Prevention of call spoofing in a Voice over Internet Protocol (VoIP) network

• US 8,681,783 B2
• Filed: 02/18/2011
• Issued: 03/25/2014
• Est. Priority Date: 02/18/2011
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: Carney, Mark D., Jackson, Jeffrey A.
• Primary Examiner(s): TRAN, PHUC H
• Application Number:
  US13/030,603
• Publication Number:
  US 20120213082A1
• Time in Patent Office: 1,131 Days
• Field of Search: 370/328, 370350-353
• US Class Current: 370/353
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04M 2207/20 hybrid systems
• CPC Class Codes: H04M 3/436 Arrangements for screening incoming calls , i.e. evaluating the characteristics of a call before deciding whether to answer it based on the calling party profile H04M3/42059; based on location H04M3/42348; based on presence H04M3/42365; diversion H04M3/54

Abstract

Call spoofing in a Voice over Internet Protocol (IP) system may be detected and/or prevented. A device may receive a call request to initiate a VoIP call. The device may analyze marker information in the call request to determine whether the call request is valid. The device may also analyze the call request, based on call pattern information of a quantity of other calls, to determine whether the call request is suspicious; and complete the call based on the determination of whether the call request is valid and the determination of whether the call request is suspicious.

Claims

1. A network device-implemented method, comprising:

receiving, by the network device, a call request to initiate a voice over Internet Protocol (VoIP) call, the call request being issued by a computing device on behalf of a calling party that is placing a call between a telephone device of the calling party, that is different than the computing device, and a telephone device of the called party;

analyzing, by the network device, marker information in the call request to determine whether the call request, issued by the computing device on behalf of the calling party, was validly issued by the computing device;

analyzing, by the network device, the call request, based on call pattern information of a quantity of other calls, to determine whether the call request is suspicious; and

initiating, by the network device, completion of the call based on the determination of whether the call request was validly issued and the determination of whether the call request is suspicious.

2. The method of claim 1, where analyzing the marker information further includes:

determining whether a digital signature in the call request is valid.

3. The method of claim 2, where the digital signature is based on a private key embedded in hardware of the computing device that issued the call request.

4. The method of claim 1, where analyzing the marker information further includes:

decrypting the call request using a symmetric encryption technique and a key associated with the computing device that issued the call request.

5. The method of claim 1, where analyzing the marker information further includes:

determining whether a progressive code in the call request is valid.

6. The method of claim 1, where analyzing the marker information further includes:

extracting substitution characters from the call request message; and

determining whether the substitution characters are valid.

7. The method of claim 1, where the call pattern information is determined from historical call data made by users.

8. The method of claim 1, where analyzing the call request further includes:

determining whether the called number of the call request is a suspicious number based on a comparison of a number of recent calls made to the number, by a plurality of users, to a threshold value.

9. The method of claim 1, further comprising:

calling back a telephone number of a user associated with a computing device that issued the call request; and

prompting the user to verify that the call request is valid.

10. The method of claim 1, further comprising:

forwarding the call request to a human operator for validation of the call request.

11. The method of claim 1, further comprising:

logging the call request when the call request is determined to be suspicious.

12. A non-transitory computer-readable medium containing programming instructions for execution by one or more processors, the programming instructions including:

instructions to receive a call request to initiate a voice over Internet Protocol (VoIP) call, the call request being issued by a computing device on behalf of a calling party that is placing a call between a telephone device of the calling party, that is different than the computing device, and a telephone device of the called party;

instructions to analyze marker information in the call request, issued by the computing device on behalf of the calling party, to determine whether the call request was validly issued by the computing device;

instructions to analyze the call request based on call pattern information of a quantity of other calls, to determine whether the call request is suspicious; and

instructions to initiate completion of the call based on the determination of whether the call request was validly issued and the determination of whether the call request is suspicious.

13. The non-transitory computer-readable medium of claim 12, where the instructions to analyze the marker information further include:

instructions to determine whether a digital signature in the call request is valid;

instructions to decrypt the call request using a symmetric encryption technique and a key associated with a computing device that issued the call request;

instructions to determine whether a progressive code in the call request is valid;

or

instructions to extract substitution characters from the call request and determine whether the substitution characters are valid.

14. The non-transitory computer-readable medium of claim 12, where the call pattern information is determined from historical call data made by users.

15. The non-transitory computer-readable medium of claim 12, where the instructions to analyze the call request based on call pattern information further include:

instructions to determine whether the called number of the call request is a suspicious number based on a comparison of a number of recent calls made to the called number, by a plurality of users, to a threshold value.

16. A network server comprising:

one or more processors; and

one or more memories, coupled to the one or more processors, the one or more memories storing instructions, that when executed by the one or more processors, cause the one or more processors to;

receive a call request, from a computing device, to initiate a voice over Internet Protocol (VoIP) call between a calling telephone number and a called telephone number, the call request being issued by the computing device on behalf of a calling party that is placing a call between a telephone device of the calling party, that is different than the computing device, and a telephone device of the called party;

analyze information contained in the call request to determine whether the call request, issued by the computing device on behalf of the calling party, was validly issued by the computing device;

analyze call pattern information of a quantity of other calls issued by the computing device and other computing devices, to determine whether the call request is suspicious; and

initiate completion of the call between the calling telephone number and the called telephone number based on the determination of whether the call request was validly issued and the determination of whether the call request is suspicious.

17. The network server of claim 16, where the network server presents a web interface to the computing device.

18. The network server of claim 16, where the computing device includes a set-top box.

19. The network server of claim 16, where, when analyzing the information contained in the call request, the one or more processors additionally:

determine whether a digital signature in the call request is valid;

decrypt the call request using a symmetric encryption technique and a key associated with a computing device that issued the call request;

determine whether a progressive code in the call request is valid;

or

extract substitution characters from the call request and determine whether the substitution characters are valid.

20. The network server of claim 16, where the call pattern information is determined from historical call data made by users.

21. The network server of claim 16, where, when analyzing the call pattern information, the one or more processors additionally:

determine whether the called telephone number is a suspicious number based on a comparison of a number of recent calls made to the called telephone number, by a plurality of users, to a threshold value.

22. The network server of claim 16, where the one or more processors additionally:

call back a telephone number of a user associated with the computing device; and

prompt the user to verify that the call request is valid.