System and method for detecting cloning fraud in cellular/PCS communications

• US 6,370,373 B1
• Filed: 11/23/1994
• Issued: 04/09/2002
• Est. Priority Date: 11/23/1994
• Status: Expired due to Term

• Current Assignee: Alcatel-Lucent USA, Inc. (Nokia Corporation)
• Original Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Inventors: Rooney, Timothy J., Kamath, Yogeesh H., Gerth, Donald M.
• Primary Examiner(s): Maung, Nay
• Assistant Examiner(s): Vuong, Quochien B.
• Application Number:
  US08/344,390
• Time in Patent Office: 2,694 Days
• Field of Search: 379/59, 379/60, 379/62, 455/33.1, 455/33.2, 455/54.2, 455/56.1, 455/410, 455/411, 455/435, 380/21, 380/23, 380/250, 380/258, 380/279
• US Class Current: 455/410
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/2026 Wireless network, e.g. GSM, PCS, TACS
• CPC Class Codes: H04M 2215/32 Involving wireless systems
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 4/24 Accounting or billing

Abstract

A system and method for proactively detecting cloning fraud in a cellular mobile telephone environment are discussed. Information is collected which corresponds to registration notifications of the cellular telephones as they operate within the cellular mobile telephone environment. The registration information is used to detect time-space peculiarities. Specifically, registrations having the same mobile identification number and occurring in different mobile switching centers within a predetermined time interval are identified. This time interval, based on a reasonable travel time between cells covered by the different mobile switching centers where the registrations originated, is used as a threshold for detecting cloning fraud.

Claims

1. A method for proactively detecting cloning fraud in a mobile cellular telephone environment, comprising the steps of:

(1) collecting a plurality of registration notifications each represented by a registration notification (REGNOT) record comprising a mobile identification number (MIN), a time stamp of said registration notification, and originating indicia identifying a cell where said registration notification originated;

(2) detecting a first REGNOT record and a second REGNOT record having a common MIN;

(3) computing a time difference between time stamps of said first and second REGNOT records; and

(4) determining whether cloning fraud involving said common MIN has occurred based on said time difference.

2. The method of claim 1, wherein step (4) comprises the step of comparing said time difference to a clone detection time corresponding to a time needed to travel between cells identified by originating indicias contained in said first and second REGNOT records.

3. The method of claim 2, wherein said clone detection time is stored in a clone detection time table and retrieved using said originating indicias contained in said first and second REGNOT records as indices into said clone detection time table.

4. The method of claim 1, wherein the plurality of REGNOT records are received from a plurality of RVCDs.

5. A method for proactively detecting cloning fraud in a mobile cellular telephone environment, comprising the steps of:

(1) storing a plurality of registration notifications each represented by a registration notification (REGNOT) records, each REGNOT record comprising a mobile identification number (MIN), a time stamp of said registration notification, and originating indicia identifying a cell where said registration notification originated;

(2) forming a clone data window comprising a plurality of said REGNOT records occurring within a predetermined time frame;

(3) detecting in said clone data window a first REGNOT record and a second REGNOT record having a common MIN;

(4) computing a time difference between time stamps of said first and second REGNOT records;

(5) determining whether cloning fraud involving said common MIN has occurred based on said time difference; and

(6) recording said occurrence of cloning fraud involving said common MIN.

6. The method of claim 5, wherein step (5) comprises the step of comparing said time difference to a clone detection time corresponding to a time needed to travel between cells identified by originating indicias contained in said first and second REGNOT records.

7. The method of claim 6, wherein said clone detection time is stored in a clone detection time table and retrieved using said originating indicias contained in said first and second REGNOT records as indices into said clone detection time table.

8. The method of claim 7, wherein said clone detection window is formed every 30 minutes and said predetermined time frame is the previous 6.5 hours.

9. The method of claim 5, wherein the plurality of REGNOT records are received from a plurality of RVCDs.

10. A computer-based system for proactively detecting cloning fraud in a mobile cellular telephone environment, comprising:

storing means for storing a plurality of registration notifications each represented by a registration notification (REGNOT) record, each REGNOT record comprising a mobile identification number (MIN), a time stamp of said registration notification, and originating indicia identifying a cell where said registration notification originated;

detecting means for detecting a first REGNOT record and a second REGNOT record having a common MIN;

computing means for computing a time difference between time stamps of said first and second REGNOT records;

means for determining whether cloning fraud involving said common MIN has occurred based on said time difference; and

reporting means for reporting said occurrence of cloning fraud involving said common MIN.

11. The system of claim 10, wherein said means for determining cloning fraud comprises comparing said time difference to a clone detection time corresponding to the time needed to travel between cells identified by originating indicias contained in said first and second REGNOT records.

12. The system of claim 11, wherein said clone detection time is stored in a clone detection time table and retrieved using said originating indicias contained in said first and second REGNOT records as indices into said clone detection time table.

13. The system of claim 10, further comprising means for accepting a plurality of REGNOT records from a plurality of RVCDs.

14. A method for proactively detecting cloning fraud in a mobile cellular telephone environment, comprising the steps of:

receiving a plurality of registration notifications each having a mobile identification number for identifying a mobile user in the mobile cellular telephone environment;

obtaining a time stamp and an originating indicia for each of said plurality of registration notifications, wherein said time stamp indicates when and said originating indicia indicates where each of said plurality of mobile identification numbers was received; and

determining whether an instance of cloning fraud has occurred based on said time stamps and said originating indicias of two of said plurality of registration notifications having a same mobile identification number.

15. The method of claim 14, wherein said step of determining comprises:

computing a time difference between time stamps of said two of said plurality of registration notifications having the same mobile identification number; and

comparing said time difference to a time needed to travel between said cells indicated by said originating indicias.

16. The method of claim 14, wherein the plurality of REGNOT records are received from a plurality of RVCDs.

17. A method for detecting cloning fraud in a mobile telephone environment, comprising the steps of:

receiving a plurality of registration notification each identifying a same particular mobile user; and

determining, as a function of a time of creation of each of said plurality of registration notifications and a location identified as the location of a mobile telephone that caused the creation of each of said plurality of registration notifications, whether an instance of cloning fraud has occurred.

18. The method of claim 17, wherein the plurality of REGNOT records are received from a plurality of RVCDs.

19. A method for detecting cloning fraud in a mobile telephone environment, comprising the steps of:

receiving a plurality of registration notifications identifying a same particular mobile user;

obtaining a creation time and an originating location for each of said plurality of registration notifications; and

determining whether cloning fraud has occurred based on said creation times and said originating locations.

20. The method of claim 19, wherein the plurality of REGNOT records are received from a plurality of RVCDs.