WO2016209262A1

WO2016209262A1 - Authentication requests

Info

Publication number: WO2016209262A1
Application number: PCT/US2015/037978
Authority: WO
Inventors: Mayank BAJPAI
Original assignee: Hewlett Packard Enterprise Development Lp
Priority date: 2015-06-26
Filing date: 2015-06-26
Publication date: 2016-12-29

Abstract

Examples disclosed herein relate, among other things, to a method. In some aspects, the method may include receiving, by a computing device associated with a network, an authentication request from an electronic device associated with a subscriber; based on the authentication request, determining whether the subscriber is associated with an active account associated with the network; and based on a determination that the subscriber is not associated with an active account associated with the network, sending to the electronic device a message including an instruction to modify a memory coupled to the electronic device.

Description

AUTHENTICATION REQUESTS

BACKGROUND

[0001] Miilions of electronic devices today can be wire!essly connected to various networks such as mobile networks, satellite networks, etc. Such electronic devices may include mobile phones, tablets, tracking devices, and so on. In order for an electronic device to connect to a given network, the electronic device or its user (hereinafter, "subscriber") may need to be registered on the network or on one of its partner networks.

BRIEF DESCRIPTION OF THE DRAWINGS

[0002] The following detailed description references the drawings, wherein:

[0003] FIG. 1 is a block diagram of an example electronic device communicatively coupled to an example network;

[0004] FIG. 2 is another block diagram of an example electronic device communicatively coupled to an example network;

[0005] FIG. 3 is yet another block diagram of an example electronic device communicatively coupled to an example network;

[0006] FIG. 4 is a flowchart illustrating an example method for deactivating an electronic device; and

[0007] FIG. 5 is another flowchart illustrating an example method for deactivating an electronic device.

DETAILED DESCRIPTION

[0008] As discussed above, in order to connect to a network, an electronic device or its user (also referred to herein as "subscriber") may need to be registered on the network. For example, the subscriber may need to have an active account associated with the network. Accordingly, if an account of a particular subscriber is deactivated and the user is no longer registered on the network (e.g., if the subscriber switched to another network provider, stopped paying subscription fees, etc.) the subscriber may no longer be able to connect his or her electronic device to the network. When such electronic device attempts to connect to the network, it may receive a message or a signal indicating that the connection to the network has failed. Some electronic devices, however, may be configured to periodically attempt to connect to the network until a successful connection is established. And while some subscribers after being unsubscribed from the network may power off their devices, turn off the communication modules on the devices, reprogram their devices to connect to another network, or otherwise cause the device to stop making attempts to connect to the network, some subscribers may not do so.

[0009] For example, an electronic device may be a tracking device attached by a trucking company to one of its trucks in order to track its movements. The trucking company may pay to a network provider (either directly or through a third party such as the provider of the tracking device and the tracking services associated therewith) for an ongoing subscription. If and when the company decides to stop the service, the network provider may unsubscribe the tracking device from the network, but the company may forget or intentionally decide not to return, deactivate (e.g., power off), or reprogram the tracking device to connect to another network, for example, if the device is attached underneath a truck at a place that is difficult to reach. In these cases, the device may remain powered up, and as discussed above, it may continuously and unsuccessfully try to connect (or "attach") to the network. As the number of such devices is growing exponentially, the numerous unsuccessful authentication attempts may cause a significant burden on the network, affecting its cost and/or performance.

[0010] Examples disclosed herein relate, among other things, to an electronic device that includes a memory storing a prohibited networks list, and a communication module. The communication module may determine a network to which to connect the electronic device, and responsive to a determination that the network is not listed in the prohibited networks list, send an authentication request to the network. The communication module may then receive a deactivation message from the network, and responsive to receiving the deactivation message, add the network to the prohibited networks list. As a result, the electronic device may stop making further attempts to connect to the network, thereby reducing the burden on the network's authentication module and otherwise improving the network's performance.

