WO2007031980A1

WO2007031980A1 - Authentication of calls in packet networks

Info

Publication number: WO2007031980A1
Application number: PCT/IL2005/000996
Authority: WO
Inventors: Danny Shporer
Original assignee: Mts Mer Telemanagement Solutions Ltd.
Priority date: 2005-09-15
Filing date: 2005-09-15
Publication date: 2007-03-22

Abstract

A method of detecting fraud in a packet network (170), including, monitoring (110) communication packets in the network (170), detecting one or more packets of a call, determining the identity of one or more participants (190) of the call from the detected packets, transmitting a query with the determined identity to a billing system (120) for authentication, and waiting for a response from the billing system (120).

Description

AUTHENTICATION OF CALLS IN PACKET NETWORKS

FIELD OF THE INVENTION

The present invention relates generally to call services in a packet network.

BACKGROUND OF THE INVENTION

In recent years there has been an increase in the bandwidth and transfer rate of standard networks, for example the standard transmission rate in local area networks (LANs) has increased from 1 OMBPS to IOOMBPS or even 1000MBPS. The standard connection speed to the Internet has increased from 10-lOOKBPS to 1-lOMBPS. Applications which were previously too slow and unfeasible have become a reality. An example of such an application is point to point or point to multipoint voice and/or video communication.

Currently a growing number of businesses are providing commercial telephone call services using internet protocol based networks. These services are generally referred to as voice over IP services (VoIP). The service provider typically supplies address translation services and optionally, connectivity between different types of call service networks, for example between the IP based network and a public switched telephone network (PSTN). Typically VoIP services offer a competitive alternative to traditional telephone services. VoIP services that are connected to the Internet provide a mobility which is generally not provided by traditional telephone services. Typically, users of VoIP services can use the same telephone number and pay the same rates regardless of their geographical location as long as they have access to the Internet.

The growing popularity of VoIP services has led to an increase in the desire of miscreants to take advantage of these services, for example using the infrastructure provided by a service provider to call without paying.

US publication 2002/0188712 to Caslin et al. the disclosure of which is incorporated herein by reference, describes a fraud monitoring system that analyzes records of usage activity and applies fraud pattern detection algorithms to detect patterns indicative of fraud.

US patent 6,701,439 to Dunn the disclosure of which is incorporated herein by reference, describes a method of call rejection provided for use in connection with a data network.

PCT publication WO 02/17036 the disclosure of which is incorporated herein by reference, describes a processor architecture for processing data packets representing VoIP calls in a packet switched network.

SUMMARY OF THE INVENTION

An aspect of an embodiment of the invention relates to a method and apparatus for detecting fraudulent calls in an IP based packet network. In an exemplary embodiment of the invention, a mediation device is installed at key points in the network. The mediation device monitors packets of the network to detect call packets providing the details of the call participants. The mediation device queries a billing system comprising a database provided by the service provider to authenticate the call. If the call fails authentication the mediation device attempts to block packets of the call.

In some embodiments of the invention, the mediation device monitors all packets in the network. Alternatively, the mediation device randomly monitors packets or periodically monitors packets.

In some embodiments of the invention, the mediation device authenticates all call packets. Alternatively, the mediation device authenticates specific call packets.

In some embodiments of the invention, the mediation device communicates with the billing system over the network. Alternatively, the mediation device uses a direct connection to communicate with the billing system.

In some embodiments of the invention, the mediation device instructs a fire wall to block packets of the call or packets transmitted or received from the call participants. Optionally, the blocking is performed for a specific time interval, for example 1-10 minutes.

In some embodiments of the invention, the mediation device blocks the call itself.

In some embodiments of the invention, the mediation device assists in verifying call duration.

There is thus provided in accordance to an exemplary embodiment of the invention a method of detecting fraud in a packet network, comprising, monitoring communication packets in the network, detecting one or more packets of a call, determining the identity of one or more participants of the call from the detected packets; transmitting a query with the determined identity to a billing system for authentication; and waiting for a response from the billing system. Optionally, the monitoring comprises monitoring all packets in the network. Alternatively, the monitoring comprises randomly monitoring packets in the network. In an exemplary embodiment of the invention, the monitoring comprises periodically monitoring packets in the network. Optionally, the detecting comprises detecting specific types of call packets. In an exemplary embodiment of the invention, the detecting comprises detecting call initialization packets. Optionally, the determining is at least of the identity of the call initiator. In an exemplary embodiment of the invention, the deteπnining is at least of the identity of the call receptor. Optionally, the determining is of the identity of all call participants.

