Utilizing SIP messages to determine the status of a remote terminal in VOIP communication systems

• US 9,866,683 B1
• Filed: 03/13/2017
• Issued: 01/09/2018
• Est. Priority Date: 11/23/2016
• Status: Active Grant

• Current Assignee: Global Tel-Link Corporation
• Original Assignee: Global Tel-Link Corporation
• Inventors: Hodge, Stephen, Gonzalez, Eric
• Primary Examiner(s): Nguyen, Quynh
• Application Number:
  US15/457,823
• Time in Patent Office: 302 Days
• Field of Search: 379188, 379200, 379249, 370259, 370352
• CPC Class Codes: H04L 2101/38 Telephone uniform resource identifier [URI]
• CPC Class Codes: H04L 2101/385 Uniform resource identifier for session initiation protocol [SIP URI]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04L 65/1045 Proxies, e.g. for session initiation protocol [SIP]
• CPC Class Codes: H04L 65/1046 Call controllers; Call servers
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 65/403 Arrangements for multi-party communication, e.g. for conferences data switching systems for conference H04L12/18; arrangements for connecting several subscribers to a common circuit, i.e. affording conference facilities H04M3/56; television conferencing systems H04N7/15
• CPC Class Codes: H04L 65/65 Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]
• CPC Class Codes: H04M 2203/6027 Fraud preventions
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 3/42102 Making use of the called party identifier
• CPC Class Codes: H04M 3/428 Arrangements for placing incoming calls on hold
• CPC Class Codes: H04M 3/54 Arrangements for diverting calls for one subscriber to another predetermined subscriber based on the calling party profile H04M3/42059; based on location H04M3/42348; based on presence H04M3/42365; to voice mail H04M3/53308
• CPC Class Codes: H04M 3/56 Arrangements for connecting several subscribers to a common circuit, i.e. affording conference facilities video conference systems H04N7/15
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention

Abstract

There is a growing problem in correctional facility telecommunications systems in which parties on a voice call may connect inmate callers with restricted parties. Prison communication systems monitor calls to prevent such activity, but in Voice over Internet Protocol (VoIP) environments such systems may fail to detect this activity. The present disclosure provides details of a system and method for using SIP messages common in VoIP environments to detect illicit activity initiated by a party on a voice call within a controlled environment. Scenarios are detected in which a called party connects an inmate caller to a restricted party via three-way call conferencing, call forwarding, or other call features. Corrective actions are then taken when such activity is detected, such as call blocking or alerting officials illicit activity is occurring.

Claims

1. A method for detecting fraudulent activity in a communication system serving a correctional facility, comprising:

receiving a packet stream associated with a voice call utilizing voice over internet protocol (VoIP) between an inmate call party and an outside call party, the packet stream including a session initiation protocol (SIP) message stream;

determining a call phase of the voice call based on the packet stream, wherein the call phase is one of a call setup phase and a call established phase, the call established phase occurring after a successful end of the call setup phase;

flagging a first SIP message from within the SIP message stream as requiring further investigation, wherein the determining that the first SIP message requires further investigation includes;

determining, during the call setup phase, that a message type associated with the first SIP message is one of a 181 Response or a 3xx Response, wherein 3xx in the 3xx Response represents an integer between 300 and 399;

or

determining, during the call established phase, that the message type is one of an INVITE or a REFER; and

in response to the flagging that the first SIP message requires further investigation, confirming that a disallowed third party has joined the voice call based at least in part on a first content of the first SIP message or a second content of a second SIP message, the second SIP message appearing after the first SIP message within the SIP message stream.

2. The method of claim 1, wherein the call established phase begins when a real-time transport protocol (RTP) packet stream appears within the packet stream.

3. The method of claim 1, wherein the message type is 181 Response and the second content comprises a header information field including a SIP universal resource identifier (SIP-URI), and wherein the confirming is based on the SIP-URI being on a block list for the inmate call party.

4. The method of claim 1, wherein the message type is 181 Response and the second content comprises a header information field including a telephone number, and wherein the confirming is based on the telephone number being on a block list for the inmate call party.