[0011] FIG. 1 is a block diagram showing an example network 100. Network 100 may be, for example, a public land mobile network (PLMN) based on digital cellular radio technology. For purposes of illustration, FIG. 1 shows network 100 that is a Global System for Mobile Communications (GSM) network. As illustrated in FIG. 1 , network 100 may include a network and switching subsystem (NSS) 10 which connects with a plurality of base station subsystems (BSS) 1 1 that provide radio communication with electronic devices 12 (only one of which is shown in FIG. 1 ). NSS 10 also communicates with a fixed public network 13 that may include a public switched telephone network (PSTN) and integrated digital services network (ISDN). Indeed the network can be thought of as an access path to the PSTN/ISDN, though calls may also be wholly contained within the PLMN.

[0012] Each BSS 11 may include a base station controller (BSC) 17 and a plurality of base transceiver stations (BTS) 18 controlled by BSC 17. Each BTS 18 may include radio transmitters and receivers for providing radio coverage of a local area known as a 'cell'.

[0013] Signals and user data (e.g., digital voice data and other digital data such as computer data) may be transferred between each electronic device 12 and BTS 18 of the ceil in which electronic device 12 is located. As electronic device 12 moves from one ceil to another, control of handover of communication with electronic device 12 from BTS 18 of the old cell to BTS 18 of the new cell may be effected by BSC 17.

[0014] The radio/air interface between electronic device 12 and BTS 18 may be implemented in accordance with a communication standard, such as GSM, CDMA, etc. Similarly, the interface between each BTS 18 and its associated BSC 17 may also be implemented in accordance to a standard. For example, in a GSM network, the interface between each BTS 18 and its associated BSC 17 may be referred to as an "Abis" interface. Each BSS 11 may communicate with a mobile switching center (MSC) 20 of the NSS 10, where each MSC 20 may be in communication with several BSS 11. In a GSM network, the interface between a BSS and an MSC is may be known as the "A"' interface. In a GSM network, user data and signals may be multiplexed across the radio interface, the Abis interface and the A interface, while within the NSS, user data and signals may be handled separately. This is shown in FIG. 1 by depicting user-data paths in solid lines, signal paths in dotted lines, and paths used for both user data and signals with solid lines with superimposed white dots.

[0015] Within NSS 10, the user data may be handled by MSCs 20, and for a given call the user data may traverse, for example, two MSCs 20. Although in FIG. 1 MSCs 20 are shown as directly connected by a solid line, it is appreciated that while a direct connection may be used when justified by traffic levels, MSCs 20 may also be connected through the intermediary of fixed public network 13.

[0016] In addition to MSCs 20, user data may also be handled in NSS 10 by a gateway MSC (GMSC) 21. GMSC 21 may handle calls set up in either direction between electronic devices 12 and outside of the network. Thus, for a call from outside of network 100 to electronic device 12, GMSC 21 may determine where the call should be routed to reach electronic device 12. In some examples, some or all functionality of GMSC 21 may be provided at MSCs 20.

[0017] Components of NSS 10 may communicate with each other, with MSCs 20 and GMSC 21 , and with the fixed public network through signaling links using a signaling system such as the system described in the CCITT Signaling System No.7 (SS7) standard. For example, a Mobile Application Part (MAP) protocol may be used for non-circuit-related signaling traffic, and a Telephone User Part (TUP) and ISDN User Part (ISUP) protocols may be used for circuit-related signaling traffic.

[0018] NSS 10 may also include a Home Location Register (HLR) 23, a Visitor Location Register (VLR) 24, an Authentication Register (AuC) 25, an Equipment Identify Register (EIR) 26, and an SMS Gateway 27. HLR 23 may store information about subscribers registered with network 100, such as the services available to a particular subscriber, the network address of the MSC 20 with which the subscriber is currently located, etc. In some examples, each MSC 20 may have its own associated VLR that stores, for example, subscriber data about users currently visiting the area covered by the MSG 20 and data about the current location of each user within the coverage area of the MSC 20. AuC 25 may be associated with HLR 23 and store data that may be used for subscriber identification and encryption of calls. Equipment Identify Register (EIR) 26 may store information about the electronic devices 12 themselves. SMS Gateway 27 may be used to receive and transmit short message service (SMS) messages from and to electronic devices 12.