In an exemplary embodiment of the invention, the billing system is adapted to authenticate that a client is registered for initiating calls. Optionally, the billing system is adapted to authenticate that a client is registered for receiving calls. In an exemplary embodiment of the invention, the billing system is adapted to authenticate that the call is registered. Optionally, the transmitting is over a direct connection. In an exemplary embodiment of the invention, the monitoring continues while waiting for a response from the billing system. Optionally, the monitoring continues after commencing the waiting. In an exemplary embodiment of the invention, the method further comprises selectively instructing a firewall to block future call packets of the call responsive to the authentication. Optionally, the firewall blocks packets of a call until a termination packet is detected for the call. In an exemplary embodiment of the invention, the firewall blocks packets of a call for a selected time interval.

There is thus further provided a system for detecting fraud calls in a packet network comprising, a mediation device that detects call packets in the network and determines one or more caller identities, a billing system that comprises a database of registered clients that are authenticated to conduct calls, a firewall that is adapted to block call packets from being transmitted between two or more clients, wherein the mediation device queries the billing system to authenticate the determined call participant identities; and wherein the mediation device instructs the firewall to block communications from a remote communication device responsive to the status of authentication received from the billing system. Optionally, the mediation device is positioned in the network between the firewall and a communication device that initiates the call. In an exemplary embodiment of the invention, the mediation device is positioned in the network between the firewall and a communication device that receives the call.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be understood and appreciated more fully from the following detailed description taken in conjunction with the drawings in which:

Fig. 1 is a schematic illustration of a network, according to an exemplary embodiment of the invention;

Fig. 2 is a schematic illustration of an alternative configuration of a network, according to an exemplary embodiment of the invention;

Fig. 3 is a flow diagram of the process of handling an authorized call, according to an exemplary embodiment of the invention;

Fig. 4 is a flow diagram of the process of handling a fraudulent call, according to an exemplary embodiment of the invention.

DETAILED DESCRIPTION

Fig. 1 is a schematic illustration of a network 100, according to an exemplary embodiment of the invention. In an exemplary embodiment of the invention, network 100 comprises multiple clients or client networks, which are interconnected over an IP based network 170, for example the Internet. In some embodiments of the invention, network 170 is a private network interconnecting clients to a service provider, with or without providing the clients with direct access to the internet.

A client requesting access to VoIP services is connected over a network to the service provider. As an example such a client may be a single user or may be a network with many users, for example a LAN. Additionally, the client connection may be over cables or wireless. Optionally, a client location may comprise a firewall 160 to protect the client network, a router 150 to route communication from the client network to network 170 and one or more switches or hubs 130 to connect multiple client stations at the client site. In some embodiments of the invention, the client station 190 is optionally a personal computer, a PDA, a smart phone or an IP telephone. Alternatively or additionally, the client station may be a standard communication device, such as an analog telephone, a fax machine or a standard PSTN system which is connected via a gateway 180 to the client network.

In an exemplary embodiment of the invention, the service provider provides a gatekeeper 140 to handle address translation and control call allocation. Optionally, the service provider additionally provides a billing system 120, which comprises a database that is updated with details of all subscribers to the VoIP service, for example client identity and charge plan. In an exemplary embodiment of the invention, billing system 120 keeps track of client usage of the service, the client's billing charges and payments.

In some embodiments of the invention, billing system 120 is combined with gatekeeper 140 or there is a direct connection between them. Alternatively, billing system may be connected to the gatekeeper over a network, for example a LAN, WAN (e.g. the Internet).

In an exemplary embodiment of the invention, the service provider provides a mediation device 110 to monitor the packets in the network and authenticate call packets with billing system 120. In an exemplary embodiment of the invention, mediation device 110 is positioned at the client location. Optionally, mediation device 110 may monitor packet traffic between router 150 and switch 130 or between router 150 and firewall 160. Alternatively or additionally, mediation device 110 may monitor packet traffic between switch 130 and each communication device 190. Optionally, the monitoring position is selected to monitor packets in an unencrypted form to simplify mediation device 110. However in some embodiments of the invention, mediation device 110 may monitor encrypted packets.

