Apparatus and methods for providing wireless system fraud and visibility data

• US 6,014,557 A
• Filed: 03/14/1996
• Issued: 01/11/2000
• Est. Priority Date: 03/14/1996
• Status: Expired due to Fees

• Current Assignee: Bellsouth Intellectual Property Corporation (AT&T, Inc.)
• Original Assignee: Bellsouth Intellectual Property Corporation (AT&T, Inc.)
• Inventors: Morton, John W., Smith, Thomas C.
• Primary Examiner(s): Chin, Wellington
• Assistant Examiner(s): Ferguson, Keith
• Application Number:
  US08/615,962
• Time in Patent Office: 1,398 Days
• Field of Search: 455/410, 455/461, 455/411, 455/67.1, 455/405, 455/435, 455/423, 455/406, 455/408, 455/404, 455/412, 455/432, 455/436, 455/438, 455/440, 455/560, 455/422, 455/439, 379/34, 379/207, 379/112, 379/111, 370/250
• US Class Current: 455/410
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

Apparatus and methods are disclosed for providing wireless telecommunications service providers roamer visibility for on-line customer support and a fraud data feed for reducing losses due to fraud, obviating the need for each provider to purchase data from a central clearinghouse. Monitoring devices are coupled to existing network links (e.g., SS7 telecommunications links) or network elements (e.g., an STP pair), and are adapted to capture certain data regarding user traffic. The captured data is in turn provided via a wide area network or other transmission means to a message processor. The message processor collates raw messages received from the data capture devices and produces roamer visibility and fraud data. This subscriber-related data can be used to populate one or more databases available for query by on-line client workstations, or may, in the case of fraud-related data, be provided as a wire feed or other transmission to a fraud detection system or other wireless service providers. Before providing fraud data, redundant data is eliminated.

Claims

1. Apparatus for generating wireless telecommunications system data for use in administering wireless systems and detecting fraud in their use, the apparatus in communication with at least one data capture device for capturing from a telecommunications network messages indicative of wireless telecommunications transmitted over the network, the messages corresponding to a first or second class, the apparatus comprising:

a. means for receiving wireless telecommunications messages from the data capture device; and

b. at least one message processor coupled to a first memory location and programmed to;

i. store in the first memory location those of the received messages that belong to the first class;

ii. collate each received message belonging to the second class with its mate by searching the first memory location for a previously stored message of the first class related to the received message of the second class; and

iii. provide the collated messages to an end-user.

2. The apparatus according to claim 1, wherein the first class of messages includes invoke messages and the second class of messages includes return result messages.

3. The apparatus according to claim 2, wherein:

a. the messages indicative of wireless telecommunications traffic are IS-41 messages;

b. the first class of messages are IS-41 invoke messages;

c. the second class of messages are IS-41 return results messages;

d. the search for IS-41 invoke messages relates to each received IS-41 return result message and is to find an invoke message corresponding to a particular received result message; and

e. the collating of related messages comprises the pairing of each received return result message with the invoke message corresponding to that return result message.

4. The apparatus according to claim 1, wherein the apparatus includes a second memory location, the telecommunications messages include registration notification messages, the message processor further being programmed to determine whether the message belonging to a first class is a registration notification message and, if so, to write the message to the second memory location.

5. The apparatus according to claim 4, wherein the message processor is centrally located and is further programmed to identify redundant data.

6. The apparatus according to claim 5, wherein the apparatus includes a third memory location containing source information identifying at least one outside source that provides particular registration notification data, the data capture device provides information regarding the origin of the registration notification data it provides, and the message processor identifies redundant data by checking the origin of each registration notification message to determine whether it originated from a location for which registration notification messages also are received from the outside source.

7. The apparatus according to claim 6, wherein the apparatus is in communication with a fraud detection system and the message processor is further programmed to provide registration notification data from the second memory location to the fraud detection system.

8. The apparatus according to claim 1, wherein, if no message located in the search of the first memory location is identified as related to the received message, then the received message is stored in the first memory location.

9. The apparatus according to claim 1, wherein the messages are each a member of a set of paired messages and the matching of each member with its pair produces matched sets, each fully identifying a wireless telecommunications system action.

10. The apparatus according to claim 1, wherein the data capture device comprises a link capture device comprising:

a. at least one telecommunications link interface each corresponding and coupled to at least one telecommunications link for reading signals off the link; and

b. a processor coupled to the telecommunications link interface and programmed to;

i. retrieve signals read by the telecommunications link interface;

ii. identify messages in the retrieved signals;

iii. select messages belonging to a preselected set of message types of interest; and

iv. transmit the selected messages to the message processor.