[0019] Electronic device 12 may be any type of an electronic device or a number of electronic devices capable of communicating with network 100 and/or with other electronic devices 12 through network 100. For example, electronic device 12 may be a mobile device (e.g., a cellular phone), a tracking device (e.g., a tracking device attached to a moving object such as an automobile), a tablet, a laptop, an e-book reader, a wearable electronic device (e.g., smart watch or other smart computing apparel), a camera, a gaming device, an application-specific electronic device or any other type of processing device or equipment including a processor and capable of communicating with network 100. In some examples, electronic device 12 may include or be coupled to a global positioning system (GPS) unit enabling electronic device to determine and report its current geographic location. As will be discussed in detail below, in some examples, electronic device 12 may include, among other things, a memory 130 and a communication module 140, discussed in more detail below.

[0020] While in some examples discussed herein and illustrated in FIG. 1 , network 100 is described as a GSM network, it is appreciated that in other examples network 100 may also be a code division multiple access (CDMA) network, or any other type of wireless network, including mobile (e.g., cellular) networks, satellite networks, Wi-Fi, etc. In some examples, some or all of the components or modules of network 100 (e.g., MSC 20, HLR 23, VLR 24, AuC 25, SMS Gateway 27, etc.) may be implemented as computing devices, where a "computing device" may be a server, a desktop computer, a laptop, a mobile phone, an application-specific computing device, or as any other processing device or equipment, or a combination thereof. [0021] FIG. 2 shows another example in which electronic device 12 is communicatively (e.g., wirelessly) coupled to network 100. In the example of FIG. 2, network 100 includes a computing device which may generally represent any number of computing devices of network 100. For example, if network 100 is a GSM network as illustrated in FIG. 1 , computing device may include any combination of HLR 23, VLR 24, AuC 25, SMS Gateway 27, and/or other computing devices of network 100. Computing device 170 may include an authentication engine 180, which may include any combination of hardware and programming capable of performing the functionality discussed below.

[0022] Electronic device 12 may include memory 130 and communication module 140, as mentioned above. Memory 130 may include any type of non- transitory memory that may include any combination of volatile and non-volatiie memory. For example, memory 130 may include any combination of random- access memories (RAMs), read-only memories (ROMs), flash memories, hard drives, memristor-based memories, and the like.

[0023] In some examples, as illustrated in FIG. 3, electronic device 12 may include or be coupled to a subscriber identification module (SIM) card 150, and memory 130 may be a part of SIM card 150. In some examples, SIM card 150 may be associated with a subscriber. Accordingly, electronic device 12 may be associated with the subscriber that is associated with SIM card 150 coupled to electronic device 12. Thus, if a SIM card 150 associated with a first subscriber is replaced, and another SIM card 150 associated with a second subscriber is coupled to electronic device 12, electronic device 12 may be disassociated from the first subscriber and associated with the second subscriber instead.

[0024] In some examples, memory 130 may store a number of network identifiers. Each network identifier may be, for example, a mobile network code (MNC) uniquely identifying a mobile network. Memory 130 may store, for example, a home network identifier, that is, a network identifier of a home network to which electronic device 12 may automatically try to connect to first, by default. Memory 130 may also store a number of network identifiers of preferred networks to which electronic device 12 may try to connect if electronic device 12 could not successfully connect to the home network.

[0025] Memory 130 may also store a prohibited networks list that may include a number of network identifiers of networks to which electronic device 12 should not try to connect automatically. For example, if network 100 is a GSM network and electronic device 12 is compliant with the GSM standard, the prohibited networks list may be a forbidden public landline mobile networks (FPLMN) list 134 stored in an elementary file 132 that is stored on SIM card 150. At any given point, the prohibited networks list may contain no network identifiers, one network identifier, or a number of network identifiers. In some examples, the list may be automatically cleared when electronic device 12 is powered down or restarted. In some examples, elementary file 132 may also store the network identifiers of preferred networks.

[0026] Communication module 140 may include any combination of hardware and programming for implementing the functionality discussed below. In some examples, communication module 140 may, either periodically (e.g., once a minute) or responsive to a subscriber's action, attempt to connect to network 100. Communication module 140 may then determine to which network 100, from a plurality of networks 100, to connect. For example, communication module 140 may first attempt to connect to the home network identified by the home network identifier. If a connection to the home network is unsuccessful, communication module 140 may try to connect to the first preferred network. If this attempt is also unsuccessful, communication module 140 may try to connect to the second preferred network, and so on.

