Monitoring suspicious events in a cellular network

1. A method in a cellular network, comprising:

receiving a monitoring request regarding a user equipment;

performing a monitoring activity regarding the user equipment with respect to at least one suspicious event; and

responding to the monitoring request indicating whether monitoring will be performed for the user equipment,

wherein the monitoring activity comprises selecting a serving node for monitoring services and registering the user equipment for monitoring service with the serving node, the method further comprising

receiving a registration status response in response to the registering; and

forwarding the registration status toward a source of the monitoring request while responding to the monitoring request,

wherein the suspicious event comprises at least one event of the following: a tracking update, accessing a network, location update, or exceeding a data usage limit.

2. The method of claim 1 , wherein the suspicious event comprises at least one event of the following: the tracking update occurs from a location outside an area allowed for the user equipment or from a certain device category; the user equipment or the device category accesses the network outside an allowed time interval or at a forbidden time interval; the user equipment or the device category is subscribed for packet switched services only but is performing the location update to obtain voice service; or the user equipment or the device category has exceeded the data usage limit.

3. The method of claim 1 , wherein the device category comprises a category of at least one of the following: smart phones, regular phones, machine type devices, smart meters, tablets, or dongles.

4. A method in a cellular network, comprising:

requesting monitoring of a user equipment with respect to at least one suspicious event; and

receiving a response to the monitoring request, wherein the response indicates a registration status of the monitoring,

wherein the monitoring comprises selecting a serving node for monitoring services and registering the user equipment for monitoring service with the serving node, the method further comprising

receiving a registration status response in response to the registering; and

forwarding the registration status toward a source of the monitoring request while responding to the monitoring request,

wherein the suspicious event comprises at least one event of the following: a tracking update, accessing a network, location update, or exceeding a data usage limit.

5. The method of claim 4 , wherein the requesting monitoring comprises sending a monitoring request to a machine type communication interworking function.

6. A method in a cellular network, comprising:

receiving a request for monitoring a user equipment with respect to at least one suspicious event;

determining whether the monitoring is permitted; and

responding to the request based on whether the monitoring is permitted,

wherein the monitoring comprises selecting a serving node for monitoring services and registering the user equipment for monitoring service with the serving node, the method further comprising

receiving a registration status response in response to the registering; and

forwarding the registration status toward a source of the monitoring request while responding to the monitoring request,

wherein the suspicious event comprises at least one event of the following: a tracking update, accessing a network, location update, or exceeding a data usage limit.

7. The method of claim 6 , further comprising:

determining whether monitoring is permitted under a subscriber agreement corresponding to the user equipment, wherein the responding is based on the subscriber agreement of the user equipment.

8. The method of claim 7 , further comprising:

storing an identifier of the requestor of the monitoring.

9. A method in a cellular network, comprising:

monitoring for a suspicious event with respect to a user equipment for which monitoring has been requested by a requestor;

detecting an occurrence of the suspicious event with respect to the user equipment; and

reporting the occurrence to the requestor,

wherein the monitoring comprises selecting a serving node for monitoring services and registering the user equipment for monitoring service with the serving node, the method further comprising

receiving a registration status response in response to the registering; and

forwarding the registration status toward a source of the monitoring request while responding to the monitoring request,

wherein the suspicious event comprises at least one event of the following: a tracking update, accessing a network, location update, or exceeding a data usage limit.

10. The method of claim 9 , wherein the reporting comprises sending an indication of the user equipment's international mobile subscriber identity to the requestor.

11. The method of claim 9 , wherein the reporting comprises sending a report to a machine type communication interworking function.

12. A method in a cellular network, comprising:

receiving a report of suspicious activity with respect to a user equipment for which monitoring has been requested by a requestor; and

forwarding the report of the suspicious activity to the requestor,

wherein the monitoring comprises selecting a serving node for monitoring services and registering the user equipment for monitoring service with the serving node, the method further comprising

receiving a registration status response in response to the registering; and

forwarding the registration status toward a source of the monitoring request while responding to the monitoring request,

wherein the suspicious activity comprises at least one event of the following: a tracking update, accessing a network, location update, or exceeding a data usage limit.

13. The method of claim 12 , further comprising:

receiving, in the report, a user equipment's international mobile subscriber identity; and

translating the user equipment's international mobile subscriber identity to an external identifier or mobile subscriber integrated services digital network number.

14. The method of claim 4 , wherein the suspicious event comprises at least one event of the following: the tracking update occurs from a location outside an area allowed for the user equipment or from a certain device category; the user equipment or the device category accesses the network outside an allowed time interval or at a forbidden time interval; the user equipment or the device category is subscribed for packet switched services only but is performing the location update to obtain voice service; or the user equipment or the device category has exceeded the data usage limit.

15. The method of claim 6 , wherein the suspicious event comprises at least one event of the following: the tracking update occurs from a location outside an area allowed for the user equipment or from a certain device category; the user equipment or the device category accesses the network outside an allowed time interval or at a forbidden time interval; the user equipment or the device category is subscribed for packet switched services only but is performing the location update to obtain voice service; or the user equipment or the device category has exceeded the data usage limit.

16. The method of claim 9 , wherein the suspicious event comprises at least one event of the following: the tracking update occurs from a location outside an area allowed for the user equipment or from a certain device category; the user equipment or the device category accesses the network outside an allowed time interval or at a forbidden time interval; the user equipment or the device category is subscribed for packet switched services only but is performing the location update to obtain voice service; or the user equipment or the device category has exceeded the data usage limit.

17. The method of claim 12 , wherein the suspicious event comprises at least one event of the following: the tracking update occurs from a location outside an area allowed for the user equipment or from a certain device category; the user equipment or the device category accesses the network outside an allowed time interval or at a forbidden time interval; the user equipment or the device category is subscribed for packet switched services only but is performing the location update to obtain voice service; or the user equipment or the device category has exceeded the data usage limit.