Telephony security system

• US 7,440,558 B2
• Filed: 06/17/2004
• Issued: 10/21/2008
• Est. Priority Date: 07/17/2001
• Status: Expired due to Term

• Current Assignee: SecureLogix Corporation
• Original Assignee: SecureLogix Corporation
• Inventors: Brysch, Michael, Pickens, Keith S., Conyers, Doug, Beebe, Todd, Heilmann, Craig, Applonie, Robert R., Faustino, Stephen, Collier, Mark D., Buntin, David, Schmid, Greg
• Primary Examiner(s): Hong; Harry S
• Application Number:
  US10/870,395
• Publication Number:
  US 20040234056A1
• Time in Patent Office: 1,587 Days
• Field of Search: 379/93.03, 379/93.09, 379/93.11, 379/114.14, 379/145, 379/189, 379/196, 379/198, 379/200, 379/93.02, 379/188, 379/197, 379/199, 379/32.04
• US Class Current: 379/189
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 3/38 Graded-service arrangements, i.e. some subscribers prevented from establishing certain connections queuing arrangements H04Q3/64

Abstract

A system and method of telephony resource management and security for monitoring and/or controlling and logging access between an enterprise'"'"'s end-user stations and their respective circuits into the public switched telephone network (PSTN). One or more rules are defined which specify actions to be taken based upon at least one attribute of a call. Calls are detected and sensed to determine attributes associated with each call. Actions are then performed on selected calls based upon their attributes in accordance with the defined rules.

Claims

1. A telephony security system located within an enterprise, at one or more of said enterprise'"'"'s locations, for monitoring and/or controlling calls, wherein said calls is understood to refer to an inbound call, an outbound call, or any combination thereof, between end-user stations within said enterprise and said end-user stations'"'"'respective circuits into a Public Switched Telephone Network (PSTN), said system comprising:

one or more rules controlled by a system administrator, said one or more rules designating one or more actions, said one or more actions to include allowing or denying a call, said one or more actions to be performed based upon at least one attribute of said call;

one or more line sensors, said one or more line sensors including;

determining said at least one attribute of said call, and

performing said one or more actions based upon said at least one attribute of said call;

said one or more line sensors being constructed and arranged to not interrupt said call unless designated to do so in said one or more rules; and

wherein said one or more rules designating said one or more actions comprises at least one of;

a. redirecting said call,

b. logging said call,

c. recording said call,

d. encrypting said call,

e. generating a report,

f. providing an alert,

g. removing a number, wherein said number is understood to refer to a source number of said call, a destination number of said call, an alias or identifier associated with said call, or any combination thereof, from a current group associated with said number and placing said number into a different group not previously associated with said number,

h. monitoring said call, a plurality of said call, or any combination thereof, for one or more patterns of interest,

i. monitoring said call for one or more data of interest,

j. authenticating said call for remote access, and

k. monitoring said call for one or more sequences of digital data.

2. The system of claim 1 wherein said determination of said at least one attribute of said call includes determining one or more attributes selected from the group consisting of:

direction of said call,

source number of said call,

destination number of said call,

type of said call,

PBX trunk group through which said call is processed,

channel through which said call is processed,

date said call starts,

time said call starts,

digits dialed before said call connects,

digits dialed prior to a base phone number,

digits dialed after said base phone number,

caller ID identifier,

time said call connects,

sequences of digital data,

protocol and/or characteristics of said protocol used for said call,

host-based software used for said call,

digits dialed after said call connects,

date said call ends, and

time said call ends.

3. The system of claim 1 wherein said determination of said at least one attribute of said call includes determining at least one type of said call selected from the group consisting of:

voice,

fax,

modem,

STU-III,

wideband,

wideband video,

busy,

unanswered, and

undetermined.

4. The system of claim 1 wherein said one or more actions includes generating at least one report selected from the group consisting of:

post-event report,

schedule-generated report,

ad hoc report,

batch analysis report,

trend report, and

difference/comparison report.

5. The system of claim 1 wherein said one or more actions includes providing at least one alert selected from the group consisting of:

electronic mail notification,

pager notification,

console messaging, and

network management protocol trap notification.