11. The apparatus according to claim 1, wherein the data capture device comprises a Signal Transfer Point capture device comprising:

a. at least two preprocessors, each coupled to one of a pair of coupled Signal Transfer Points, the preprocessors each programmed to;

i. communicate via a communications link with one Signal Transfer Point;

ii. select messages of interest passing through the Signal Transfer Point; and

iii. transfer selected messages to;

b. a merge processor coupled to each of the preprocessors and programmed to;

i. receive selected messages of interest from each preprocessor;

ii. merge the selected messages from each preprocessor; and

iii. forward the messages to the message processor.

12. The apparatus according to claim 1, wherein the data capture device comprises a switch capture device for interfacing with a wireless telecommunications network switch that includes a buffer for holding wireless telecommunications messages translated into a standard format and means for responding to a remote request, the switch capture device comprising a message visibility processor programmed to:

a. request messages of interest from the remote request response means;

b. receive messages of interest and store received messages; and

c. periodically provide at least some of the stored messages to the message processor.

13. The apparatus according to claim 1, wherein the receiving means comprises a bus that couples the data capture device to the message processor.

14. A method for generating wireless telecommunications system fraud and visibility data for use by a wireless telecommunications service provider in administering its wireless system and detecting fraud in its use, the method apparatus with at least one memory location and in communication with at least one data capture device for capturing and transmitting messages indicative of such traffic, the messages corresponding to a first class or a second class, the method comprising the steps of:

a. receiving messages indicative of wireless telecommunications traffic from the telecommunications message data capture device;

b. storing the received messages belonging to the first class in the memory location;

c. for each received message belonging to the second class;

i. searching the memory location for a previously stored message of the first class related to the received message; and

ii. if any message located in the search is related to the received message of the second class, collating the received message with the located message; and

d. providing the collated messages to an end-user.

15. The method according to claim 14, wherein:

the messages indicative of telecommunications traffic are IS-41 messages;

the first class of messages are IS-41 invoke messages;

the second class of messages are IS-41 return results messages;

the search for IS-41 invoke messages related to each received IS-41 return result message is to find an invoke message corresponding to a particular received return result message; and

the collating of related messages in step c.ii. comprises the step of pairing each received return result message with the located invoke message corresponding to that return result message.

16. The method according to claim 14, wherein the apparatus includes a second memory location, the telecommunications link messages include roaming wireless telecommunications registration notification messages, and further comprising the step of checking whether the message belonging to a first class is a registration notification and, if so, writing the message to the second memory location.

17. The method according to claim 16, wherein the apparatus includes a third memory location containing source information identifying at least one outside source from which registration notification data is received, the data capture device provides information regarding the location of origin of particular registration notification messages, and the method further comprising the steps of:

checking whether each registration notification message originated in a location for which registration notification messages are received from an outside source; and

if the message did originate in a location for which registration notification messages are received from an outside source, discarding that registration notification message.

18. The method according to claim 17, wherein the apparatus is in communication with a fraud detection system, and the method further comprises the step of providing registration notification messages from the second memory location to the fraud detection system.

19. The method according to claim 14, further comprising the step of writing the collated messages to a file containing entries for messages captured on a particular day.

20. The method according to claim 19, further comprising the step, before providing the collated messages to an end user, of reading records from the files containing messages captured on particular days and inserting them into a database containing message entries organized according to the day of the occurrence of calls to which the messages pertain.

21. The method according to claim 14, further comprising the steps of, prior to receiving the messages, monitoring a telecommunications network element or link in order to capture messages of interest and providing captured messages to the message processor.

22. The method according to claim 21, wherein the monitoring step comprises the steps of:

a. reading signals off a telecommunications link via a telecommunications link interface; and

b. programming a processor, coupled to the telecommunications link interface, to;

i. retrieve signals read by the link interface;

ii. identify messages in the retrieved signals; and

iii. select messages belonging to a preselected set of message types of interest.

23. The method according to claim 21, wherein the monitoring step comprises the steps of:

a. obtaining messages of interest from each Signal Transfer Point in a pair of Signal Transfer Points; and

b. transferring messages of interest to a merge processor for merging the messages of interest obtained from each Signal Transfer Point.

24. The method according to claim 21, wherein the network element comprises a switch, across which flow messages in a proprietary format, and the monitoring step further comprises the steps of:

a. translating, at the switch, proprietary format messages into a standard format;

b. storing, at the switch, the translated messages;

c. requesting from the switch translated messages belonging to a preselected set of message types of interest.

