Automated suspect device filtering on equipment identity registers
Embodiments of the present disclosure are directed to systems and methods for improving wireless network services by carrying out various procedures to identify and filter suspect user devices. A network function may monitor a plurality of network service requests from a particular user device and determine, based on the plurality of network services requests, that the requesting user device is engaged in suspicious activity. Upon such a determination, the network function may initiate one or more enforcement actions by communicating an instruction to an equipment identity register to add the requesting user device to a suspect device list stored on a unified data repository.
1 . A method for suspect device filtering in a wireless communication network, the method comprising:
communicating, by an access network, a plurality of connection failure messages to a user device in response to receiving a plurality of requests for a network service from the user device, wherein the user device is associated with a permanent device identifier;
determining, by a first network function of a core network, and based at least in part on the plurality of connection failure messages communicated to the user device during a first predetermined time, that the user device is suspect, wherein the first network function is associated with the provision of the requested network service;
adding the user device to a suspect device list maintained on the first network function based on the determination that the user device is suspect;
receiving, at the radio access network, a subsequent request for the network service from the user device;
communicating the subsequent request for the network service from the radio access network to the first network function;
determining by the first network function, based on a query of a locally stored second suspect device list, that the user device is blacklisted;
communicating an access denial for the network service from the first network function to the user device, via the radio access network; and
ignoring subsequent requests from the user device for the network service after the access denial is communicated,
wherein determining that the user device is suspect comprises the network function determining that a number of the plurality of connection failure messages communicated to the user device within a predetermined time period exceeds a predetermined threshold, and
wherein the suspect device list is a first-level suspect device list that limits access to one or more network services for the user device, and wherein the method further comprises, in response to receiving one or more additional requests from the user device after the user device is added to the first-level suspect device list, adding the user device to a higher-level suspect device list that prevents the user device from accessing the one or more network services.
2 . The method of claim 1 , wherein the predetermined threshold is a modifiably configurable parameter.
3 . The method of claim 2 , wherein the predetermined time period is a modifiably configurable parameter.
4 . The method of claim 1 , wherein the permanent device identifier comprises an international mobile station equipment identity (IMEI).
5 . The method of claim 1 , wherein the network function comprises an access mobility function, call session control function, or internet protocol multimedia system media gateway.
6 . The method of claim 1 , wherein determining that the user device is suspect further comprises the network function determining that a greater than threshold amount of temporary identity failures have occurred within a predetermined time period.
7 . The method of claim 1 , wherein the access denial is communicated to the user device without a subsequent query to the second network function.
8 . A method for suspect device filtering in a wireless communication network, the method comprising:
determining that a triggering event has occurred in a geographic area, the triggering event comprising a threshold high utilization of one or more radio access network nodes in the geographic area;
subsequent to said determination, receiving, at a radio access network, a plurality of requests for a network service from a user device, wherein the user device is associated with a permanent device identifier;
communicating the plurality of requests for the network service to a network function, wherein the network function is associated with the provision of the requested network service;
determining, by the network function, and based at least in part on the receipt of the plurality of requests for the network service from the user device during a first predetermined time period and that the user device is located in the geographic area, that the user device is suspect;
adding the user device to a suspect device list, wherein the suspect device list is stored on a data repository; and
ignoring subsequent requests from the user device for the network service after the access denial is communicated.
9 . A method for suspect device filtering in a wireless communication network, the method comprising:
receiving, at a networked computer processing component, a plurality of requests for a network service from a device attempting to access one or more internet resources, wherein the device is associated with a permanent device identifier, and wherein the networked computer processing component is associated with a provider of internet service;
determining, by the networked computer processing component, and based at least in part on the receipt of the plurality of requests from the device during a first predetermined time period, that the device is suspect;
adding the device to a locally stored suspect device list maintained on the networked computer processing component;
receiving a subsequent request from the device at the networked computer processing component;
determining, based on a query of the locally stored suspect device list, that the device is blacklisted;
communicating an access denial from the networked computer processing component to the device; and
ignoring subsequent requests from the user device for the network service after the access denial is communicated,
wherein determining that the device is suspect comprises the networked computer processing component determining that a number of the plurality of requests that have been received by the networked computer processing component within a predetermined time period exceed a predetermined threshold,
wherein the locally stored suspect device list is a first-level suspect device list that limits access to one or more network services for the device, and wherein the method further comprises, in response to receiving one or more additional requests from the device after the device is added to the first-level suspect device list, adding the device to a higher-level suspect device list that prevents the device from accessing the one or more network services list, adding the device to a higher-level suspect device list that prevents the device from accessing the one or more network services.
10 . The method of claim 9 , wherein the predetermined threshold is a modifiably configurable parameter.
11 . The method of claim 10 , wherein the predetermined time period is a modifiably configurable parameter.
12 . The method of claim 9 , wherein the permanent device identifier comprises an international mobile station equipment identity (IMEI).
13 . The method of claim 9 , wherein the networked computer processing component comprises an access mobility function, call session control function, or internet protocol multimedia system media gateway.
14 . The method of claim 9 , wherein determining that the user device is suspect further comprises the networked computer processing component determining that a greater than threshold amount of temporary identity failures have occurred within a predetermined time period.
15 . The method of claim 9 , further comprising communicating, based on the determination that the user device is suspect, an indication from the networked computer processing component to a second network function of the core network that causes the user device to be added to a second suspect device list maintained on the second network function, the second network function being one or more of a unified data repository and an equipment identity register, wherein the second network function is remote from the first network function.
16 . The method of claim 15 , further comprising associating the user device with the suspect device list in response to an acknowledgement from the second network function.
17 . The method of claim 16 , wherein the access denial is communicated to the user device without a subsequent query to the second network function.
18 . The method of claim 9 , wherein the method further comprises determining that a triggering event has occurred in a geographic area, the triggering event comprising one or more of a threshold high utilization of one or more radio access network nodes, a threshold high decrease in traffic capacity of one or more radio access network nodes, or a threshold large degradation of one or more key performance areas associated with providing wireless telecommunication service to the geographic area.