Fraud detection in radio communications network

• US 5,734,977 A
• Filed: 11/10/1994
• Issued: 03/31/1998
• Est. Priority Date: 11/10/1994
• Status: Expired due to Term

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Sanmugam, K. Raj
• Primary Examiner(s): MacDonald, Allen R.
• Assistant Examiner(s): RICHARDSON, SCO
• Application Number:
  US08/336,988
• Time in Patent Office: 1,237 Days
• Field of Search: 379/59, 379/58, 379/60, 379/62, 455/33.1, 455/54.2, 455/50.1, 455/410, 455/435, 455/424, 455/411, 455/433
• US Class Current: 455/410
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/125 Protection against power exhaustion attacks
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A method for detecting fraud in a cellular radio telephone system. Fraud is suspected when the system detects a multiple access from a mobile station, when an activity collision occurs, when the system receives a premature registration from the mobile station, when auditing or operator-initiated locating of the mobile station reveals the existence of the mobile station in two locations simultaneously, or when tracing of mobile subscriber activity reveals unusual activity.

Claims

1. In a cellular radio telephone system including an exchange in communication with a plurality of mobile stations over a plurality of radio frequency (RF) channels including at least one voice channel and at least one control channel, a method for detecting fraud in said system comprising the steps of:

receiving at said exchange a system access over a control channel of said system;

identifying which mob fie station is making said system access;

determining whether the identified mobile station is indicated to be currently connected to a voice channel of said system;

if the identified mobile station is indicated to be currently connected to said voice channel, sending to the identified mobile station an audit order over said voice channel for the purpose of verifying whether the identified mobile station is still connected to said voice channel; and

detecting fraud if a response to said audit order is received from the identified mobile station over said voice channel, thus verifying that the identified mobile station is still connected to said voice channel.

2. The method of claim 1 wherein said system access comprises a registration, a call origination, a solicited page response, an unsolicited page response, or a service call.

3. The method of claim 1 wherein said step of determining whether the identified mobile station is indicated to be currently connected to a voice channel of said system comprises the step of determining whether the identified mobile station is marked "busy" in a home location register (HLR) connected to said exchange.

4. A method for detecting fraud in a radio communications network comprised of a plurality of systems serving a plurality of mobile stations, the method comprising the steps of:

receiving at one of said systems a request for service from one of said mobile stations;

determining whether said one mobile station is indicated to be actively receiving service in another one of said systems;

if said one mobile station is indicated to be active in said other system, sending to said one mobile station an audit order over a voice channel of said other system for the purpose of verifying whether said one mobile station is still active in said other system; and

detecting fraud if a response to said audit order is received from said one mobile station over said voice channel, thus verifying that said one mobile station is still active in said other system.

5. The method of claim 4 wherein:

said network comprises a home system of said one mobile station and a plurality of visited systems in which said one mobile station can roam;

said service request is received at a first one of said visited systems; and

said one mobile station is determined to be active in a second one of said visited systems.

6. The method of claim 5 wherein:

said first one of said visited systems sends to said home system a notification of having received said service request from said one mobile station;

upon receiving said service request notification, said home system determines that said one mobile station is indicated to be active in said second one of said visited systems and sends thereto a notice to cancel service to said one mobile station;

upon receiving said cancellation notice, said second one of said visited systems determines that said one mobile station is indicated to be actively receiving service therefrom and sends an audit order to said one mobile station; and

fraud is detected if said second one of said visited systems receives a response to said audit order.

7. The method of claim 6 wherein said service request is a registration, a call origination, a solicited page response, an unsolicited page response, or a service call.

8. The method of claim 6 wherein said home system includes a home location register (HLR) for storing information on the activities of said one mobile station.

9. The method of claim 6 wherein said second one of said visited systems sends to said home system an indication of whether said response was received from said one mobile station.

