Mediation of open advanced intelligent network in SS7 protocol open access environment

• US 5,701,301 A
• Filed: 06/06/1994
• Issued: 12/23/1997
• Est. Priority Date: 06/28/1993
• Status: Expired due to Term

• Current Assignee: Bellsouth Intellectual Property Corporation (AT&T, Inc.)
• Original Assignee: BellSouth Corporation (AT&T, Inc.)
• Inventors: Weisser, Frank J. Jr.
• Primary Examiner(s): TON, DANG T
• Application Number:
  US08/254,590
• Time in Patent Office: 1,296 Days
• Field of Search: 370/60, 370/94.1, 370/60.1, 370/14, 370/110.1, 370/79, 370/352, 370/360, 370/387, 370/386, 370/384, 370/389, 370/395, 370/442, 370/425, 370/428, 370/465, 379/201, 379/113, 379/207, 379/211, 379/67, 379/96, 379/89, 379/221, 379/138, 379/112, 379/134, 379/242, 379/230, 379/2, 379/95, 379/229, 379/220, 340/825.3, 340/825.31, 340/825.32, 340/825.33, 340/825.34, 395/186
• US Class Current: 370/428
• CPC Class Codes: H04M 3/4228 in networks
• CPC Class Codes: H04Q 2213/13515 authentication, authorisation - fraud prevention
• CPC Class Codes: H04Q 2213/13522 traffic management
• CPC Class Codes: H04Q 2213/13526 resource management
• CPC Class Codes: H04Q 2213/13533 multivendor and hybrid, e.g. public/private, networks, inc. international
• CPC Class Codes: H04Q 2213/13541 routing
• CPC Class Codes: H04Q 2213/13561 congestion - inc. overflow
• CPC Class Codes: H04Q 2213/13566 mediation
• CPC Class Codes: H04Q 3/0045 involving hybrid, i.e. a mixture of public and private, or multi-vendor systems

Abstract

A method of mediation of data packet traffic across an interface between the Advanced Intelligent Network (AIN) operated by a local exchange carrier and a non-local exchange carrier service provider is disclosed. The interface is defined between a service provider'"'"'s network device, such as a service control point (SCP), that has access to the AIN through SS7 protocol data links connected to a local exchange carrier device, such as a service transfer point (STP). Gateway screening at the STP is used to perform certain mediation steps with respect to data packets that originate with non-local exchange carrier network elements. An invalid data packet is rejected, but a valid data packet is passed for further mediation steps to a mediated access SCP. Prior to further routing of the data packet (other than rejection), the mediated access SCP removes information from the data packet regarding the source of the data packet. The mediated access SCP stores this removed information, generates substitute information, correlates the removed information with the substitute information, and replaces the removed information in the data packet with substitute information. The mediated access SCP examines the responsive data packet upon receipt for inclusion of the substitute information. If the responsive data packet does not include this substitute information, the data packet is rejected. If the responsive data packet includes the substitute information, and is otherwise valid, mediated access SCP correlates the substitute information to the removed information, and uses the removed information to further route the data packet.

Claims

1. A method for preventing unauthorized transmission of data packet messages between a service provider service control point (SP-SCP) and an intelligent switched telephone network, said network including a plurality of digital data communications channels among a plurality of intelligent switched network elements including at least one signal transfer point (STP) and at least one mediated access service control point (MA-SCP), said MA-SCP being connected to said STP, comprising the steps of:

receiving a message in said STP;

transmitting said message from said STP to said MA-SCP; and

mediating said message in said MA-SCP, wherein said MA-SCP includes at least one database containing customer records, wherein said message comprises a first transaction number, and wherein said step of mediating said message in said MA-SCP comprises;

storing a transaction identifier for said message in said database;

generating a second transaction number for said message;

associating said second transaction number with said first transaction identifier in said database;

removing said first transaction number from said message; and

adding said second transaction number to said message.

2. The method of claim 1, further comprising the step of:

prior to storing said transaction identifier, reading said message for message information;

comparing said message information for correspondence with at least one customer record in said database; and

rejecting said message if said message information fails to correspond to said customer record.

3. The method of claim 1, wherein said transaction identifier includes said first transaction number, an originating point code of said message, and a subsystem number of said message, and wherein said step of storing said transaction identifier comprises storing said first transaction number, said originating point code and said subsystem number.