[0027] In some examples, before attempting to connect to a particular network 100 (e.g., a home network or a preferred network), communication module 140 may determine whether the network is included in a prohibited networks list, e.g., by determining whether the network's network identifier is included in FPLMN list 134. In some examples, communication module 140 may attempt to connect to a network if and only if it is not a prohibited network, e.g., if and only if the network's identifier is not included in FPLMN list 134. [0028] After determining a network 100 to which to connect, communication module 140 may attempt to connect to computing device 170 associated with that network 100. Specifically, in some examples, communication module 140 may communicate with authentication engine 180 of computing device 170. For example, communication module 140 may send to authentication engine 180 an authentication request that may include identification information identifying the subscriber associated with electronic device 12, such as the subscriber associated with SIM card 150 coupled to electronic device 12. In some examples, e.g., if network 100 is a GSM network, the authentication request may be a MAP_SEND_AUTHENTICATION_INFO message that includes an International Mobile Subscriber Identity (IMSI) value identifying the subscriber.

[0029] Authentication engine 180 may receive the authentication request and the identification information identifying the subscriber, and determine whether the subscriber is an active subscriber registered on or otherwise associated with the network. For example, engine 180 may query a database (e.g., a database of HLR 23) to determine whether it stores an account associated with the subscriber, and whether that account is active and has not been inactivated, suspended, etc. In some examples, if engine 180 determines that the subscriber is not an active subscriber, engine 180 may further determine whether the subscriber has made more than a predefined number (e.g., 10) of unsuccessful authentication requests. In some examples, engine 180 may further determine whether the unsuccessful authentication requests were received within a predefined period of time (e.g., 24 hours) and/or at substantially equal time intervals.

[0030] Based on a determination that the subscriber is not an active subscriber, and in some examples also based on the number and/or the timing of unsuccessful authentication requests received from the same subscriber, authentication engine

180 or another module of computing device 170 may "deactivate" electronic device

12 and cause electronic device 12 to stop sending additional authentication requests to network. In some examples, in order to deactivate electronic device 12, engine 180 may temporarily register the subscriber associated with electronic device 12 on network 100 in order to temporarily allow communications (e.g., exchange of SMS messages) with electronic device 12. In some examples, in order to temporarily register the subscriber on network 100, engine 180 may create a temporary account or profile for the subscriber associated with electronic device 12. Alternatively or in addition to creating a temporary account or profile, engine 180 may send to electronic device an authentication response that indicates to electronic device 12 that the authentication has been successful, i.e., that electronic device 12 has successfully connected ("attached") to network 100 and is authorized to receive messages from network 100. Depending on the authentication protocol associated with the type of network 100, the authentication response may include a single communication from network 100, or a series of communications exchanged between network 100 and electronic device 12.

[0031] After temporarily registering electronic device on network 100, engine 180 may send to electronic device 12 a deactivation message. The deactivation message may be any type of message that can cause electronic device 12 to stop sending additional authentication requests to computing device 170 of network 100. For example, if network 100 is a GSM network, the deactivation message may be a message that can cause electronic device 12 to add network 100 to a prohibited networks list, such as FPLMN list 134.

[0032] In some examples, the deactivation message may be an SMS message that contains an instruction to update the elementary file. The SMS message may have a protocol identifier field set to "SIM data download" and a data coding scheme field set to "class 2 message", as defined in the GSM 11.11 [14] specification. In some examples, if "data download via SMS point-to-point" type of service is allocated and activated in a SIM Service Table stored on SIM card 150, upon receiving this SMS message, electronic device 12 may pass the SMS message to SIM card 150 using the ENVELOPE (SMS-PP DOWNLOAD) command as defined in the GSM 11.11 [14] specification. In some examples, electronic device 12 may not display such SMS message to the user or otherwise alert the user about the SMS message.

[0033] In some examples, the SMS message may include an Application Protocol Data Unit (APDU) command such as the "UPDATE BINARY" or the "UPDATE RECORD" command, as defined in ETSI GSM 11.11. The command may include the network code associated with network 10, and SIM card 150 may update its elementary file 132 to include the network code in FPLMN list 134. As discussed above, when the network code is included in FPLMN list 134, electronic device 12 may not access (e.g., send authentication requests or other types of communications to) network 100 associated with the network code, even if the network is defined as the home network or as one of the preferred networks of electronic device 12. For example, in the example illustrated in FIG. 3, FPLMN list 134 includes two network identifiers represented by "MNC-A" and "MNC-B." In this example, electronic device 12 may not send authentication requests to networks 100 identified by any of the two network identifiers.

