FIELD OF THE INVENTION
The present invention pertains to the identification of potentia5 l
suspect communication devices following a given communication device.
BACKGROUND
Currently, security of some people, such as business-men, political
10 figures, company executives, media stars, demands a huge technology and
skill support. A mechanism that facilitates identifying non social elements that
may be continuously following or tracking potential targets, could be very
useful.
The only possibility in today’s scenario is to track an already known
15 potential threat that may cause harm to the potential targets. Mechanisms
exist, which may help to continuously track the activities and locations of
such potential threat elements.
There is a need to identify a set of definite non-social mobile points
that are following or trailing a specific mobile point.
20
SUMMARY
This summary is provided to introduce concepts related to the
present inventive subject matter. This summary is not intended to identify
essential features of the claimed subject matter nor is it intended for use in
25 determining or limiting the scope of the claimed subject matter.
In accordance with one embodiment, a method is provided for
identifying communication devices following a given communication device in
motion through a telecommunication network, comprising the following steps
performed by an application server:
30 receiving a first localization message from the given communication
device, the first localization message containing an identifier of a cell in which
said given communication device is attached,
2
determining a target localization area by means of the identifier of the
cell and identifying a switch controlling said target localization area,
sending a first message to the identified switch that starts a recording
of registering and unregistering of communication devices within the target
localization 5 n area,
receiving a second localization message from the given
communication device having moved from said cell to another cell,
sending a second message to the identified switch that stops the
recording of registering and unregistering of other communication devices
10 within the target localization area,
receiving a list of communication devices from the identified switch,
the list containing identifiers of communication devices having an active
registration duration above a given threshold
15 In an embodiment, the application server produces a final list of
suspect communication devices, once a given number of lists of suspect
communication devices has been received.
In an embodiment, the final list contains identifiers of communication
devices which have recurrent existence in at least a predefined number of
20 lists.
In an embodiment, the list contains the call numbers of the
communication devices
In an embodiment, the application server eliminates call numbers
from the list according to a predefined exclusion list.
25 In an embodiment, the second localization message contains at least
an identifier of the cell to which the given communication device is attached.
In an embodiment, the start message defines current target
localization area as a given cell or a set of cells.
In an embodiment, the application server identifies a switch of at
30 least another operator of a telecommunication network, sends the first and
second messages to said another switch and receives a list of
communication devices from the identified switch from said another switch.
3
Advantageously, the invention provides a unique approach to identify
such probable “potential threat elements” that are otherwise unknown and
unidentified. The method provides an approach to identify and extract mobile
data points (from among the huge mobile data points located in the vicinity of
the target communication device) which have maintained proximity with th5 e
target communication device over longer period of time.
The invention also pertains to a server for identifying communication
10 devices following a given communication device in motion through a
telecommunication network, comprising:
means for receiving a first localization message from the given
communication device, the first localization message containing an identifier
of a cell in which said given communication device is attached,
15 means for determining a target localization area by means of the
identifier of the cell and identifying a switch controlling said target localization
area,
means for sending a first message to the identified switch that starts
a recording of registering and unregistering of communication devices within
20 the target localization area,
means for receiving a second localization message from the given
communication device having moved from said cell to another cell,
means for sending a second message to the identified switch that
stops the recording of registering and unregistering of other communication
25 devices within the target localization area,
means for receiving a list of communication devices from the
identified switch, the list containing identifiers of communication devices
having an active registration duration above a given threshold.
30 The invention also pertains to a computer program capable of being
implemented within a server, said program comprising instructions which,