4. The method of claim 3, wherein said message comprises said first transaction number, said originating point code and said subsystem number, and wherein said step of removing said first transaction number comprises removing said first transaction number, said originating point code and said subsystem number from said message.

5. The method of claim 2, further comprising the step of storing said second transaction number in a list of active second transaction numbers in said database.

6. The method of claim 1, wherein said second transaction number is an unassigned random number, and wherein said step of generating said second transaction number comprises generating said unassigned random number as said second transaction number.

7. A method for preventing unauthorized transmission of data packet messages between a service provider service control point (SP-SCP) and an intelligent switched telephone network, said network including a plurality of elements including at least one signal transfer point (STP) and at least one mediated access service control point (MA-SCP), said MA-SCP being connected to said STP, comprising the steps of:

receiving a message in said STP;

transmitting said message from said STP to said MA-SCP; and

mediating said message in said MA-SCP, wherein said MA-SCP includes at least one database containing customer records, and wherein said step of mediating said message in said MA-SCP comprises;

determining whether said message includes a transaction number;

if said message includes said transaction number, comparing said transaction number for correspondence to a list of active transaction numbers stored in said database; and

rejecting said message if said transaction number fails to correspond to an entry in said list of active transaction numbers.

8. The method of claim 7, further comprising the steps of:

if said transaction number corresponds to an entry in said list of active transaction numbers, obtaining destination information from said entry; and

routing said message on the basis of said destination information.

9. A method for preventing unauthorized transmission of data packet messages between a service provider service control point (SP-SCP) and an intelligent switched telephone network, said network including a plurality of digital data communications channels among a plurality of intelligent switched network elements including at least one signal transfer point (STP) and at least one mediated access service control point (MA-SCP), said MA-SCP being connected to said STP, comprising the steps of:

receiving a message in said STP;

transmitting said message from said STP to said MA-SCP; and

mediating said message in said MA-SCP, wherein said message is a response message received from said SP-SCP in response to a query message, and wherein said step of mediating said message in said MA-SCP comprises;

determining whether said response message includes an originating point code;

if said response message includes said originating point code, tempting said originating point code for correspondence to a destination point code associated with said query message; and

rejecting said message if said originating point code fails to correspond to said destination point code.

10. A method for preventing unauthorized transmission of data packet messages between a service provider service control point (SP-SCP) and an intelligent switched telephone network, said network including a plurality of elements including at least one mediated access service control point (MA-SCP), comprising the steps of:

receiving a message in said MA-SCP; and

mediating said message in said MA-SCP;

by;

reading said message for message information from the Advanced Intelligent Network (AIN) potion of said message,

comparing said message information from said AIN portion of said message for correspondence to at least one record in a database, and

rejecting said message if said message information fails to correspond to said at least one record in said database.

11. A method for preventing unauthorized transmission of data packet messages between a service provider service control point (SP-SCP) and an intelligent switched telephone network, said network including a plurality of elements including at least one signal transfer point (STP) and at least one mediated access service control point (MA-SCP), said MA-SCP being connected to said STP, comprising the steps of:

receiving a message in said STP;

transmitting said message from said STP to said MA-SCP;

mediating said message in said MA-SCP;

determining whether said message has passed mediation in said MA-SCP;

if said message has passed mediation in said MA-SCP, determining whether said SP-SCP is out-of-service; and

if said SP-SCP is out-of-service, then rejecting said message and providing said message with a default response.

12. The method of claim 11, wherein said message comprises a request for a particular service provider service, and wherein said step of determining whether said SP-SCP is out-of-service comprises determining whether said particular service provider service is out-of-service;

and

if said particular service provider service is out-of-service, then rejecting said message and providing said message with said default response.

13. The method of claim 11, further comprising the steps of:

testing said out-of-service SP-SCP; and

if said out-of-service SP-SCP properly responds to said testing, reclassifying said out-of-service SP-SCP as an in-service SP-SCP.

34. The method of claim 13, wherein said step of testing said out-of-service service control point comprises sending said out-of-service SP-SCP a test message.

35. The method of claim 34, wherein said step of testing said out-of-service service control point comprises sending said out-of-service SP-SCP a test message on a periodic basis.