[0034] After sending the deactivation message, authentication engine 180 may unregister the subscriber associated with electronic device 2 from the network, for example, by inactivating (e.g., deleting) the temporary profile or account created for the subscriber.

[0035] In foregoing discussion, communication module 140 and authentication engine 180 were described as any combinations of hardware and programming. Such components may be implemented in a number of fashions. The programming may be processor executable instructions stored on a tangible, non- transitory computer readable medium and the hardware may include a processing resource for executing those instructions. The processing resource, for example, may include one or multiple processors (e.g., central processing units (CPUs), semiconductor-based microprocessors, graphics processing units (GPUs), field- programmable gate arrays (FPGAs) configured to retrieve and execute instructions, or other electronic circuitry), which may be integrated in a single device or distributed across devices. The computer readable medium can be said to store program instructions that when executed by the processor resource implement the functionality of the respective component. The computer readable medium may be integrated in the same device as the processor resource or it may be separate but accessible to that device and the processor resource. In one example, the program instructions can be part of an installation package that when installed can be executed by the processor resource to implement the corresponding component. In this case, the computer readable medium may be a portable medium such as a CD, DVD, or flash drive or a memory maintained by a server from which the installation package can be downloaded and installed, in another example, the program instructions may be part of an application or applications already installed, and the computer readable medium may include integrated memory such as a hard drive, solid state drive, or the like.

[0036] FIG. 4 is a flowchart of an example method 400 for deactivating an electronic device. Method 400 may be described below as being executed or performed by at least one computing device, such as computing device 170. Method 400 may be implemented in the form of executable instructions stored on at least one non-transitory machine-readable storage medium of the computing device and executed by at least one processor of the computing device. The non-transitory machine-readable storage medium may be any electronic, magnetic, optical, or other physical storage device that stores executable instructions. For example, the medium may be a Random Access Memory (RAM), an Electrically-Erasable Programmable Read-Only Memory (EEPROM), a storage drive, an optical disc, and the like. The medium may be disposed within computing device 170 or it may be a portable, external or remote storage medium, for example, that allows computing device 170 to download the instructions from the portabie/external/remote storage medium.

[0037] Alternatively or in addition, method 400 may be implemented in the form of electronic circuitry (e.g., hardware). In alternate examples of the present disclosure, at least one block of method 400 may be executed substantially concurrently or in a different order than shown in FIG. 4. In alternate examples of the present disclosure, method 400 may include more or fewer blocks than are shown in FIG.4. In some examples, at least one block of method 400 may, at certain times, be ongoing and/or may repeat.

[0038] At block 405, method 400 may receive, by a computing device (e.g., 170) associated with a network (e.g., 100), an authentication request from an electronic device (e.g., 12) associated with a subscriber. At block 410, method 400 may determine, based on the authentication request, whether the subscriber is associated with an active account associated with the network. At block 415, method 400 may, based on a determination that the subscriber is not associated with an active account associated with the network, send to the electronic device a message comprising an instruction to modify a memory (e.g., 130) coupled to the electronic device. As discussed above, in some examples, instead of or in addition to determining that the subscriber is not associated with an active, the method may send the message based on a determination that a plurality of unsuccessful authentication requests have been received from the electronic device. In some examples, the instruction included in the message may include a command to add a network identifier associated with the network to a prohibited networks list (e.g., FPLMN list 134) stored in the memory (e.g., memory 130 of SIM card 150). As also discussed above, in some examples, the method may create an active account for the subscriber before sending the message, and deactivate the active account after sending the message. In some examples, before sending the message the method may also send to the electronic device an authentication response indicating that the authentication was successful and that the device has been connected to the network.