4
when the program is executed within said server, carry out steps according to
the method according to the invention.
The invention also pertains to a method for identifying
communication devices following a given communication device in moti5 on
through a telecommunication network, comprising the following steps
performed by a switch:
receiving a first message from an application server,
starting a recording of registering and unregistering of
10 communication devices within a target localization area controlled by the
switch,
receiving a second message from an application server,
stopping the recording of registering and unregistering of other
communication devices within the target localization area,
15 producing a list of communication devices from the identified switch,
the list containing identifiers of communication devices having an active
registration duration above a given threshold,
sending the list to the application server.
20 The invention also pertains to a switch for identifying communication
devices following a given communication device in motion through a
telecommunication network, said switch comprising at least one processing
means for:
receiving a first message from an application server,
25 starting a recording of registering and unregistering of
communication devices within a target localization area controlled by the
switch,
receiving a second message from an application server,
stopping the recording of registering and unregistering of other
30 communication devices within the target localization area,
5
producing a list of communication devices from the identified switch,
the list containing identifiers of communication devices having an active
registration duration above a given threshold,
sending the list to the application server.
5
BRIEF DESCRIPTION OF THE FIGURES
Some embodiments of the present invention are now described, by
way of example only, and with reference to the accompanying drawings. The
same reference number represents the same element or the same type of
10 element on all drawings.
FIG. 1 is a schematic block diagram of a communication system
according to one embodiment of the invention for identifying suspect
communication devices following a communication device.
FIG. 2 is a flow chart illustrating a method for identifying suspect
15 communication devices following a communication device according to one
embodiment of the invention.
The same reference number represents the same element or the
same type of element on all drawings.
20
DESCRIPTION OF EMBODIMENTS
The figures and the following description illustrate specific exemplary
embodiments of the invention. It will thus be appreciated that those skilled in
the art will be able to devise various arrangements that, although not
25 explicitly described or shown herein, embody the principles of the invention
and are included within the scope of the invention. Furthermore, any
examples described herein are intended to aid in understanding the
principles of the invention, and are to be construed as being without limitation
to such specifically recited examples and conditions. As a result, the
30 invention is not limited to the specific embodiments or examples described
below, but by the claims and their equivalents.
6
Referring to FIG. 1, a communication system comprises an
application server AS, a target communication device CDT and a set of
communication devices CD which are able to be connected to at least one
telecommunication network 5 ork TN.
For example, the telecommunication network TN is a digital cellular
radio communication network of the GSM (Global System for Mobile
communications) or UMTS (Universal Mobile Telecommunications System)
or even CDMA (Code Division Multiple Access) type or even LTE (Long Term
10 Evolution) type. The GSM type network may be coupled with a GPRS
(General Packet Radio Service) network for the transmission of data by
packets with mobility and access management via radio. For example, the
telecommunication network is able to authorize a communication device to
send and receive data via the network when the communication device is
15 identified at the network, for example by means of a subscriber identification
module associated with the communication device.
Figure 1 does not represent known main components of the
localization area of the telecommunication network where the communication
20 device is situated. For example in a GSM type network, the localization area
comprises a switch MSC (Mobile service Switching Center) which is
connected by means of a BSC (Base Station Controller) to a base station
BTS (Base Transceiver Station) connected by means of a radio link to the
communication device.
25 The communication device CD, CDT can establish a connection with
the telecommunication network TN through a respective radio access
network via a radio link with the base station. The radio access networks are
distributed over a geographical area typically divided into cells that are
served by a corresponding base station. Base stations communicate over an
30 air interface with the user equipment, with several base stations being
connected to a radio network controller (RNC) or base station controller
(BSC) that is connected to one or more core networks. In the typical
7
