Method, apparatus and computer program product for verifying caller identification in voice communications

• US 10,063,699 B1
• Filed: 04/18/2017
• Issued: 08/28/2018
• Est. Priority Date: 04/18/2017
• Status: Active Grant

• Current Assignee: RSA Security LLC (Symphony Technology Group LLC)
• Original Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Inventors: Raman, Haim, Schoenbrun, Yihezkel, Roschak, Julia, Sorani, Itzkik, Vardy, Tamar, Peres, Mikael
• Primary Examiner(s): Tieu, Binh Kien
• Application Number:
  US15/490,145
• Time in Patent Office: 497 Days
• Field of Search: 37911419, 37911421, 37914201, 37914205, 379245, 379247, 379 9323, 379 8817, 379 881, 37914204, 37914206, 379145, 455410, 455411, 4554141, 455415, 455445
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04M 2203/6027 Fraud preventions
• CPC Class Codes: H04M 3/205 Eavesdropping prevention - indication of insecurity of line or network
• CPC Class Codes: H04M 3/42059 Making use of the calling party identifier
• CPC Class Codes: H04M 3/436 Arrangements for screening incoming calls , i.e. evaluating the characteristics of a call before deciding whether to answer it based on the calling party profile H04M3/42059; based on location H04M3/42348; based on presence H04M3/42365; diversion H04M3/54

Abstract

Techniques are disclosed for verifying caller identification in voice communications. In one embodiment, there is disclosed a method comprising receiving a request to establish a voice call between communications devices. The request comprising encrypted information and an identifier identifying a caller associated with the request to establish the voice call. The method further comprises retrieving, in response to receiving the request, a decryption key from an authentication source by requesting from the authentication source the decryption key associated with the identifier. The method further comprises utilizing the decryption key to decrypt the encrypted information and produce decrypted information as well as comparing the decrypted information and the identifier to determine a similarity therebetween. The method further comprises providing, based on the comparison, an indication of whether or not the request is deemed associated with fraud.

Claims

1. A method for detecting a spoofed call, comprising:

receiving, by processing circuitry, a request to establish a voice call between communications devices, the request comprising encrypted information, a plaintext identifier identifying a caller associated with the request to establish the voice call, and a time stamp, the encrypted information comprising an encrypted identifier and an encrypted time stamp;

in response to receiving the request, retrieving, by processing circuitry, a decryption key from an authentication source by requesting from the authentication source the decryption key associated with the plaintext identifier;

utilizing, by processing circuitry, the decryption key to decrypt the encrypted information and produce decrypted information that includes a decrypted identifier and a decrypted time stamp;

performing, by processing circuitry, a comparison to determine a similarity between (i) the decrypted identifier and the plaintext identifier and (ii) the decrypted time stamp and the time stamp; and

based on the comparison, providing, by processing circuitry, an indication of whether or not the request is deemed associated with fraud.

2. The method as claimed in claim 1, wherein the authentication source comprises a certificate authority (CA).

3. The method as claimed in claim 1, wherein the indication as provided reveals that the request is either deemed fraudulent or genuine based on whether or not the comparison determines a similarity between (i) the decrypted identifier and the plaintext identifier and (ii) the decrypted time stamp and the time stamp.

4. The method as claimed in claim 3, further comprising:

establishing the voice call between the communications device based on the comparison indicating a similarity.

5. The method as claimed in claim 3, further comprising:

rejecting the voice call between the communications device based on the comparison indicating an absence of similarity.

6. An apparatus for detecting spoofed call, comprising:

memory; and

processing circuitry coupled to the memory, the memory storing instructions which, when executed by the processing circuitry, cause the processing circuitry to;

receive a request to establish a voice call between communications devices, the request comprising encrypted information, a plaintext identifier identifying a caller associated with the request to establish the voice call, and a time stamp, the encrypted information comprising an encrypted identifier and an encrypted time stamp;

in response to receiving the request, retrieve a decryption key from an authentication source by requesting from the authentication source the decryption key associated with the plaintext identifier;

utilize the decryption key to decrypt the encrypted information and produce decrypted information that includes a decrypted identifier and a decrypted time stamp;

perform a comparison to determine a similarity between (i) the decrypted identifier and the plaintext identifier and (ii) the decrypted time stamp and the time stamp; and

based on the comparison, provide an indication of whether or not the request is deemed associated with fraud.

7. The apparatus as claimed in claim 6, wherein the authentication source comprises a certificate authority (CA).

8. The apparatus as claimed in claim 6, wherein the indication as provided reveals that the request is either deemed fraudulent or genuine based on whether or not the comparison determines a similarity between (i) the decrypted identifier and the plaintext identifier and (ii) the decrypted time stamp and the time stamp.

9. The apparatus as claimed in claim 8, further comprising:

establishing the voice call between the communications device based on the comparison indicating a similarity.

10. The apparatus as claimed in claim 8, further comprising:

rejecting the voice call between the communications device based on the comparison indicating an absence of similarity.

11. A computer program product for detecting a spoofed call having a non-transitory computer readable medium which stores a set of instructions, the set of instructions, when carried out by processing circuitry, causing the processing circuitry to perform a method of:

receiving a request to establish a voice call between communications devices, the request comprising encrypted information, a plaintext identifier identifying a caller associated with the request to establish the voice call, and a time stamp, the encrypted information comprising an encrypted identifier and an encrypted time stamp;

in response to receiving the request, retrieving a decryption key from an authentication source by requesting from the authentication source the decryption key associated with the plaintext identifier;

utilizing the decryption key to decrypt the encrypted information and produce decrypted information that includes a decrypted identifier and a decrypted time stamp;

performing a comparison to determine a similarity between (i) the decrypted identifier and the plaintext identifier and (ii) the decrypted time stamp and the time stamp; and

based on the comparison, providing an indication of whether or not the request is deemed associated with fraud.

12. The computer program product as claimed in claim 11, wherein the authentication source comprises a certificate authority (CA).

13. The computer program product as claimed in claim 11, wherein the indication as provided reveals that the request is either deemed fraudulent or genuine based on whether or not the comparison determines a similarity between (i) the decrypted identifier and the plaintext identifier and (ii) the decrypted time stamp and the time stamp.

14. The computer program product as claimed in claim 13, further comprising:

establishing the voice call between the communications device based on the comparison indicating a similarity.

15. The computer program product as claimed in claim 13, further comprising:

rejecting the voice call between the communications device based on the comparison indicating an absence of similarity.