[0039] FIG. 5 is a flowchart of an example method 500 for deactivating an electronic device (e.g., electronic device 12) coupled to a memory (e.g., memory 130) storing a prohibited networks list (e.g., FPLMN list 134). Method 500 may be described below as being executed or performed by at least one electronic device, such as electronic device 12. Method 500 may be implemented in the form of executable instructions stored on at least one non-transitory machine-readable storage medium of the electronic device and executed by at least one processor of the electronic device. The non-transitory machine-readable storage medium may be any electronic, magnetic, optical, or other physical storage device that stores executable instructions. Alternatively or in addition, method 500 may be implemented in the form of electronic circuitry (e.g., hardware). In alternate examples of the present disclosure, at least one block of method 500 may be executed substantially concurrently or in a different order than shown in FIG. 5. In alternate examples of the present disclosure, method 500 may include more or fewer blocks than are shown in FIG. 5. In some examples, at least one block of method 500 may, at certain times, be ongoing and/or may repeat. [0040] At block 505, method 500 may determine a network (e.g., 100) to which to connect the electronic device (e.g., 12). At block 510, the method may, responsive to a determination that the network is not Iisted in the prohibited networks list (e.g., 134), send an authentication request to the network. As discussed above, in some examples, the electronic device (e.g., the SIM card coupled thereto) may not be associated with active account associated with the network when the authentication request is sent to the network. Accordingly, at block 515, the method may receive a deactivation message (e.g., an SMS) from the network. At block 520, the method may, responsive to receiving the deactivation message, add the network to the prohibited networks list. As discussed above, this may inciude adding a network identifier associated with the network to the list. After the network is added to the list, the next time the electronic device would like to connect to the network, it may check the list, determine that the network is iisted on the list, and therefore refrain from sending any communications, including authentication requests, to the network.

Claims

CLAIMS What is ciaimed is:

1. A computing device associated with a network, the computing device comprising an authentication engine to:

receive an authentication request from an electronic device associated with a subscriber;

determine whether the subscriber is registered on the network; and based on a determination that the subscriber is not registered on the network:

register the subscriber on the network, send to the electronic device a deactivation message after registering the subscriber on the network, and

unregister the subscriber from the network after sending the deactivation message.

2. The computing device of claim 1 , wherein the deactivation message comprises an instruction to cause the electronic device to stop sending authentication requests to the computing device.

3. The computing device of claim 1 , wherein the deactivation message comprises an instruction to add the network to a prohibited networks list stored on the electronic device.

4. The computing device of claim 3, wherein the prohibited networks list is stored on a subscriber identification module (SIM) card coupled to the electronic device, and wherein the deactivation message comprises a short message service (SMS) message comprising the instruction.

5. The computing device of claim 3, wherein the electronic device comprises a tracking device equipped with a global positioning system (GPS) module.

6. A method comprising:

receiving, by a computing device associated with a network, an authentication request from an electronic device associated with a subscriber; based on the authentication request, determining whether the subscriber is associated with an active account associated with the network;

based on a determination that the subscriber is not associated with an active account associated with the network, sending to the electronic device a message comprising an instruction to modify a memory coupled to the electronic device.

7. The method of claim 6, wherein the instruction comprises a command to add a network identifier associated with the network to a prohibited networks list stored in the memory.

8. The method of claim 6, wherein sending the message is also based on a determination that a plurality of unsuccessful authentication requests have been received from the electronic device.

9. The method of claim 6, further comprising:

based on a determination that the subscriber is not associated with an active account associated with the network, creating an active account for the subscriber; and

after sending the message, inactivating the active account.

10. The method of claim 6, further comprising:

before sending the message, sending to the electronic device an authentication response indicating successful authentication.

11. A method of deactivating an electronic device comprising a memory storing a prohibited networks list, the method comprising:

determining a network to which to connect the electronic device; responsive to a determination that the network is not listed in the prohibited networks list, sending an authentication request to the network,

receiving a deactivation message from the network, and

responsive to receiving the deactivation message, adding the network to the prohibited networks list.

12. The method of claim 11 , wherein the deactivation message comprises a short message service (SMS) message.

13. The method of claim 11 , wherein the electronic device is coupled to a subscriber identification module (SIM) card comprising the memory, and wherein the prohibited networks list is stored in an elementary file on the SIM card.

14. The method of claim 13, wherein the SIM card is not associated with an active account associated with the network when the authentication request is sent.

15. The method of claim 11 , wherein the prohibited networks list comprises a set of network identifiers associated with a set of networks to which the electronic device should not connect.