situation, secure communications for users of the system may be provided
through encryption and decryption at the base station.
In one embodiment wherein the telecommunication network TN is a
GSM type network, the telecommunication network 5 TN comprises a location
register HLR (Home Location Register) and one or more VLR (Visitor
Location Register) location registers connected to the switch MSC. The HLR
register is similar to a database containing an international identity IMSI
(International Mobile Subscriber Identity) associated with a subscription
10 profile for each user in the telecommunication network TN. The register VLR
is a relay of the register HLR and contains characteristics of the users
located in the location area to manage their mobility.
A communication device CD, CDT is capable of establishing a
15 communication within a telecommunication network TN, for example with
another communication device. For instance, a communication device CD is
a mobile telephone, a smartphone, or a tablet, an electronic
telecommunication device or object that is personal to the user.
The communication device CDT is a device used by a user wishing
20 to be monitored by the application server in order to identify communication
devices that have been located in the proximity of the communication device
CDT over at least a given period of time. In the remainder of the description,
such communication device is designated as target communication device,
as the given user of the target communication device is potentially a target of
25 at least another user following said given user.
The application server AS is a central node accessible via different
telecommunication networks and is able to communicate with the switches
MSC the different telecommunication networks. The application server AS is
30 also able to communicate with the target communication device CDT
requiring a monitoring service.
8
The application server continuously monitors the movement of the
target communication device CDT over a telecommunication network. The
target communication device CDT continuously reports its current
geographical information and any changes of geographical information to the
application server. For example, the geographical information reported by 5 the
target communication device CDT contains an identifier of the cell to which
the target communication device CDT is attached, and contains also
identifiers of the register VLR and the switch MSC corresponding to the cell.
It is assumed that the application server collaborates with at least the
10 operator of the target communication device CDT, and can also collaborate
with different operators.
The application server AS comprises a network interface NI and an
analysis module AM.
The network interface NI of the application server AS receives
15 messages from the target communication device CDT and exchanges
messages with switches MSC of the telecommunication network TN or other
telecommunication networks, via pre-established trusted links.
The analysis module AM of the application server AS uses the
current geographical information of the target communication device CDT to
20 determine a current target localization area and to derive a list of all switches
MSCs of the registered operators lying within the current target localization
area.
The analysis module AM communicates with the identified switches
MSCs and receives data related to communication devices located in the
25 current target localization area from the identified switches MSCs.
The analysis module AM produces cell report containing a list of
suspect communication devices for each current target localization area and
produces a final list of suspect communication devices in view of the different
cell reports.
30 With the final list, the application server can identify potential threats
that are in the proximity of or following the target communication device.
9
Eventually, if multiple target communication devices have required
the monitoring service, the application server can identify potential threats
that are common to these multiple target communication devices.
Furthermore, the application server may determine commonalities
and movement patterns of identified potential threa5 ts.
Optionally, the application server AS may define, per request of the
user of the target communication device, an exclusion list of communication
devices that are ignored in the monitoring service.
10 With reference to FIG. 2, a method for identifying suspect
communication devices following a communication device according to one
embodiment of the invention comprises steps S1 to S8 executed within the
communication system.
In an initial step S01, the user of the target communication device
15 CDT subscribes to a monitoring service offered by the application server AS.
The subscription may be done with an identifier of the target communication
device CDT such as the call number of the target communication device
CDT.
In step S1, the target communication device CDT triggers the
20 monitoring service offered by the application server AS by sending a
localization message MesL to the application server AS. The localization
message MesL contains geographical information related to the target
communication device CDT. The localization message MesL contains at
