Methods and systems for protecting a telecommunication service

• US 20080279362A1
• Filed: 05/11/2007
• Published: 11/13/2008
• Est. Priority Date: 05/11/2007
• Status: Active Grant

• Current Assignee: AT&T Knowledge Ventures, L.P. (AT&T, Inc.)
• Original Assignee: AT&T Knowledge Ventures, L.P. (AT&T, Inc.)
• Inventors: Yasrebi, Mehrad, Qiu, Chaoxin Charles, Ku, Bernard S.
• Granted Patent: US 8,180,032 B2
• Time in Patent Office: Days
• US Class Current: 379/221.06
• CPC Class Codes: H04L 2101/65 Telephone numbers
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4557 Directories for hybrid networks, e.g. including telephone numbers
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04M 7/0075 Details of addressing, directories or routing tables
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention

Abstract

A client of a telephone number mapping (ENUM) server is used to protect the ENUM server from a Denial of Service (DoS) attack. The DoS attack may comprise a plurality of attempts to place exception calls from one or more end user devices that are unregistered. The one or more end user devices may originate from a service provider network.

Claims

1. A method comprising:

using a client of a telephone number mapping (ENUM) server to protect the ENUM server from a Denial of Service (DoS) attack.

2. The method of claim 1 wherein the DoS attack comprises a plurality of attempts to place exception calls from one or more end user devices that are unregistered.

3. The method of claim 1 wherein the client is a component of a service provider network, and wherein the one or more end user devices originate from the service provider network.

4. The method of claim 1 wherein the client comprises a Call Session Control Function (CSCF).

5. The method of claim 1 wherein said using the client comprises:

receiving a first call initiation request message associated with a first attempt to place a first exception call from an end user device;

querying the ENUM server in response to the first call initiation request message;

receiving a second call initiation request message associated with a second attempt to place a second exception call from the end user device;

based on the second call initiation request message, determining that a behavior of making call attempts from the end user device is excessive; and

in response to said determining that the behavior is excessive, inhibiting querying the ENUM server for the second call initiation request message.

6. The method of claim 5 further comprising:

in response to said determining that the behavior is excessive, storing a value in a database, the value indicating that a privilege of making subsequent exception calls from the end user device is withdrawn.

7. The method of claim 6 further comprising:

receiving a third call initiation request message associated with a third attempt to place a third exception call from the end user device; and

based on the value in the database indicating that the privilege of making subsequent exception calls from the end user device is withdrawn, inhibiting querying the ENUM server for the third call initiation request message.

8. The method of claim 6 further comprising:

updating the value in the database to reauthorize the privilege of making exception calls from the end user device.

9. The method of claim 5 further comprising:

determining a first behavior of making call attempts over a first time period; and

determining a second behavior of making call attempts over a second time period, wherein the second time period differs from the first time period;

wherein said determining that the behavior is excessive comprises determining that at least one of the first behavior and the second behavior is excessive.

10. The method of claim 5 wherein said determining that the behavior is excessive comprises determining that a count of a number of call attempts made from the end user device over a time period is greater than or equal to a threshold value.

11. The method of claim 5 wherein said determining that the behavior is excessive comprises determining that a count of a number of call attempts made from the end user device to a particular callee over a time period is greater than or equal to a threshold value.

12. The method of claim 5 further comprising:

sending an alarm message from the client to a network operation center in response to said determining that the behavior is excessive.

13. The method of claim 1 wherein the client comprises a session border controller.

14. The method of claim 1 wherein the client comprises a feature server.

15. A system comprising:

a client of a telephone number mapping (ENUM) server, the client to protect the ENUM server from a Denial of Service (DoS) attack.

16. The system of claim 15 wherein the DoS attack comprises a plurality of attempts to place exception calls from one or more end user devices that are unregistered.

17. The system of claim 16 wherein the client is a component of a service provider network, and wherein the one or more end user devices originate from the service provider network.

18. The system of claim 15 wherein the client comprises a Call Session Control Function (CSCF).

19. The system of claim 15 wherein the client is to protect the ENUM server by:

receiving a first call initiation request message associated with a first attempt to place a first exception call from an end user device;

querying the ENUM server in response to the first call initiation request message;

receiving a second call initiation request message associated with a second attempt to place a second exception call from the end user device;

based on the second call initiation request message, determining that a behavior of making call attempts from the end user device is excessive; and

in response to said determining that the behavior is excessive, inhibiting querying the ENUM server for the second call initiation request message.

20. The system of claim 15 further comprising:

a database storing;

a value indicating whether an unregistered end user device is privileged to make an exception call;

a set of authorized callees to which the exception call can be made from the unregistered end user device;

a first count of a number of call requests made by the end user device to one of the authorized callees over a first time period; and

a second count of a number of call requests made by the end user device to the one of the authorized callees over a second time period, wherein the second time period differs from the first time period.

21. The system of claim 20 wherein the database further stores a set of allowed device identifiers that identify which end user devices are allowed to initiate call requests.

22. The system of claim 15 further comprising:

a network component to receive a first call initiation request from an end user device, determine a network address of the end user device, and generate a second call initiation request that comprises a header which includes the network address;

wherein the client is to receive the second call initiation request from the network component, extract the network address from the second call initiation request, and determine whether to query the ENUM server for the second call initiation request based on the network address.

23. A computer-readable medium encoded with a computer program, the computer program to cause a client of a telephone number mapping (ENUM) server to protect the ENUM server from a Denial of Service (DoS) attack.