14. A method for preventing unauthorized transmission of data packet messages between a service provider service control point (SP-SCP) and an intelligent switched telephone network, said network including a plurality of digital data communications channels among a plurality of intelligent switched network elements including at least one signal transfer point (STP) and at least one mediated access service control point (MA-SCP), said MA-SCP being connected to said STP, comprising the steps of:

receiving a message in said STP, wherein said message comprises an originating point code and wherein said STP has a port identifier for each authorized provider of messages to said STP;

determining whether said message originates with said SP-SCP;

if said message originates with said SP-SCP, then initially mediating said message in said STP by comparing said originating point code for correspondence with at least one port identifier and rejecting said message if said originating point code fails to correspond to any of said port identifiers;

transmitting said message from said STP to said MA-SCP; and

mediating said message in said MA-SCP.

15. A method for preventing unauthorized transmission of data packet messages between a service provider service control point (SP-SCP) and an intelligent switched telephone network, said network including a plurality of digital data communications channels among a plurality of intelligent switched network elements including at least one signal transfer point (STP) and at least one mediated access service control point (MA-SCP), said MA-SCP being connected to said STP, comprising the steps of:

receiving a message in said STP, wherein said message comprises a destination code and wherein said STP has at least one authorized address designating an authorized destination for messages for each authorized provider of messages to said STP;

determining whether said message originates with said SP-SCP;

if said message originates with said SP-SCP, then initially mediating said message in said STP by comparing said destination code for correspondence with at least one authorized address and rejecting said message if said destination code fails to correspond to any of said authorized addresses;

transmitting said message from said STP to said MA-SCP; and

mediating said message in said MA-SCP.

16. The method of claim 15, wherein one of said authorized addresses comprises the address of said MA-SCP, wherein said step of comparing comprises comparing said destination code for correspondence with said address of said MA-SCP, and wherein said step of rejecting comprises rejecting said message if said destination code fails to correspond to said address of said MA-SCP.

17. A method for preventing unauthorized transmission of data packet messages between a service provider service control point (SP-SCP) and an intelligent switched telephone network, said network including a plurality of digital data communications channels among a plurality of intelligent switched network elements including at least one signal transfer point (STP) and at least one mediated access service control point (MA-SCP), said MA-SCP being connected to said STP, comprising the steps of:

receiving a message in said STP, wherein said message comprises a service indicator, and wherein said STP has at least one service indicator designating an authorized service for each authorized provider of messages to said STP;

determining whether said message originates with said SP-SCP;

if said message originates with said SP-SCP, then initially mediating said message in said STP by comparing said service indicator for correspondence with at least one authorized service indicator and rejecting said message if said service indicator fails to correspond to any of said authorized service indicators;

transmitting said message from said STP to said MA-SCP; and

mediating said message in said MA-SCP.

18. A method of mediating traffic in packet messages in an intelligent switched telephone network that includes a plurality of digital data communications channels among a plurality of network elements, comprising the steps of:

causing a first one of said plurality of network elements that originates a new transaction capabilities application part (TCAP) message to generate a first transaction number for each said new TCAP message;

causing said first network element to include said first transaction number said TCAP message prior to said first network element transmitting said TCAP message to a second one of said plurality of network elements;

causing said second network element to create a unique transaction identifier for association with said TCAP message;

causing said second network element to generate a second transaction number for said TCAP message;

causing said second network element to delete said first transaction number from said TCAP message;

causing said second network clement prior to said network element transmitting said TCAP message to another destination to include said second transaction number said TCAP message; and

causing said network elements to thereafter reject other TCAP messages that effect the particular transaction associated with said TCAP message but that do not contain said second transaction number in said other TCAP messages.

19. The method of claim 18, further comprising the step of:

causing said first network element to store said first transaction number in a transaction identifier table.

20. The method of claim 18, further comprising the steps of:

causing said second network element to store said unique transaction identifier in a transaction identifier table; and

causing said second network element to store said second transaction number in said transaction identifier table in association with said unique transaction identifier.

21. The method of claim 18, wherein said step of causing said first network element to include said first transaction number comprises causing said first network element to include said first transaction number and a first message identifier in said TCAP message.

22. The method of claim 18, wherein said TCAP message comprises an originating point code and a subsystem number, and wherein said step of causing said second network element to create said unique transaction identifier comprises causing said second network element to create said unique transaction identifier by concaterating said first transaction number with said originating point code and said subsystem number.

23. The method of claim 22, wherein said step of causing said second network element to delete said first transaction number comprises causing said second network element to delete said first transaction number, said originating point code and said subsystem number from said TCAP message.