25. A method of furnishing visibility and/or fraud data relating to wireless telecommunications based on signals carrying messages pertaining to such communications, the signals being transmitted through a network element or over at least one telecommunications network link coupled to at least one switching center, a data capture device being coupled to the link or the network element and including at least one memory coupled to a processor, the data capture device being in communication with an administrative instrumentality for monitoring, servicing or otherwise administering a telecommunications system, the method comprising the steps of:

a. obtaining telecommunications signals from the link or the network element, the signals containing messages pertaining to wireless telecommunications;

b. identifying messages pertaining to wireless telecommunications present in the signals;

c. selecting identified messages belonging to a preselected set of message types of interest; and

d. providing each selected message to the administrative instrumentality.

26. The method according to claim 25, wherein the preselected set of message types comprises a message type selected from the group consisting of:

wireless telecommunication registration notification;

wireless telecommunication qualification information; and

wireless telecommunication service profile request information.

27. The method according to claim 25, wherein the messages comprise IS-41 messages and the preselected set of message types comprises:

a. registration notification;

b. qualification request;

c. qualification directive;

d. service profile request;

e. service profile directive; and

f. return result.

28. The method according to claim 27, wherein the signals propagating on the links comprise signals transmitted according to the SS7 signaling standard.

29. The method according to claim 25, wherein the providing step comprises the steps of formatting the selected messages and transmitting the selected messages to the administrative instrumentality.

30. The method according to claim 29, wherein the transmission step further comprises the steps of determining whether a transmission medium connection is available for communicating the message to the administrative instrumentality, and, if the connection is not available, attempting to establish the connection.

31. The method according to claim 30, further comprising the step of logging the selected message in the memory if the attempt to establish a connection was unsuccessful.

32. The method according to claim 31, further comprising the steps of checking whether any formatted message to be transmitted is in the memory, attempting to transmit one of those messages in the memory to the administrative instrumentality, and, if the attempt to transmit the message was unsuccessful, re-logging the message in the memory.

33. The method according to claim 32, further comprising the steps of:

checking whether the data capture device has received a shutdown command and, if a shutdown command has been received, terminating the communication connection with the administrative instrumentality.

34. The method according to claim 33, further comprising the steps of setting a delay timer after terminating the communication connection and checking whether a transmission medium connection is available only after expiration of the delay timer.

35. The method according to claim 25, wherein the administrative instrumentality comprises a fraud detection system receiving messages of interest from an outside source and, before providing each selected message in step d, further comprising the step of filtering the selected messages to eliminate messages of interest received from the outside source.

36. A method of generating data for use by a wireless telecommunications service provider in administering its wireless telecommunications system or detecting fraud in its use, the system including a plurality of devices each for monitoring and capturing selected wireless telecommunications messages, each of the plurality of monitoring and capture devices communicating with a message processor having a memory, the method comprising the steps of:

a. capturing messages transmitted on each of a plurality of links or a network element; and

b. providing to a message processor captured messages generated by roaming subscribers and belonging to a preselected set of message types.

37. The method according to claim 36 wherein each of the captured messages corresponds to a first class or a second class and the processing step further comprises the steps of:

a. determining whether each message belongs to the first class of messages;

b. if a message belongs to the first class of messages, storing that message in the memory location;

c. determining, for each message not belonging to a first class of messages, whether the message belongs to the second class of messages; and

d. collating the second class messages by;

i. searching the memory location for a previously stored message of the first class related to the received message of the second class; and

ii. if any message of the first class located in the search of the memory location is related to the received message of the second class, collating the second class received message with the located first class message.

38. The method according to claim 37 further comprising the step of processing through the message processor the captured messages to create (i) a database containing paired sets of messages, each paired set describing a particular wireless telecommunication transaction, or (ii) a database containing expired invoke messages of the preselected set of message types.

39. The method according to claim 38, wherein the capturing step further comprises the steps of:

a. coupling at least one telecommunications link interface to at least one telecommunications link for reading signals off the link;

b. retrieving signals read by the telecommunications link interface;

c. identifying the preselected set of message types in the retrieved signals.

40. The method according to claim 38, wherein the capturing step further comprises the steps of:

a. coupling a first preprocessors to one of a pair of coupled Signal Transfer Points and coupling a second preprocessor to the other of the pair of coupled Signal Transfer Points;

b. communicating through the preprocessors via a communications link with one Signal Transfer Point;

c. selecting via the preprocessor the preselected set of message types passing through the Signal Transfer Point.

41. The method according to claim 38, wherein the capturing step further comprises the steps of:

a. providing the wireless system with a telecommunications network switch that includes a buffer for holding wireless telecommunications messages translated into a standard format;

; and

b. programming the switch to at least temporarily buffer messages comprising the preselected set of message types.