6. The system of claim 1 wherein said determination of said at least one attribute of said call includes one or more processes selected from the group consisting of:

monitoring call progress,

decoding caller identification,

decoding automatic number identification,

reception of digital line protocol,

decoding,

demodulation,

detection of pulse dial,

detection of tone,

matching patterns,

recognition of spoken words,

recognition of words spoken in foreign languages,

voice decompression,

detection of voice compression,

detection of encryption,

decryption,

translation of call addresses, and

detection of voice activity.

7. The system of claim 1 wherein said one or more line sensors are constructed and arranged so as to monitor and/or control said calls into and/or out of said enterprise on a per-call basis.

8. The system of claim 1 wherein said one or more actions includes redirecting said call and/or a copy of said call to an apparatus selected from the group consisting of:

listening station,

honeypot,

network intrusion detection system,

recorder,

said end-user station different from a caller'"'"'s intended destination of said call,

encrypter/decrypter,

data of interest detector,

pattern of interest detector,

remote access authenticator, and

digital data sequence detector.

9. A method of monitoring and/or controlling call access between an enterprise'"'"'s end-user stations and said end-user stations'"'"' respective circuits into a Public Switched Telephone Network (PSTN), said method comprising the steps of:

using a system administrator for defining one or more rules, said one or more rules designating one or more actions, said one or more actions including at least allowing or denying said call access, said one or more actions to be performed based upon at least one attribute of a call, wherein said call is understood to refer to an inbound call, an outbound call, or any combination thereof;

determining said at least one attribute of said call;

performing said one or more actions based upon said at least one attribute of said call, wherein said call is not interrupted unless said one or more actions designate to interrupt said call; and

wherein said one or more rules designating said one or more actions comprises at least one of;

a. redirecting said call,

b. logging said call,

c. recording said call,

d. encrypting said call,

e. generating a report,

f. providing an alert,

g. removing a number, wherein said number is understood to refer to a source number of said call, a destination number of said call, an alias or identifier associated with said call, or any combination thereof, from a current group associated with said number and placing said number into a different group not previously associated with said number,

h. monitoring said call, a plurality of said call, or any combination thereof, for one or more patterns of interest,

i. monitoring said call for one or more data of interest,

j. authenticating said call for remote access, and

k. monitoring said call for one or more sequences of digital data.

10. The method of claim 9 wherein said determination of said at least one attribute of said call includes determining one or more attributes selected from the group consisting of:

direction of said call,

source number of said call,

destination number of said call,

type of said call,

PBX trunk group through which said call is processed,

channel through which said call is processed,

date said call starts,

time said call starts,

digits dialed before said call connects,

digits dialed prior to a base phone number,

digits dialed after said base phone number,

caller ID identifier,

time said call connects,

sequences of digital data,

protocol and/or characteristics of said protocol used for said call,

host-based software used for said call,

digits dialed after said call connects,

date said call ends, and

time said call ends.

11. The method of claim 9 wherein said determination of said at least one attribute of said call includes determining at least one type of said call selected from the group consisting of:

voice,

fax,

modem,

STU-III,

wideband,

wideband video,

busy,

unanswered, and

undetermined.

12. The method of claim 9 wherein said definition of said one or more rules further includes said designation of one or more actions to be performed based on at least one determined result of said one or more actions previously performed in association with said call, said one or more actions to be performed based on at least one determined result includes one or more actions selected from the group consisting of:

allowing said call,

denying said call,

redirecting said call,

logging said call,

recording said call,

encrypting said call,

generating a report,

providing an alert,

removing a number, wherein said number is understood to refer to a source number of said call, a destination number of said call, an alias or identifier associated with said call, or any combination thereof, from a current group associated with said number and placing said number into a different group not previously associated with said number,

monitoring said call, a plurality of said call, or any combination thereof, for one or more patterns of interest,

monitoring said call for one or more data of interest,

authenticating said call for remote access, and

monitoring said call for one or more sequences of digital data.

