MOBILE NUMBER DEVICE HISTORY USED AS A RISK INDICATOR IN MOBILE NETWORK-BASED AUTHENTICATION
The device history of a mobile telephone number, or “mobile number,” is tracked to facilitate detection of risk indicators associated with the mobile number by an application server or other authentication entity. When access to a secure account is requested from a mobile device that is activated with the mobile number, certain risk indicators can be determined based on the tracked device history of the mobile number. A history is tracked of cellular devices that have been previously activated with a particular mobile number and when each such cellular device was activated with the mobile number. When a user performs an activity with a mobile device that requires authentication based on a mobile number of the mobile device, such as an online access, risk indicators associated with the mobile number can be detected and acted on accordingly.
1 . A computer-implemented method of authorizing a user activity based on a first mobile device on which a mobile number has been activated, the method comprising:
receiving a request from a computing device for authorized access to an application server;
determining a risk indicator for the mobile number based on a device history of the mobile number that includes an identifier for at least one mobile device that has been activated with the mobile number; and
upon determining that the risk indicator is below a threshold, allowing the computing device to access the application server.
2 . The computer-implemented method of claim 1 , wherein the application server comprises a restricted access computing device.
3 . The computer-implemented method of claim 2 , further comprising, based on the risk factor, enabling access via the computing device to a secure account associated with the restricted access computing device.
4 . The computer-implemented method of claim 1 , further comprising:
in response to receiving the request from the computing device, querying a mobile device identification server for the device history; and
receiving the device history from the mobile device identification server.
5 . The computer-implemented method of claim 1 , further comprising, in response to receiving the request from the computing device, determining the mobile number based on information included in the request from the computing device.
6 . The computer-implemented method of claim 1 , wherein the device history further includes a time at which the at least one mobile device was associated with the mobile number.
7 . The computer-implemented method of claim 1 , wherein the device history further includes an identifier for at least one subscriber identification module (SIM) that has been associated with the mobile number.
8 . The computer-implemented method of claim 7 , wherein the device history further includes a time at which the at least one subscriber module was associated with the mobile number.
9 . The computer-implemented method of claim 1 , wherein the first mobile device is being used to login to a secure account associated with the application server.
10 . The computer-implemented method of claim 1 , wherein the identifier for the at least one mobile device comprises an international mobile equipment identifier.
11 . The computer-implemented method of claim 1 , further comprising, upon determining that the risk indicator is above the threshold, preventing the computing device from accessing the application server.
12 . A restricted-access system of computing devices, comprising:
a first mobile device on which a mobile number has been activated; and
an application server, configured to:
receive a request from a computing device for authorized access to the application server;
determine a risk indicator for the mobile number based on a device history of the mobile number that includes an identifier for at least one mobile device that has been activated with the mobile number; and
upon determining that the risk indicator is below a threshold, allow the computing device to access the application server.
13 . The restricted-access system of computing devices of claim 12 , further comprising a mobile device identification server communicatively coupled to the application server and, and wherein the application server is configured to determine the risk factor for the mobile number by:
querying the mobile device identification server for the device history; and
receiving the device history from the mobile device identification server.
14 . The restricted-access system of computing devices of claim 13 , wherein the mobile device identification server is configured to:
in response to the query, determine an identifier for the first mobile device; and
update an entry in the device history with the identifier for the first mobile device.
15 . The restricted-access system of computing devices of claim 13 , wherein the mobile device identification server is configured to determine the identifier for the first mobile device by:
querying a cellular network provider associated with the mobile number; and
receiving the identifier for the first mobile device from the cellular network provider.
16 . The restricted-access system of computing devices of claim 12 , wherein the device history further includes a time at which the at least one mobile device was associated with the mobile number.
17 . The restricted-access system of computing devices of claim 1 , wherein the device history further includes an identifier for at least one subscriber identification module (SIM) that has been associated with the mobile number.
18 . The restricted-access system of computing devices of claim 12 , wherein the device history further includes a time at which the at least one subscriber module was associated with the mobile number.
19 . The restricted-access system of computing devices of claim 12 , wherein the computing device is being used to login to a secure account associated with the application server.
20 . The restricted-access system of computing devices of claim 12 , wherein the application server is further configured to, upon determining that the risk indicator is above the threshold, preventing the computing device from accessing the application server.