Detection of cloned identifiers in communication systems

• US 8,010,083 B2
• Filed: 05/21/2007
• Issued: 08/30/2011
• Est. Priority Date: 05/22/2006
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Descombes, Pierre-Yves, Iwulski, Eddie, Wassifi, Hamid
• Primary Examiner(s): Afshar; Kamran
• Assistant Examiner(s): SHAHEED, KHALID W
• Application Number:
  US11/802,157
• Publication Number:
  US 20070275718A1
• Time in Patent Office: 1,562 Days
• Field of Search: 455/435.1
• US Class Current: 455/410
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2203/6027 Fraud preventions
• CPC Class Codes: H04M 2207/18 wireless networks
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 3/229 Wire identification arrangements; Number assignment determination
• CPC Class Codes: H04Q 2213/13097 Numbering, addressing
• CPC Class Codes: H04Q 2213/13098 Mobile subscriber
• CPC Class Codes: H04Q 2213/13103 Memory
• CPC Class Codes: H04Q 2213/13139 Fraud detection/prevention
• CPC Class Codes: H04Q 2213/13213 Counting, timing circuits
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

According to one aspect of the present invention, there is provided a method, in a communication system having a plurality of communication devices each having a first and second identifier associated therewith at the time of a connection attempt to the network, of identifying when one of the identifiers has been cloned, the connection status of the first identifier being obtainable from a network element, comprising receiving the first and second identifiers of a communication device, determining whether one of the identifiers has been cloned, the determination being made in part through information obtained from a connection history database, and in part through information obtained from the network element.

Claims

1. A method of identifying cloned identifiers comprising:

receiving a first identifier relating to the identity of a communication device and a second identifier relating to the identity of a subscriber at the time of a connection attempt to a network; and

determining whether one of the identifiers has been cloned, the determination being made in part through information obtained from a connection history database, and in part through information obtained from a network element,

in which the connection history database stores previously received first and second identifiers, and

in which determining whether one of the identifiers has been cloned comprises determining whether the first identifier has been cloned, the method further comprising;

determining from the connection history database whether the received first identifier has previously attempted to connect to the network with a number of second identifiers other than the received second identifier, and where it is so determined, obtaining those other second identifiers, and

determining from the network element whether any of the other second identifiers are currently connected to the network.

2. The method of claim 1, further comprising

determining from the connection history database, for each of the other second identifiers, whether the latest entry in connection history database is paired with the received first identifier, and if it so determined, signaling that the first identifier has been cloned.

3. The method of claim 1 in which determining whether one of the identifiers has been cloned further comprises determining whether the second identifier has been cloned, the method further comprising:

determining from the connection history database whether the last connection attempt for the received second identifier was with a first identifier other than the received first identifier;

determining from the network element whether the received second identifier is currently connected to the network; and

where it is so determined, signaling that the received second identifier has been cloned.

4. The method of claim 1, further comprising storing a timestamp correlating to previously received first and second identifiers in the connection history database.

5. The method of claim 1, further comprising, determining whether the received first and second identifiers are the genuine first and second identifiers, the determination being based on information stored in the connection history database,

in which the earliest recorded first and second identifiers entered in the connection history database are the genuine first and second identifiers.

6. The method of claim 5, wherein the step of storing the received identifiers further includes storing an incremental connection attempt number for the received first and second identifiers, and wherein the step of determining the genuine identifiers comprises using the stored incremental connection attempt number.

7. The method of claim 6, further comprising causing the disconnection of a mobile communication device having an identifier determined as having been cloned.

8. The method of claim 1, wherein the network is a mobile telephony network, wherein the communication devices are mobile stations, wherein the network element is a home location register, wherein the first identifier is an international mobile equipment identifier, IMEI, and wherein the second identifier is an international mobile subscriber identity, IMSI.

12. The method of claim 1, further comprising, determining whether the received first and second identifiers are the genuine first and second identifiers, in which the first and second identifier pairing with the greatest number of recorded connections are the genuine first and second identifiers.

13. The method of claim 1, further comprising, determining whether the received first and second identifiers are the genuine first and second identifiers, in which the determination is based on location information stored in the connection history database.

14. The method of claim 13, in which determining whether the received first and second identifiers are the genuine first and second identifiers comprises:

determining whether a connection of the first and second identifiers occurred at a different location than the location of a different connection of the first or second identifiers;

determining that the first or second identifiers are not genuine if the locations are different and the time difference between the two connections of the first and second identifiers is less than that required to travel from the different locations.

9. An apparatus for determining if an identifier has been cloned, comprising:

a receiver for receiving via a network a first identifier relating to the identity of a communication device and a second identifier relating to the identity of a subscriber associated with a communication device;

a first interface for accessing a network element for providing the connection status of the first identifier;

a second interface for accessing a connection history database, the connection history database being configured to store, in response to a connection attempt by a communication device, connection data related to the first and second identifiers associated with that communication device; and

a processor for determining whether one of the received identifiers has been cloned, the determination being made in part through data obtained from the connection history database, and in part through data obtained from the network element,

in which the processor further determines whether the second identifier has been cloned by determining from the connection history database whether the last connection attempt for the received second identifier was with a first identifier other than the received first identifier; and

determining from the network element whether the received second identifier is currently connected to the network.

10. A system for identifying cloned identifiers comprising:

mobile switching center (MSC) configured to determine an international mobile equipment identity (IMEI) and an international mobile subscriber identity (IMSI) associated with a mobile station;

an equipment identity register (EIR) configured to classify IMEI numbers;

an equipment identity register proxy (EIR proxy) electronically coupled between the MSC and the EIR; and

a connection history database configured to store a number of IMEI and IMSI pairs,

in which the EIR proxy is configured to receive the IMEI and the IMSI from the MSC, and access the connection history database to determine whether the IMEI or the IMSI have been cloned.

11. The system of claim 10, in which the EIR proxy is further configured to determine, via the EIR, whether the IMEI is blacklisted, graylisted, or whitelisted.