In some embodiments of the invention, mediation device 110 is a dedicated device, which monitors packets, for example a personal computer programmed for the task or a special circuit. Alternatively mediation device 110 is optionally a circuit or element that is installed in communication devices 190, switch 130, router 150 and/or firewall 160.

In some embodiments of the invention, the service provider may require installation of mediation device 110 at the location of every subscriber, for example by supplying a dedicated router 150 or dedicated communication device 190 for use with the service. Alternatively, mediation device 110 is optionally, installed at an Internet Service Provider (ISP) to monitor all incoming traffic from clients.

Fig. 2 is a schematic illustration of an alternative configuration of a network 200, according to an exemplary embodiment of the invention. In the configuration illustrated in Fig. 2, IP based network 270 is optionally a private network controlled by the VoIP service provider that connects between clients, for example by direct cables, satellite, wireless transmissions, leased lines from a telephony service provider or any other type of connection. In network 200, optionally all communication packets are routed under the control of the service provider. In an exemplary embodiment of the invention, mediation device 110 is installed in network 270 under control of the service provider. Optionally, mediation device 110 is positioned to monitor communication packets between router 150 and switch 130 in network 270. Alternatively; any other enabling layout may be used to allow mediation device 110 to monitor the packets in the network. In some embodiments of the invention, more than one meditation device 110 is used by the service provider. Alternatively, one mediation device 110 monitors multiple communication paths in network 170 and/or network 270.

Fig. 3 is a flow diagram 300 of the process of handling an authorized call, according to an exemplary embodiment of the invention. In an exemplary embodiment of the invention, an authorized client (e.g. B) initiates (310) a call, for example by lifting the receiver of a VoIP telephone and dialing the number of another authorized client (e.g. A). Optionally, the call is routed (320) via gatekeeper 140 to receive the address of the other client station and optionally, authenticate (330) the callers.

In an exemplary embodiment of the invention, mediator device 110 detects (340) packets associated with the call based on the contents of communication packets. In some embodiments of the invention, VoIP calls are setup using the H.323 protocol or SIP protocol. However the methods described herein can be practiced using other protocols. In some protocols mediation device 110 performs authentication of calls from any call packet, for example using the source and destination addresses of the packet. Optionally, billing system 120 is updated by gatekeeper 140 with translation tables if needed to match between IP addresses and user identifications.

In some embodiments of the invention, authentication is performed only for initialization packets, termination packets or other specific packets of a call since authentication of other packets would be redundant, more complex and/or problematic since some packets may not contain the required details needed to identify the caller and/or call receiver. Optionally, mediator device 110 reconstructs a higher level message from multiple packets in order to extract the identities and/or addresses of the call participants.

In an exemplary embodiment of the invention, the information needed for authentication comprises the identity of the client that initiated the call and the identity of the client that is receiving the call. Optionally, a packet that only identifies one of the clients is authenticated for the identified client. In some embodiments of the invention, only the call initiator needs to be authenticated since the initiator pays for the call. Optionally, calls can be transmitted to clients of other service providers or to clients of non VoIP systems. However, in some embodiments of the invention, all participants need to be registered at the service provider in order to use the service. In some embodiments of the invention, some call packets may identify more than two participants, for example in a conference call. Optionally, mediation device 110 authenticates all participants.

In an exemplary embodiment of the invention, mediation device 110 transmits the client details to billing system 120 to authenticate (350) the call, for example by checking that the client is listed in the billing system data base and/or that the client pays for the service and there is no reason to prevent the client from receiving service.

In some embodiments of the invention, mediation device 110 may be combined with billing system 120 or have a direct connection to billing system 120, for example in a network 270 to eliminate the need for transmitting authentication requests.

In the case that the call is an authorized call, a positive answer is received from billing system 120 and the call continues (360) since no further action is taken by mediation device 110. Optionally, if no answer is received from billing system 120, for example due to packet loss or problems with billing system 120, no further action is taken. Alternatively, if no answer is received, mediation device 110 may be programmed to respond as if the call is a fraudulent call as will be described below. In some embodiments of the invention, the response if no answer is received may depend on the type of call, for example a call that is expensive for the service provider may be dealt with, while other calls will be ignored.