10. A method for detecting fraud in a cellular network including a plurality of mobile stations subscribing service from a home system and capable of receiving service in a plurality of other systems, said home system maintaining a register of which systems are currently serving said mobile stations, the method comprising the steps of:

receiving at said home system a notification that one of the other systems has received a service request from one of said mobile stations;

determining at said home system whether the other system which received said service request is the same as the system which is registered to be currently serving said one mobile station;

if the other system is different from the registered system, sending from said home system to the registered system an order cancelling service to said one mobile station;

determining at said registered system in response to the receipt of said order the current activity status of said one mobile station;

if said one mobile station is indicated to be currently active in said registered system, sending to said one mobile station an audit order over a voice channel in said registered system for the purpose of confirming that said one mobile station is still active in said registered system; and

detecting fraud if an audit response is received from said one mobile station over said voice channel, thus confirming that said one mobile station is still active in said registered system while also indicated as being active in the other system.

11. The method of claim 10 wherein the step of determining whether the other system is the same as the registered system comprises the step of determining whether the other system is the same as that indicated by a temporary location (TLOC) register for said one mobile station in said home system.

12. The method of claim 10 further comprising the step of reporting to said home system whether or not said audit response was received from said one mobile station in said registered system.

13. A method for detecting fraud in a radio communications system in which a plurality of mobile stations periodically register with said system on the basis of a comparison between the current value of a registration identification (REGID) periodically transmitted from said system and the current value of a next registration (NXTREG) stored in each of said mobile stations, said NXTREG value in each mobile station being updated at each periodic registration by that mobile station with the sum of the then-current value of REGID and the value of a registration increment (REGINCR) transmitted from said system, the method comprising the steps of:

determining the difference between the values of REGID for two registrations received by said system from a particular mobile station;

comparing the REGID difference between the two registrations with the value of REGINCR; and

detecting fraud if the REGID difference between the two registrations is less than the REGINCR value.

14. The method of claim 13 wherein said two registrations are consecutive periodic registrations.

15. The method of claim 13 wherein each mobile station also updates its NXTREG value at each call origination or reception.

16. The method of claim 13 wherein:

said system comprises a plurality of location areas; and

the two registrations are received from said particular mobile station within the same location area of said system.

17. A method for detecting fraud in a radio communications system in which a mobile station periodically registers with the system on the basis of a comparison between the current value of a registration identification (REGID) periodically transmitted from said system and the current value of a next registration (NXTREG) stored in said mobile station, said NXTREG value being updated at each periodic registration with the sum of the then-current value of REGID and the value of a registration increment (REGINCR) transmitted from said system, the method comprising the steps of:

storing the value of REGID at the time at which a first registration from said mobile station was received by said system;

estimating the value of REGID at the expected time of arrival at said system of a second registration from said mobile station as the sum of the REGINCR value and the stored REGID value;

determining the value of REGID at the actual time of arrival at said system of said second registration from said mobile station;

comparing the estimated REGID with the actual REGID value for said second registration; and

detecting fraud if the actual REGID value is less than the estimated REGID value for said second registration.

18. The method of claim 17 wherein said first and second registrations are consecutive periodic registrations.

19. The method of claim 17 wherein said mobile station also updates the NXTREG value at each call origination or reception.

20. The method of claim 17 wherein:

said system comprises a plurality of location areas; and

said first and second registrations are received from said mobile station within the same location area of said system.

21. In a radio communications network, a method for locating a mobile station suspected of fraud comprising the steps of:

selecting an area to be searched for said mobile station;

issuing an audit order on a voice channel in said area for said mobile station;

detecting an answer to said audit order on said voice channel from said mobile station; and

determining the location of said mobile station based upon the location from which said answer was detected.

22. The method of claim 21 wherein:

said network comprises a home system for said mobile station and at least one other system; and

said home system selects said search area.

23. The method of claim 22 wherein said search area is in another system and said home system sends to said other system a request to audit said mobile station in said search area.

24. The method of claim 22 wherein said search area is selected through operator commands or is set to a default search area comprising the last registered area for said mobile station.