Systems and methods for detecting device location and usage

A method comprising:

• receiving, by a processor, from a device, a device certificate comprising a unique identifier;
• based on an authorized deployment region for the device, generating, by the processor, stored data comprising at least one of an expected location for the device or an expected usage of the device;
• associating, by the processor, the stored data with the device using the unique identifier extracted from the device certificate;
• subsequently receiving, by the processor, from the device, a first message comprising first data, wherein the first data comprises the device certificate with the unique identifier and a first hash of device data that is indicative of at least one of a current device location or a current device usage, the device data comprising at least one of a current Session Initiation Protocol (SIP) domain of the device, a current time zone in which the device is located, data related to a current posture of the device, a configured language of the device, a dialing configuration of the device for emergency numbers, or a dial plan of the device;
• using the unique identifier, retrieving, by the processor, the stored data associated with the device;
• after receiving the first message, transmitting, by the processor, to the device, instructions to transmit a second message comprising second data that is different from the first data, wherein the second data comprises at least one of a hardware configuration of the device, a Domain Name System (DNS) domain name, a public Internet Protocol (IP) address of a DNS server, or a public IP address of a Network Time Protocol (NTP) server;
• receiving, by the processor, from the device, the second message;
• for the first message:
• generating, by the processor, a second hash of one or more first corresponding portions of the stored data;
• and
• comparing, by the processor, the first and second hashes;
• for the second message:
• comparing, by the processor, the second data to one or more second corresponding portions of the stored data;
• and
• when at least one of (i) the first and second hashes do not match, or (ii) the second data and the one or more second corresponding portions of the stored data do not match, generating, by the processor, an alert.

A non-transitory computer-readable medium comprising instructions that when executed, cause a processor of a device to:

• in response to detecting a boot-up of the device, automatically extract first device data indicative of at least one of a current device location or a current device usage, wherein the first device data comprises a first data type, the first device data comprising at least one of a current Session Initiation Protocol (SIP) domain of the device, a current time zone in which the device is located, data related to a current posture of the device, a configured language of the device, a dialing configuration of the device for emergency numbers, or a dial plan of the device;
• generate a nonce;
• create hashed first device data comprising a hash of the first device data and the nonce;
• automatically transmit a first message comprising a device certificate, the nonce, and the hashed first device data to an external system via a public network;
• after transmitting the first message, receiving, from the external system, a second message comprising instructions to send second device data, wherein the second device data comprises a second data type that is different from the first data type, the second device data comprising at least one of a hardware configuration of the device, a Domain Name System (DNS) domain name, a public Internet Protocol (IP) address of a DNS server, or a public IP address of a Network Time Protocol (NTP) server;
• and
• transmitting, to the external system via the public network, a third message comprising the device certificate, a second nonce, and the second device data.

A system comprising:

• a memory storing executable instructions;
• and
• a processor in communication with the memory, wherein the processor when executing the executable instructions:
• receives, from a device, a first message comprising first data, wherein the first data comprises a first hash of device data that is indicative of at least one of a current device location or a current device usage, the device data comprising at least one of a current Session Initiation Protocol (SIP) domain of the device, a current time zone in which the device is located, data related to a current posture of the device, a configured language of the device, a dialing configuration of the device for emergency numbers, or a dial plan of the device;
• retrieves stored data associated with the device, wherein the stored data is based on an authorized deployment region for the device, the authorized deployment region comprising at least one of (i) an authorized location associated with the device, or (ii) an authorized configuration and posture associated with the device;
• after receiving the first message, transmits, to the device, instructions to transmit a second message comprising second data that is different from the first data, wherein the second data comprises at least one of a hardware configuration of the device, a Domain Name System (DNS) domain name, a public Internet Protocol (IP) address of a DNS server, or a public IP address of a Network Time Protocol (NTP) server;
• receives, from the device, the second message;
• for the first message:
• generates a second hash of one or more first corresponding portions of the stored data;
• and
• compares the first and second hashes;
• for the second message:
• compares the second data to one or more second corresponding portions of the stored data;
• and
• when at least one of (i) the first and second hashes do not match, or (ii) the second data and the one or more second corresponding portions of the stored data do not match, generates an alert.

A system comprising:

• a memory storing executable instructions;
• and
• a processor in communication with the memory, wherein the processor when executing the executable instructions:
• receives, from a device, a first message comprising a first hash of device data that is indicative of at least one of a current device location or a current device usage, wherein the device data comprises at least one of a current Session Initiation Protocol (SIP) domain of the device, a current time zone in which the device is located, data related to a current posture of the device, a configured language of the device, a dialing configuration of the device for emergency numbers, or a dial plan of the device;
• after receiving the first message, transmits, to the device, instructions to transmit a second message comprising second data that is different from the first data, wherein the second data comprises at least one of a hardware configuration of the device, a Domain Name System (DNS) domain name, a public Internet Protocol (IP) address of a DNS server, or a public IP address of a Network Time Protocol (NTP) server;
• receives, from the device, the second message;
• for the first message:
• generates a second hash of one or more first corresponding portions of stored data, the stored data being based on at least one of an expected location or an expected usage associated with the device;
• and
• compares the first and second hashes;
• for the second message:
• compares the second data to one or more second corresponding portions of the stored data;
• when at least one of (i) the first and second hashes do not match, or (ii) the second data and the one or more second corresponding portions of the stored data do not match, registers a mismatch;
• determines a total number of mismatches for the device within a time period;
• and
• generates an alert only when the total number of mismatches for the device is greater than a predetermined number.

A system for detecting grey market activities, the system comprising:

• a memory storing executable instructions;
• and
• a processor in communication with the memory, wherein the processor when executing the executable instructions:
• receives, from a device, a first message comprising first data, wherein the first data comprises a first hash of device data that is indicative of at least one of a current device location or a current device usage, the device data comprising at least one of a current Session Initiation Protocol (SIP) domain of the device, a current time zone in which the device is located, data related to a current posture of the device, a configured language of the device, a dialing configuration of the device for emergency numbers, or a dial plan of the device;
• after receiving the first message, transmits, to the device, instructions to transmit a second message comprising second data that is different from the first data, wherein the second data comprises at least one of a hardware configuration of the device, a Domain Name System (DNS) domain name, a public Internet Protocol (IP) address of a DNS server, or a public IP address of a Network Time Protocol (NTP) server;
• receives, from the device, the second message;
• for the first message:
• generates a second hash of one or more first corresponding portions of stored data, the stored data being based on at least one of an authorized location for the device or an authorized usage associated with the device;
• and
• compares the first and second hashes;
• for the second message:
• compares the second data to one or more second corresponding portions of the stored data;
• and
• when at least one of (i) the first and second hashes do not match, or (ii) the second data and the one or more second corresponding portions of the stored data do not match, generates an alert indicating that the device is a potential grey market device with at least one of an unauthorized location or an unauthorized use.