least an identifier of the cell to which the target communication device CDT is
25 attached.
In step S2, the analysis module AM of the application server AS uses
the current geographical information of the target communication device CDT
to determine a current target localization area Loc and to derive a list of all
switches MSCs of the registered operators controlling the current target
30 localization area.
To identify the appropriate switch MSC of another operator, the
application server can determine and use coordinates of the current target
10
localization area to apply a correlation with available parameters of switches
MSC of said another operator or to interrogate said another operator that
identifies itself the appropriate switch MSC.
In step S3, the network interface NI of the application server AS
sends a start message MesS to the switch MSC of the operator of the targ5 et
communication device and optionally to the switches MSC of different
operators to start tracking all the communication devices lying within or in the
proximity of the current target localization area.
The start message MesS may include specific location information to
10 define current target localization area as a given cell or a set of cells.
Each switch MSC having received the start message MesS starts the
recording of registering and de-registering of communication devices within
the current target localization area covered by the switch MSC.
15 In step S4, when the target communication device CDT changes
location and moves to a different cell, the target communication device CDT
reports its current geographical information to the application server again, by
sending another localization message MesL containing an identifier of the
cell to which the target communication device CDT is now attached.
20 In step S5, upon reception of a changed location indication, i.e. the
identifier of the current cell in the localization message MesL, the network
interface NI of the application server AS sends a stop message MesO to all
the switches MSC that were initially instructed to track the communication
devices under the current target localization area.
25 In step S6, each switch MSC having received the stop message
MesO evaluates its data sets related to the recorded registering and deregistering
of communication devices and applies a series of normalization
factors on these data sets. Normalization may include operations such as :
only keeping communication devices which had an active registration
30 duration above a predefined percentage of total active registration duration of
the target communication device CDT within the current target localization
area.
11
Another normalization may exclude all recorded data for
communication devices registered in cells whose distance from the target
communication device registered cell is above a given distance threshold.
Once normalization is done, each switch MSC produces a tracking
list Ls of suspect communication devices and sends the tracking 5 cking list to the
application server AS. For example, the tracking list contains the call
numbers MSISDN of the communication devices.
In step S7, the application server applies further normalization to the
10 tracking lists Ls of suspect communication devices to affine the report list and
eliminate some call numbers.
For example, the application server takes into account an exclusion
list containing call numbers that should not be present in the tracking list Ls.
These call numbers can be defined by the user of the target communication
15 device CDT at step S01 and can be call numbers of communication devices
of known relationships of the user.
Steps S2 to S7 are then repeated successively for each location
change of the target communication device CDT; and the application server
20 AS receives report lists from switches MSC each time the target
communication device changes cell location.
In step S8, the analysis module AM of the application server AS
produces a final list Lf of suspect communication devices, once a given
25 number of suspect list Ls has been received.
The application server AS produces the final list Lf in view of the
given number of suspect list Ls. The final list contains identifiers of suspect
communication devices which have recurrent existence in at least a
predefined number of suspect lists Ls.
30
The invention described here relates to a method and a server
identifying suspect communication devices following a communication
12
device. According to one implementation of the invention, steps of the
invention are determined by the instructions of a computer program
incorporated into a server, such as the application server. The program
comprises program instructions which, when said program is loaded and
executed within the server, carry out the steps of the method .
Consequently, the invention also applies to a computer program,
particularly a computer program on or within an information medium, suitable
to implement the invention. This program may use any programming
language, and be in the form of source code, object code, or intermediate
10 code between source code and object code, such as in a partially compiled
form, or in any other form desirable for implementing the method according to
the invention.