5. The method of claim 1, wherein the message type is 3xx Response and the first content comprises a header information field including a SIP universal resource identifier (SIP-URI), and wherein the confirming is based on the SIP-URI being on a block list for the inmate call party.

6. The method of claim 1, wherein the message type is 3xx Response and the first content comprises a header information field including a telephone number, and wherein the confirming is based on the telephone number being on a block list for the inmate call party.

7. The method of claim 1, wherein the message type is INVITE and the first content comprises a header information field, and wherein the confirming is based on the header information field containing an “

isfocus”

indication.

8. The method of claim 1, wherein the message type is INVITE and the first content comprises a session data protocol (SDP) information section, and wherein the confirming is based on the SDP information section including an “

a=sendonly”

indication or an “

a=recvonly”

indication.

9. The method of claim 1, further comprising detecting that a fraudulent activity has occurred based on an absence of real-time transport protocol (RTP) packets in the packet stream during the call established phase for a time longer than a pre-determined threshold.

10. The method of claim 1, further comprising detecting that a fraudulent activity has occurred based on a presence of silence insertion description (SID) packets in the packet stream during the call established phase for a time longer than a pre-determined threshold.

11. The method of claim 1, wherein the message type of the first SIP message is REFER and the first content includes a “

refer-to”

header information field including a SIP universal resource identifier (SIP-URI) or a telephone number, and wherein the confirming is based on the SIP-URI or the telephone number being on a block list for the inmate call party.

12. The method of claim 1, further comprising:

in response to the flagging that the first SIP message requires further investigation, sending a suspected infraction log to a jail management server; and

in response to the confirming;

sending a confirmed infraction log to the jail management server, the confirmed infraction log including an infraction type that is at least one of “

call forwarding”

, “

call hold”

, and “

call forwarding”

; and

triggering a corrective action.

13. A method for detecting fraudulent activity in a communication system in a correctional facility, comprising:

receiving a packet stream associated with a voice call utilizing voice over internet protocol (VoIP) between an inmate call party and an outside call party, the packet stream including a session initiation protocol (SIP) message stream;

determining a call phase of the voice call, wherein the call phase is one of a call setup phase and a call established phase, the call established phase occurring after a successful end of the call setup phase;

detecting that a message type associated with a first SIP message from the SIP message stream is one of a 181 Response or a 3xx Response during the call setup phase, or that the message type is one of an INVITE or a REFER during the call established phase, wherein 3xx in the 3xx Response represents an integer between 300 and 399;

flagging that the first SIP message requires further investigation based on the detecting; and

in response to the flagging that the first SIP message requires further investigation, confirming that a disallowed third party has joined the voice call based at least on a first content associated with the first SIP message or a second content associated with a second SIP message from the SIP message stream, the second SIP message appearing after the first SIP message within the SIP message stream.

14. The method of claim 13, wherein the call established phase begins when a real-time transport protocol (RTP) packet stream appears within the packet stream.

15. The method of claim 13, wherein the message type is 181 Response and the second content comprises a header information field including a SIP universal resource identifier (SIP-URI) or a telephone number, and wherein the confirming is based on the SIP-URI or the telephone number being on a block list for the inmate call party.

16. The method of claim 13, wherein the message type is 3xx Response and the first content comprises a header information field including a SIP universal resource identifier (SIP-URI) or a telephone number, and wherein the confirming is based on the SIP-URI or the telephone number being on a block list for the inmate call party.

17. The method of claim 13, wherein the message type is INVITE and the first content comprises a header information field, and wherein the confirming is based on the header information field containing an “

isfocus”

indication.

18. The method of claim 13, wherein the message type is INVITE and the first content comprises a session data protocol (SDP) information section, and wherein the confirming is based on the SDP information section including an “

a=sendonly”

indication or an “

a=recvonly”

indication.

