response to determining that the communication is associated with the unauthorized data request, determining an access point associated with a source of the communication. The method further includes transmitting a message to a service provider. The message may request identification of mobile communication devices that are located within a threshold distance of the access point.

Claims

1. A method comprising:

detecting, at a device coupled to a network, a communication transmitted over the network;

determining whether the communication is associated with an unauthorized data request;

in response to determining that the communication is associated with the unauthorized data request, determining an access point associated with a source of the communication; and

transmitting a message to a service provider, wherein the message requests identification of one or more mobile communication devices that are located within a threshold distance of the access point.

2. The method of claim 1, wherein the access point is a wireless network access point.

3. The method of claim 1, further comprising:

determining a network address associated with the access point based on the communication; and

estimating a physical location of the access point based on the network address.

4. The method of claim method of claim 3, wherein the physical location of the access point is estimated based on information received from an internet service provider.

5. The method of claim 1, further comprising determining whether information associated with the communication matches an identifier of the unauthorized data request, wherein the identifier is stored at a database accessible to the device.

6. The method of claim 5, wherein the unauthorized data request is a request to access a website and wherein the identifier includes a uniform resource identifier associated with the website.

7. The method of claim 5, wherein the unauthorized data request is a request to initiate a transfer of a file and wherein the identifier includes a digital signature of the file, a digital fingerprint of the file, a watermark of the file, or any combination thereof.

8. The method of claim 5, further comprising performing a deep packet inspection of one or more packets associated with the communication to identify the information associated with the communication.

9. The method of claim 1, wherein the service provider, in response to receiving the message, transmits a list of the one or more identified mobile communication devices that are located within the threshold distance of the access point to a correlation server.

10. A method comprising:

receiving, at a server of a mobile communication service provider from a detection server, a request to identify mobile communication devices located within a threshold distance of an access point;

identifying one or more mobile communication devices located within the threshold distance of the access point; and

transmitting a message to a correlation server via a network, wherein the message includes information identifying the one or more mobile communication devices.

11. The method of claim 10, wherein the request includes a network address of the access point, the method further comprising:

estimating a physical address of the access point based on the network address;

retrieving information associated with a plurality of mobile communication devices located within a coverage area of a base station of the mobile communication service provider, wherein the physical address of the access point is within the coverage area of the base station.

12. The method of claim 11, further comprising sending a location query to each of the plurality of mobile communication devices within the coverage area of the base station, and wherein the location query requests positioning information from each of the plurality of mobile communication devices.

13. The method of claim 12, wherein the location query includes ephemeris data associated with the coverage area of the base station.

14. The method of claim 13, further comprising:

receiving a response to the location query from one or more of the plurality of mobile communication devices, wherein each response includes location data associated with a location of a particular mobile communication device of the plurality of mobile communication devices; and

determining, based on the location data, whether each of the plurality of mobile communication devices is located within the threshold distance of the access point.

15. The method of claim 10, wherein the message includes a list of subscribers, wherein each subscriber in the list of subscribers is associated with at least one of the one or more mobile communication devices located within the threshold distance of the access point.

16. The method of claim 10, further comprising:

receiving, at the server of the mobile communication service provider from the unauthorized data request detection server, a second request to identify one or more additional mobile communication devices located within a threshold distance of an additional access point;

identifying the one or more additional mobile communication devices located within the threshold distance of the additional access point; and

transmitting a second message to the correlation server via the network, wherein the second message includes information identifying the one or more additional mobile communication devices located within the threshold distance of the additional access point.

17. A computer-readable storage device comprising instructions that, when executed by a processor, cause the processor to:

receive first data identifying mobile communication devices that were located within a threshold distance of a first access point;

receive second data identifying mobile communication devices that were located within the threshold distance of the first access point; and

identify at least one mobile communication device identified by the first data and the second data.

18. The computer-readable storage device of claim 17, wherein the first data is received from a mobile communication service provider at a first time, wherein the second data is received from the mobile communication service provider at a second time.

19. The computer-readable storage device of claim 18, further comprising instructions that, when executed by the processor, cause the processor to:

correlate the first data and the second data to generate correlation data, wherein the at least one identified mobile communication device is identified based on the correlation data; and

store the correlation data at a database.

20. The computer-readable storage device of claim 19, further comprising instructions that, when executed by the processor, cause the processor to:

receive, from a server, a request for information associated with mobile communication devices that were located within the threshold distance of the of the first access point; and

send the correlation data to the server.

21. The computer-readable storage device of claim 20, wherein the server is associated with one of a law enforcement agency and a content provider.

22. The computer-readable storage device of claim 17, wherein the first data includes an identifier of an unauthorized data request, an identifier of the at least identified one mobile communication device, a timestamp, a location, a uniform resource identifier, or any combination thereof.

23. The computer-readable storage device of claim 17, wherein the first access point is identified as a source of an unauthorized data request.

24. The computer-readable storage device of claim 23, wherein the first access point is a wireless data communication access point that complies with an institute of electrical and electronics engineers (IEEE) wireless communication standard.

25. The computer-readable storage device of claim 17, wherein the first data is received from a first mobile communication service provider, wherein the second data is received from a second mobile communication service provider.

26. The computer-readable storage device of claim 25, further comprising instructions that, when executed by the processor, cause the processor to:

identify at least one mobile communication device that is identified by the first data and the second data by performing a correlation of the first data and the second data to generate first correlation data; and

store the correlation data at a database.

27. The computer-readable storage device of claim 17, further comprising instructions that, when executed by the processor, cause the processor to:

receive third data identifying mobile communication devices that are located within a threshold distance of a second access point;

identify at least one mobile communication device that is identified by the first data, the second data, and the third data by performing a correlation of the first data, the second data, and the third data to generate second correlation data; and

store the correlation data at a database