Systems and methods for detecting device location and usage

1. A system comprising:

a memory storing executable instructions; and

a processor in communication with the memory, wherein the processor when executing the executable instructions:

receives, from a device, a device certificate comprising a unique identifier;

based on an authorized deployment region for the device, generates stored data comprising at least one of an expected location for the device or an expected usage of the device;

associates the stored data with the device using the unique identifier extracted from the device certificate;

subsequently receives, from the device, a first message comprising first data, wherein the first data comprises the device certificate with the unique identifier and a first hash of device data that is indicative of at least one of a current device location or a current device usage, the device data comprising at least one of a current Session Initiation Protocol (SIP) domain of the device, a current time zone in which the device is located, data related to a current posture of the device, a configured language of the device, a dialing configuration of the device for emergency numbers, or a dial plan of the device;

using the unique identifier, retrieves the stored data associated with the device;

after receiving the first message, transmits, to the device, instructions to transmit a second message comprising second data that is different from the first data, wherein the second data comprises at least one of a hardware configuration of the device, a Domain Name System (DNS) domain name, a public Internet Protocol (IP) address of a DNS server, or a public IP address of a Network Time Protocol (NTP) server;

receives, from the device, the second message;

for the first message:

generates a second hash of one or more first corresponding portions of the stored data; and

compares the first and second hashes;

for the second message:

compares the second data to one or more second corresponding portions of the stored data; and

when at least one of (i) the first and second hashes do not match, or (ii) the second data and the one or more second corresponding portions of the stored data do not match, generates an alert.

2. The system of claim 1 , wherein:

the first hash of device data comprises a hash of the device data and a nonce; and

the first message further comprises the nonce, the second hash of stored data being generated by hashing the one or more first corresponding portions of the stored data and the nonce.

3. The system of claim 1 , wherein the second message comprises the public IP address of the DNS server or the NTP server to which the device is connected, and wherein the processor, when executing the executable instructions:

extracts the public IP address of the DNS server or the NTP server from the second message; and

compares the public IP address to an expected address, wherein the expected address is based on the authorized deployment region for the device.

4. The system of claim 1 , wherein the processor, when executing the executable instructions:

based on the unique identifier extracted from the device certificate provided by the device in the first message, determines an entity with which the device is associated.

5. The system of claim 1 , wherein the device data contained in the first message comprises customer-specific data and the second data contained in the second message comprises non-customer-specific data.

6. The system of claim 1 , wherein the first message comprises data related to the current posture of the device, and wherein the processor, when executing the executable instructions:

compares the current posture to an expected posture of the device.

7. A method comprising:

receiving, by a processor, from a device, a device certificate comprising a unique identifier;

based on an authorized deployment region for the device, generating, by the processor, stored data comprising at least one of an expected location for the device or an expected usage of the device;

associating, by the processor, the stored data with the device using the unique identifier extracted from the device certificate;

subsequently receiving, by the processor, from the device, a first message comprising first data, wherein the first data comprises the device certificate with the unique identifier and a first hash of device data that is indicative of at least one of a current device location or a current device usage, the device data comprising at least one of a current Session Initiation Protocol (SIP) domain of the device, a current time zone in which the device is located, data related to a current posture of the device, a configured language of the device, a dialing configuration of the device for emergency numbers, or a dial plan of the device;

using the unique identifier, retrieving, by the processor, the stored data associated with the device;

after receiving the first message, transmitting, by the processor, to the device, instructions to transmit a second message comprising second data that is different from the first data, wherein the second data comprises at least one of a hardware configuration of the device, a Domain Name System (DNS) domain name, a public Internet Protocol (IP) address of a DNS server, or a public IP address of a Network Time Protocol (NTP) server;

receiving, by the processor, from the device, the second message;

for the first message:

generating, by the processor, a second hash of one or more first corresponding portions of the stored data; and

comparing, by the processor, the first and second hashes;

for the second message:

comparing, by the processor, the second data to one or more second corresponding portions of the stored data; and

when at least one of (i) the first and second hashes do not match, or (ii) the second data and the one or more second corresponding portions of the stored data do not match, generating, by the processor, an alert.

8. The method of claim 7 , wherein:

the first hash of device data comprises a hash of the device data and a nonce, the nonce being generated by the device; and

the first message further comprises the nonce, the second hash of stored data being generated by hashing the one or more first corresponding portions of the stored data and the nonce.

9. The method of claim 7 , wherein the first message comprises data related to the current posture of the device and the second message comprises the public IP address of the DNS server or the NTP server to which the device is connected, the method further comprising:

extracting, by the processor, the public IP address of the DNS server or the NTP server from the second message; and

comparing, by the processor, the current posture to an expected posture and the public IP address to an expected address, wherein the expected address is based on the authorized deployment region for the device.

10. The method of claim 7 , further comprising:

based on the unique identifier extracted from the device certificate provided by the device in the first message, determining, by the processor, an entity with which the device is associated.

11. The method of claim 7 , wherein the device data contained in the first message comprises customer-specific data and the second data contained in the second message comprises non-customer-specific data.