19. A monitoring and detection system, comprising:

a memory that stores a block list for an inmate call party;

a network interface configured to receive a packet stream associated with a voice call utilizing voice over internet protocol (VoIP) between the inmate call party and an outside call party, the packet stream including a session initiation protocol (SIP) message stream; and

a processor, configured to;

determine a call phase of the voice call based on the SIP message stream, wherein the call phase is one of a call setup phase and a call established phase, the call established phase occurring after a successful end of the call setup phase;

flag a first SIP message from within the SIP message stream as requiring further investigation, wherein the flagging that the first SIP message requires further investigation includes;

determining, during the call setup phase, that a message type associated with the first SIP message is one of a 181 Response or a 3xx Response, wherein 3xx in the 3xx Response represents an integer between 300 and 399;

or

determining, during the call established phase, that the message type is one of an INVITE or a REFER; and

in response to the flagging that the first SIP message requires further investigation, confirm that a disallowed third party has joined the voice call based at least in part on a first content of the first SIP message or a second content of a second SIP message, the second SIP message appearing after the first SIP message within the SIP message stream.

20. The system of claim 19, wherein the message type is 181 Response and the second content comprises a header information field including a SIP universal resource identifier (SIP-URI) or a telephone number, and wherein the confirming is based on the SIP-URI or the telephone number being on the block list for the inmate call party.

21. The system of claim 19, wherein the message type is 3xx Response and the first content comprises a header information field including a SIP universal resource identifier (SIP-URI) or a telephone number, and wherein the confirming is based on the SIP-URI or the telephone number being on the block list for the inmate call party.

22. The system of claim 19, wherein the message type is INVITE and the first content comprises a header information field, and wherein the confirming is based on the header information field containing an “

isfocus”

indication.

23. The system of claim 19, wherein the message type is INVITE and the first content comprises a session data protocol (SDP) information section, and wherein the confirming is based on the SDP information section including an “

a=sendonly”

indication or an “

a=recvonly”

indication.

24. The system of claim 19, wherein the processor is further configured to detect that a fraudulent activity has occurred based on an absence of real-time transport protocol (RTP) packets in the packet stream during the call established phase for a time longer than a pre-determined threshold.

25. The system of claim 19, wherein the processor is further configured to detect that a fraudulent activity has occurred based on a presence of silence insertion description (SID) packets in the packet stream during the call established phase for a time longer than a pre-determined threshold.

26. A monitoring and detection system, comprising:

a memory that stores a block list for an inmate call party;

a network interface configured to receive a packet stream associated with a voice call utilizing voice over internet protocol (VoIP) between the inmate call party and an outside call party, the packet stream including a session initiation protocol (SIP) message stream; and

a processor, coupled to the network interface, configured to;

determine a call phase of the voice call, wherein the call phase is one of a call setup phase and a call established phase, the call established phase occurring after a successful end of the call setup phase;

detect that a message type associated with a first SIP message from the SIP message stream is one of a 181 Response or a 3xx Response during the call setup phase or that the message type is one of an INVITE or a REFER during the call established phase, wherein 3xx in the 3xx Response represents an integer between 300 and 399;

flag the first SIP message as requiring further investigation based on the detecting; and

in response to the flagging that the first SIP message requires further investigation, confirm that a disallowed third party has joined the voice call based at least on a first content associated with the first SIP message or a second content associated with a second SIP message from the SIP message stream, the second SIP message appearing after the first SIP message within the SIP message stream.

27. The system of claim 26, wherein the message type is 181 Response and the second content comprises a header information field including a SIP universal resource identifier (SIP-URI) or a telephone number, and wherein the confirming is based on the SIP-URI or the telephone number being on the block list for the inmate call party.

28. The system of claim 26, wherein the message type is 3xx Response and the first content comprises a header information field including a SIP universal resource identifier (SIP-URI) or a telephone number, and wherein the confirming is based on the SIP-URI or the telephone number being on the block list for the inmate call party.

29. The system of claim 26, wherein the message type is INVITE and the first content comprises a header information field, and wherein the confirming is based on the header information field containing an “

isfocus”

indication.

30. The system of claim 26, wherein the message type is INVITE and the first content comprises a session data protocol (SDP) information section, and wherein the confirming is based on the SDP information section including an “

a=sendonly”

indication or an “

a=recvonly”

indication.