13. The method of claim 9 wherein a management server, one or more peripheral devices, or any combination thereof, performs one or more actions selected from the group consisting of:

logging said call,

recording said call,

generating a report,

providing an alert,

removing a number, wherein said number is understood to refer to a source number of said call, a destination number of said call, an alias or identifier associated with said call, or any combination thereof, from a current group associated with said number and placing said number into a different group not previously associated with said number,

monitoring said call, a plurality of said call, or any combination thereof, for one or more patterns of interest,

monitoring said call for one or more data of interest, and

monitoring said call for one or more sequences of digital data.

14. The method of claim 9 wherein said performance of said one or more actions may be preempted and/or complemented by said system administrator with one or more actions selected from the group consisting of:

allowing said call,

denying said call,

redirecting said call,

logging said call,

recording said call,

encrypting said call,

generating a report,

providing an alert,

removing a number, wherein said number is understood to refer to a source number of said call, a destination number of said call, an alias or identifier associated with said call, or any combination thereof, from a current group associated with said number and placing said number into a different group not previously associated with said number,

monitoring said call, a plurality of said call, or any combination thereof, for one or more patterns of interest,

monitoring said call for one or more data of interest,

authenticating said call for remote access, and

monitoring said call for one or more sequences of digital data.

15. The method of claim 9 wherein said one or more actions includes generation of at least one report selected from the group consisting of:

post-event report,

schedule-generated report,

ad hoc report,

batch analysis report,

trend report, and

difference/comparison report.

16. The method of claim 9 wherein said one or more actions includes provision of at least one alert selected from the group consisting of:

electronic mail notification,

pager notification,

console messaging, and

network management protocol trap notification.

17. The method of claim 9 wherein said determination of said at least one attribute of said call includes one or more processes selected from the group consisting of:

monitoring call progress,

decoding caller identification,

decoding automatic number identification,

reception of digital line protocol,

decoding,

demodulation,

detection of pulse dial,

detection of tone,

matching patterns,

recognition of spoken words,

recognition of words spoken in foreign languages,

voice decompression,

detection of voice compression,

detection of encryption,

decryption,

translation of call addresses, and

detection of voice activity.

18. The method of claim 9 wherein said determination of said at least one attribute of said call and said performance of said one or more actions is executed on a per-call basis.

19. The method of claim 9 wherein said one or more actions includes redirecting said call and/or a copy of said call to an apparatus selected from the group consisting of:

listening station,

honeypot,

network intrusion detection system,

recorder,

said end-user station different from a caller'"'"'s intended destination of said call,

encrypter/decrypter,

data of interest detector,

pattern of interest detector,

remote access authenticator, and

digital data sequence detector.

20. A system for monitoring and/or controlling call access between an enterprise'"'"'s end-user stations and said end-user stations'"'"' respective circuits into a Public Switched Telephone Network (PSTN), said system comprising:

means for defining one or more rules, said one or more rules designating one or more actions to include allowing or denying said call access, said one or more actions to be performed based upon at least one attribute of a call, wherein said call is understood to refer to an inbound call, an outbound call, or any combination thereof;

means for determining said at least one attribute of said call;

means for performing said one or more actions based upon said at least one attribute of said call, wherein said means for performing said one or more actions does not interrupt said call unless designated to do so in said one or more rules; and

wherein said one or more rules designating said one or more actions comprises at least one of;

a. redirecting said call,

b. logging said call,

c. recording said call,

d. encrypting said call,

e. generating a report,

f. providing an alert,

g. removing a number, wherein said number is understood to refer to a source number of said call, a destination number of said call, an alias or identifier associated with said call, or any combination thereof, from a current group associated with said number and placing said number into a different group not previously associated with said number,

h. monitoring said call, a plurality of said call, or any combination thereof, for one or more patterns of interest,

i. monitoring said call for one or more data of interest,

j. authenticating said call for remote access, and

k. monitoring said call for one or more sequences of digital data.