In a VoIP calling system there may be many types of fraudulent calls, for example:

1. using service provider system resources without registering and paying for the service, such as a call from a non authorized client to another client by circumventing the gatekeeper;

2. calling without having the call recorded - although registered, such as a call from an authorized client to another client circumventing the gatekeeper;

3. continuing a call after the client station notifies billing system 120 that the call terminated in order to stop charges; and

4. calling and not paying, such as a client that does not pay or has outstanding unpaid debts to the service provider.

5. using unauthorized services by a registered client, for example a registered client that is using a service that was not authorized for his/her use such as a voice subscriber conducting a video call.

Some methods of fraud can be detected by mediation device 110 from the packets themselves without querying billing system 120, for example a call initialization packet using the H.323 protocol, which is not directed to the gatekeeper. However some methods of fraud can only be determined by checking with billing system 120. Additionally, some packets using certain protocols can only be authenticated by billing system 120.

Fig. 4 is a flow diagram 400 of the process of handling a fraudulent call, according to an exemplary embodiment of the invention. In an exemplary embodiment of the invention, a client initiates a call (410) that circumvents the gatekeeper, for example by programming communication device 190 to initiate a call directly between clients. It should be noted that in some cases of fraud the initialization is the same as in an authorized call such as described in association with Fig. 3 - (320) and (330) and the fraud starts at a later stage for example by faking call termination while continuing the conversation as described above.

In an exemplary embodiment of the invention, mediation device 110 monitors communication packets in the network and detects (420) packets of a call. In some embodiments of the invention, mediation device 110 is programmed to detect specific types of call packets, for example call initialization packets and/or call termination packets. Alternatively, mediation device 110 detects all call packets or substantially all call packets.

In an exemplary embodiment of the invention, mediator device 110 checks (430) the authentication of the call. In some cases mediation device 110 is able to detect immediately that the call is fraudulent and does not need to transmit the identities of the participants to billing system 120. Alternatively, mediation device 110 transmits a query regarding the identity of the callers to billing system 120 for authentication. In some embodiments of the invention, billing system 120 authenticates that the clients are registered and approved to receive the service from the service provider. Optionally, billing system 120 authenticates that the clients do not have outstanding debt.

In some embodiments of the invention, billing system 120 is notified of billing details while a call is in progress. Optionally, mediation device 110 is able to confirm if a call is currently being charged to the client, in order to identify fraudulent calls which managed to bypass the standard charge process. In some embodiments of the invention, mediation device 110 and/or billing system 120 query gatekeeper 140 to verify details that are only known to the gatekeeper, for example in some configurations details of billing of calls in progress.

In some embodiments of the invention, mediation device 110 monitors all packets in the network. Alternatively, mediation device 110 monitors packets randomly or periodically, for example every few seconds.

In some embodiments of the invention, mediation device 110 handles a single call at a time, ignoring any other packets until resolving authentication for the packet being handled. Alternatively, mediation device 110 deals with more than one packet as detected according to its ability, for example mediation device 110 may have a limitation on the number of open queries it can handle. Optionally, mediation device 110 will initiate queries up to the number it can handle and postpone or skip any further checking until it closes some of the open queries for example after receiving a response or after timing out due to a lack of response.

In an exemplary embodiment of the invention, when a fraudulent call is detected, mediation device 110, notifies (440) firewall 160 to block the fraudulent call. Optionally, firewall 160 is set to block the packets of a specific call or block a specific client. In some embodiments of the invention, firewall 160 blocks the call initiator or call receiver from transmitting packets. Alternatively, firewall 160 blocks the reception of packets by the call initiator or call receiver. In either case at least one side of the call will not received since the call packets are blocked. As a result the clients will not be able to have a conversation and will terminate the call. In some embodiments of the invention, both sides are blocked by firewall 160.

In an exemplary embodiment of the invention, firewall 160 will continue to block the call until mediator device 110 detects (450) a call termination packet for the call. Optionally, upon detecting a call termination mediation device 110 instructs (460) firewall 160 to remove the block. In some embodiments of the invention mediation device 110 instructs (460) firewall 160 to remove the block after a predetermined time interval, for example after about 1-10 minutes or about 1-60 seconds, since the clients would be expected to terminate the call if nothing can be heard. In any case mediation device 110 can re-block the call if it is detected again.