CLAIMS:1. A method for identifying communication devices (CD) following a given communication device (CDT) in motion through a telecommunication network (TN), comprising the following steps performed by an application server (AS):
receiving (S1) a first localization message (MesL) from the given communication device (CDT), the first localization message containing an identifier of a cell in which said given communication device is attached,
determining (S2) a target localization area (Loc) by means of the identifier of the cell and identifying a switch (MSC) controlling said target localization area (Loc),
sending (S3) a first message (MesS) to the identified switch (MSC) that starts a recording of registering and unregistering of communication devices within the target localization area (Loc),
receiving (S4) a second localization message (MesL) from the given communication device (CDT) having moved from said cell to another cell,
sending (S5) a second message (MesO) to the identified switch (MSC) that stops the recording of registering and unregistering of other communication devices within the target localization area (Loc),
receiving (S6) a list (Ls) of communication devices from the identified switch (MSC), the list (Ls) containing identifiers of communication devices having an active registration duration above a given threshold.

2. A method according to claim 1, wherein the application server produces a final list (Lf) of suspect communication devices, once a given number of lists (Ls) of suspect communication devices has been received.

3. A method according to claim 2, wherein the final list contains identifiers of communication devices which have recurrent existence in at least a predefined number of lists (Ls).

4. A method according to any of claims 1 to 3, wherein the list contains the call numbers of the communication devices.

5. A method according to claim 4, wherein the application server eliminates call numbers from the list according to a predefined exclusion list.

6. A method according to any of claims 1 to 5, wherein the second localization message (MesL) contains at least an identifier of the cell to which the given communication device (CDT) is attached.

7. A method according to any of claims 1 to 5, wherein the start message (MesS) defines current target localization area as a given cell or a set of cells.

8. A method according to any of claims 1 to 5, wherein the application server identifies a switch of at least another operator of a telecommunication network, sends the first and second messages to said another switch and receives a list of communication devices from the identified switch from said another switch.

9. An application server (AS) for identifying communication devices (CD) following a given communication device (CDT) in motion through a telecommunication network (TN), comprising:
means (NI) for receiving a first localization message (MesL) from the given communication device (CDT), the first localization message containing an identifier of a cell in which said given communication device is attached,
means (AM) for determining a target localization area (Loc) by means of the identifier of the cell and identifying a switch (MSC) controlling said target localization area (Loc),
means (AM) for sending a first message (MesS) to the identified switch (MSC) that starts a recording of registering and unregistering of communication devices within the target localization area (Loc),
means (NI) for receiving a second localization message (MesL) from the given communication device (CDT) having moved from said cell to another cell,
means (AM) for sending a second message (MesO) to the identified switch (MSC) that stops the recording of registering and unregistering of other communication devices within the target localization area (Loc),
means (NI) for receiving a list (Ls) of communication devices from the identified switch (MSC), the list containing identifiers of communication devices having an active registration duration above a given threshold.

10. A computer program capable of being implemented within an application server (AS) for identifying communication devices (CD) following a given communication device (CDT) in motion through a telecommunication network (TN), said program comprising instructions which, when the program is loaded and executed within said server (AS), carry out the following steps:
receiving (S1) a first localization message (MesL) from the given communication device (CDT), the first localization message containing an identifier of a cell in which said given communication device is attached,
determining (S2) a target localization area (Loc) by means of the identifier of the cell and identifying a switch (MSC) controlling said target localization area (Loc),
sending (S3) a first message (MesS) to the identified switch (MSC) that starts a recording of registering and unregistering of communication devices within the target localization area (Loc),
receiving (S4) a second localization message (MesL) from the given communication device (CDT) having moved from said cell to another cell,
sending (S5) a second message (MesO) to the identified switch (MSC) that stops the recording of registering and unregistering of other communication devices within the target localization area (Loc),
receiving (S6) a list (Ls) of communication devices from the identified switch (MSC), the list containing identifiers of communication devices having an active registration duration above a given threshold.

11. A method for identifying communication devices (CD) following a given communication device (CDT) in motion through a telecommunication network (TN), comprising the following steps performed by a switch (MSC):
receiving (S3) a first message (MesS) from an application server (AS),
starting (S3) a recording of registering and unregistering of communication devices within a target localization area (Loc) controlled by the switch (MSC),
receiving (S5) a second message (MesO) from an application server (AS),
stopping (S5) the recording of registering and unregistering of other communication devices within the target localization area (Loc),
producing (S6) a list (Ls) of communication devices from the identified switch (MSC), the list (Ls) containing identifiers of communication devices having an active registration duration above a given threshold,
sending (S6) the list (Ls) to the application server (AS).

12. A switch (MSC) for identifying communication devices (CD) following a given communication device (CDT) in motion through a telecommunication network (TN), said switch (MSC) comprising at least one processing means for:
receiving a first message (MesS) from an application server (AS),
starting a recording of registering and unregistering of communication devices within a target localization area (Loc) controlled by the switch (MSC),
receiving a second message (MesO) from an application server (AS),
stopping the recording of registering and unregistering of other communication devices within the target localization area (Loc),
producing a list (Ls) of communication devices from the identified switch (MSC), the list (Ls) containing identifiers of communication devices having an active registration duration above a given threshold,
sending the list (Ls) to the application server (AS).