21. The system of claim 20 wherein said means for determining said at least one attribute of said call includes determining one or more attributes selected from the group consisting of:

direction of said call,

source number of said call,

destination number of said call,

type of said call,

PBX trunk group through which said call is processed,

channel through which said call is processed,

date said call starts,

time said call starts,

digits dialed before said call connects,

digits dialed prior to a base phone number,

digits dialed after said base phone number,

caller ID identifier,

time said call connects,

sequences of digital data,

protocol and/or characteristics of said protocol used for said call,

host-based software used for said call,

digits dialed after said call connects,

date said call ends, and

time said call ends.

22. The system of claim 20 wherein said means for determining said at least one attribute of said call includes determining at least one type of said call selected from the group consisting of:

voice,

fax,

modem,

STU-III,

wideband,

wideband video,

busy,

unanswered, and

undetermined.

23. The system of claim 20 wherein said means for defining said one or more rules further includes designating one or more actions to be performed based on at least one determined result of said one or more actions previously performed in association with said call, said one or more actions to be performed based on at least one determined result includes one or more actions selected from the group consisting of:

allowing said call,

denying said call,

redirecting said call,

logging said call,

recording said call,

encrypting said call,

generating a report,

providing an alert,

removing a number, wherein said number is understood to refer to a source number of said call, a destination number of said call, an alias or identifier associated with said call, or any combination thereof, from a current group associated with said number and placing said number into a different group not previously associated with said number,

monitoring said call, a plurality of said call, or any combination thereof, for one or more patterns of interest,

monitoring said call for one or more data of interest,

authenticating said call for remote access, and

monitoring said call for one or more sequences of digital data.

24. The system of claim 20 wherein a management server, one or more peripheral devices, or any combination thereof, performs one or more actions selected from the group consisting of:

logging said call,

recording said call,

generating a report,

providing an alert,

removing a number, wherein said number is understood to refer to a source number of said call, a destination number of said call, an alias or identifier associated with said call, or any combination thereof, from a current group associated with said number and placing said number into a different group not previously associated with said number,

monitoring said call, a plurality of said call, or any combination thereof, for one or more patterns of interest,

monitoring said call for one or more data of interest, and

monitoring said call for one or more sequences of digital data.

25. The system of claim 20 further including means for preempting and/or complementing performance of said one or more actions with one or more actions selected from the group consisting of:

allowing said call,

denying said call,

redirecting said call,

logging said call,

recording said call,

encrypting said call,

generating a report,

providing an alert,

removing a number, wherein said number is understood to refer to a source number of said call, a destination number of said call, an alias or identifier associated with said call, or any combination thereof, from a current group associated with said number and placing said number into a different group not previously associated with said number,

monitoring said call, a plurality of said call, or any combination thereof, for one or more patterns of interest,

monitoring said call for one or more data of interest,

authenticating said call for remote access, and

monitoring said call for one or more sequences of digital data.

26. The system of claim 20 wherein said one or more actions includes generating at least one report selected from the group consisting of:

post-event report,

schedule-generated report,

ad hoc report,

batch analysis report,

trend report, and

difference/comparison report.

27. The system of claim 20 wherein said one or more actions includes providing at least one alert selected from the group consisting of:

electronic mail notification,

pager notification,

console messaging, and

network management protocol trap notification.

28. The system of claim 20 wherein said means for determining said at least one attribute of said call includes means for one or more processes selected from the group consisting of:

monitoring call progress,

decoding caller identification,

decoding automatic number identification,

reception of digital line protocol,

decoding,

demodulation,

detection of pulse dial,

detection of tone,

matching patterns,

recognition of spoken words,

recognition of words spoken in foreign languages,

voice decompression,

detection of voice compression,

detection of encryption,

decryption,

translation of call addresses, and

detection of voice activity.

29. The system of claim 20 wherein said means for determining said at least one attribute of said call and said means for performing said one or more actions is constructed and arranged so as to monitor and/or control said call access into and/or out of said enterprise on a per-call basis.

30. The system of claim 20 wherein said one or more actions includes redirecting said call and/or a copy of said call to an apparatus selected from the group consisting of:

listening station,

honeypot,

network intrusion detection system,

recorder,

said end-user station different from a caller'"'"'s intended destination of said call,

encrypter/decrypter,

data of interest detector,

pattern of interest detector,

remote access authenticator, and

digital data sequence detector.