In some embodiments of the invention, mediation device 110 also serves as a firewall and is able to block packets (e.g. erase them or return them) and not only monitor them, for example monitor device 110 may be optionally combined with router 150, switch 130, firewall 160 or communication device 190. Optionally, instead of notifying firewall 150 to block a client, it will erase fraudulent packets of a call once determining that a call is fraudulent.

In some embodiments of the invention, mediation device 110 supports instructing specific firewalls 160. Alternatively or additionally, mediation device 110 can be programmed to instruct other firewalls 160.

In some embodiment of the invention, mediation device 110 updates billing system 120 and/or gatekeeper 140 with the details of monitored calls in order to assist in verifying billing of the detected calls and/or allow billing of calls that would otherwise go undetected. In some embodiments of the invention, billing system 120 and/or gatekeeper 140 build a list of client identities used for fraudulent calls. Optionally, calls detected with a client from this list may be automatically blocked or checked with more scrutiny, for example by checking payment history of the client.

It should be appreciated that the above described methods may be varied in many ways, including omitting or adding steps, changing order of the steps and the type of devices used. It should be appreciated that different features may be combined in different ways. In particular, not all the features shown above in a particular embodiment are necessary in every embodiment of the invention. Further combinations of the above features are also considered to be within the scope of some embodiments of the invention. Section headings are provided for assistance in navigation and should not be considered as necessarily limiting the contents of the section.

It will be appreciated by persons skilled in the art that the present invention is not limited to what has been particularly shown and described hereinabove. Rather the scope of the present invention is defined only by the claims which follow.

Claims

1. A method of detecting fraud in a packet network, comprising: monitoring communication packets in the network; detecting one or more packets of a call; determining the identity of one or more participants of the call from the detected packets; transmitting a query with the determined identity to a billing system for authentication; and waiting for a response from the billing system.

2. A method according to claim 1, wherein said monitoring comprises monitoring all packets in the network.

3. A method according to claim I₅ wherein said monitoring comprises randomly monitoring packets in the network.

4. A method according to claim I₅ wherein said monitoring comprises periodically monitoring packets in the network.

5. A method according to claim I₅ wherein said detecting comprises detecting specific types of call packets.

6. A method according to claim 5, wherein said detecting comprises detecting call initialization packets.

7. A method according to claim I₅ wherein said determining is at least of the identity of the call initiator.

8. A method according to claim 1, wherein said determining is at least of the identity of the call receptor.

9 A method according to claim I₅ wherein said determining is of the identity of all call participants.

10. A method according to claim 1, wherein said billing system is adapted to authenticate that a client is registered for initiating calls.

11. A method according to claim 1, wherein said billing system is adapted to authenticate that a client is registered for receiving calls.

12. A method according to claim 1, wherein said billing system is adapted to authenticate that the call is registered.

13. A method according to claim 1, wherein said transmitting is over a direct connection.

14. A method according to claim I₅ wherein said monitoring continues while waiting for a response from said billing system.

15. A method according to claim 1, wherein said monitoring continues after commencing said waiting.

16. A method according to claim 1, further comprising selectively instructing a firewall to block future call packets of the call responsive to said authentication.

17. A method according to claim 16, wherein said firewall blocks packets of a call until a termination packet is detected for the call.

18. A method according to claim 16, wherein said firewall blocks packets of a call for a selected time interval.

19. A system for detecting fraud calls in a packet network comprising: a mediation device that detects call packets in the network and determines one or more caller identities; a billing system that comprises a database of registered clients that are authenticated to conduct calls; a firewall that is adapted to block call packets from being transmitted between two or more clients; wherein said mediation device queries said billing system to authenticate said determined call participant identities; and wherein said mediation device instructs said firewall to block communications from a remote communication device responsive to the status of authentication received from said billing system.

20. A system according to claim 19, wherein said mediation device is positioned in the network between said firewall and a communication device that initiates the call.

21. A system according to claim 19, wherein said mediation device is positioned in the network between said firewall and a communication device that receives the call.