12. A non-transitory computer-readable medium comprising instructions that when executed, cause a processor of a device to:

in response to detecting a boot-up of the device, automatically extract first device data indicative of at least one of a current device location or a current device usage, wherein the first device data comprises a first data type, the first device data comprising at least one of a current Session Initiation Protocol (SIP) domain of the device, a current time zone in which the device is located, data related to a current posture of the device, a configured language of the device, a dialing configuration of the device for emergency numbers, or a dial plan of the device;

generate a nonce;

create hashed first device data comprising a hash of the first device data and the nonce;

automatically transmit a first message comprising a device certificate, the nonce, and the hashed first device data to an external system via a public network;

after transmitting the first message, receiving, from the external system, a second message comprising instructions to send second device data, wherein the second device data comprises a second data type that is different from the first data type, the second device data comprising at least one of a hardware configuration of the device, a Domain Name System (DNS) domain name, a public Internet Protocol (IP) address of a DNS server, or a public IP address of a Network Time Protocol (NTP) server; and

transmitting, to the external system via the public network, a third message comprising the device certificate, a second nonce, and the second device data.

13. The non-transitory computer-readable medium of claim 12 , wherein the instructions when executed, cause the processor of the device to:

in response to determining that the device has been operating for a predetermined time without powering down, automatically extracting additional device data indicative of at least one of the current device location or the current device usage;

generate an additional nonce;

create additional hashed device data comprising an additional hash of the additional device data with the additional nonce; and

automatically transmit an additional message comprising the device certificate, the additional nonce, and the additional hashed device data to the external system via the public network.

14. The non-transitory computer-readable medium of claim 12 , wherein the first data type comprises customer-specific data and the second data type comprises non-customer-specific data.

15. A system comprising:

a memory storing executable instructions; and

a processor in communication with the memory, wherein the processor when executing the executable instructions:

receives, from a device, a first message comprising first data, wherein the first data comprises a first hash of device data that is indicative of at least one of a current device location or a current device usage, the device data comprising at least one of a current Session Initiation Protocol (SIP) domain of the device, a current time zone in which the device is located, data related to a current posture of the device, a configured language of the device, a dialing configuration of the device for emergency numbers, or a dial plan of the device;

retrieves stored data associated with the device, wherein the stored data is based on an authorized deployment region for the device, the authorized deployment region comprising at least one of (i) an authorized location associated with the device, or (ii) an authorized configuration and posture associated with the device;

after receiving the first message, transmits, to the device, instructions to transmit a second message comprising second data that is different from the first data, wherein the second data comprises at least one of a hardware configuration of the device, a Domain Name System (DNS) domain name, a public Internet Protocol (IP) address of a DNS server, or a public IP address of a Network Time Protocol (NTP) server;

receives, from the device, the second message;

for the first message:

generates a second hash of one or more first corresponding portions of the stored data; and

compares the first and second hashes;

for the second message:

compares the second data to one or more second corresponding portions of the stored data; and

when at least one of (i) the first and second hashes do not match, or (ii) the second data and the one or more second corresponding portions of the stored data do not match, generates an alert.

16. A system comprising:

a memory storing executable instructions; and

a processor in communication with the memory, wherein the processor when executing the executable instructions:

receives, from a device, a first message comprising a first hash of device data that is indicative of at least one of a current device location or a current device usage, wherein the device data comprises at least one of a current Session Initiation Protocol (SIP) domain of the device, a current time zone in which the device is located, data related to a current posture of the device, a configured language of the device, a dialing configuration of the device for emergency numbers, or a dial plan of the device;

after receiving the first message, transmits, to the device, instructions to transmit a second message comprising second data that is different from the first data, wherein the second data comprises at least one of a hardware configuration of the device, a Domain Name System (DNS) domain name, a public Internet Protocol (IP) address of a DNS server, or a public IP address of a Network Time Protocol (NTP) server;

receives, from the device, the second message;

for the first message:

generates a second hash of one or more first corresponding portions of stored data, the stored data being based on at least one of an expected location or an expected usage associated with the device; and

compares the first and second hashes;

for the second message:

compares the second data to one or more second corresponding portions of the stored data;

when at least one of (i) the first and second hashes do not match, or (ii) the second data and the one or more second corresponding portions of the stored data do not match, registers a mismatch;

determines a total number of mismatches for the device within a time period; and

generates an alert only when the total number of mismatches for the device is greater than a predetermined number.

17. A system for detecting grey market activities, the system comprising:

a memory storing executable instructions; and

a processor in communication with the memory, wherein the processor when executing the executable instructions:

receives, from a device, a first message comprising first data, wherein the first data comprises a first hash of device data that is indicative of at least one of a current device location or a current device usage, the device data comprising at least one of a current Session Initiation Protocol (SIP) domain of the device, a current time zone in which the device is located, data related to a current posture of the device, a configured language of the device, a dialing configuration of the device for emergency numbers, or a dial plan of the device;

after receiving the first message, transmits, to the device, instructions to transmit a second message comprising second data that is different from the first data, wherein the second data comprises at least one of a hardware configuration of the device, a Domain Name System (DNS) domain name, a public Internet Protocol (IP) address of a DNS server, or a public IP address of a Network Time Protocol (NTP) server;

receives, from the device, the second message;

for the first message:

generates a second hash of one or more first corresponding portions of stored data, the stored data being based on at least one of an authorized location for the device or an authorized usage associated with the device; and

compares the first and second hashes;

for the second message:

compares the second data to one or more second corresponding portions of the stored data; and

when at least one of (i) the first and second hashes do not match, or (ii) the second data and the one or more second corresponding portions of the stored data do not match, generates an alert indicating that the device is a potential grey market device with at least one of an unauthorized location or an unauthorized use.