24. A method of mediating traffic in packet messages between a service provider service control point (SP-SCP) and an intelligent switched telephone network that includes a plurality of digital data communications channels among a plurality of network elements including a plurality of service switching points, at least one mediated access service control point (MA-SCP) and at least one signal transfer point (STP), comprising the steps of:

causing said SP-SCP to generate a first transaction number for each new message that said SP-SCP originates;

causing said SP-SCP to include said first transaction number in said message prior to said SP-SCP transmitting said message to one of said plurality of network elements;

after said network element receives said message, causing said network element to create a unique transaction identifier for association with said message;

causing said network element to generate a second transaction number for said message;

causing said network element to store said second transaction number in association with said unique transaction identifier;

causing said network element to delete said first transaction number from of said message;

causing said network element to add said second transaction number to said message; and

causing said SP-SCP and said network elements thereafter to include said second transaction number in other messages affecting the particular transaction associated with said message and to reject said other messages that do not include said second transaction number.

25. The method of claim 24, wherein said message comprises an originating point code, wherein said network element has a port identifier for each authorized provider of messages to said network element, and further comprising the steps of:

causing said network element to compare said originating point code for correspondence with a port identifier;

causing said network element to reject said message if said originating point code fails to correspond to any of said port identifiers.

26. The method of claim 24, wherein said message comprises a destination code, wherein said network element has at least one authorized address designating an authorized destination for messages for each authorized provider of messages to said network element, and further comprising the steps of:

causing said network element to compare said destination code for correspondence with at least one authorized address;

causing said network element to reject said message if said destination code fails to correspond to any of said authorized addresses.

27. The method of claim 24, wherein said message comprises a service indicator, wherein said network element has at least one service indicator designating an authorized service for each authorized provider of messages to said network elements, and further comprising the steps of:

causing said network element to compare said service indicator for correspondence with at least one authorized service indicator;

causing said network element to reject said message if said service indicator fails to correspond to said authorized service indicator.

28. A method of mediating traffic in data packet messages between a service provider service control point (SP-SCP) and an intelligent switched telephone network including a signal transfer point (STP) and a mediated access service control point (MA-SCP), comprising the steps of:

providing that said SP-SCP be allowed to use only particular trunk group routings of said network with respect to use of said network by said SP-SCP;

causing said MA-SCP to maintain a table of legal trunk group indices for said SP-SCP, said legal trunk group indices representing said particular trunk group routings which may be used by said SP-SCP;

receiving a message associated with said SP-SCP in said STP;

transmitting said message from said STP to said MA-SCP;

in response to said MA-SCP receiving said message associated with said SP-SCP wherein said message includes a request for a trunk group routing, causing said MA-SCP to check said table for an entry corresponding to said trunk group routing; and

causing said MA-SCP to reject said message if said trunk group routing fails to correspond to any entry in said table.

29. A method of mediating traffic in data packet messages between a service provider service control point (SP-SCP) and an intelligent switched telephone network including a mediated access service control point (MA-SCP), comprising the steps of:

providing that said SP-SCP has authorized access to a plurality of network elements of said network;

causing said MA-SCP to maintain a table of authorized directory numbers of network elements for said SP-SCP, each of said authorized directory numbers representing a network element of said plurality of network elements to which said SP-SCP has said authorized access;

receiving a message associated with said SP-SCP in said STP;

transmitting said message from said STP to said MA-SCP;

in response to said MA-SCP receiving said message associated with said SP-SCP wherein said message includes a request for access to a particular network element and includes a directory number for said particular network element, causing said MA-SCP to check said table for said directory number of said particular network element; and

causing said MA-SCP to reject said message if said directory number of said particular network element fails to correspond to an entry in said table.

30. A method of mediating traffic in data packet messages between a service provider service control point (SP-SCP) and an intelligent switched telephone network including a mediated access service control point (MA-SCP), comprising the steps of:

causing said MA-SCP to maintain a permitted limited network resource occupancy number for said SP-SCP with respect to the use of limited network resources of said network, said limited network resources comprising audio connection devices;

causing said MA-SCP to maintain a current count of each limited network resource occupied by said SP-SCP within a preselected period;

receiving a message associated with said SP-SCP in said STP;

transmitting said message from said STP to said MA-SCP;

in response to said MA-SCP receiving said message associated with said SP-SCP wherein said message includes a request for use of a limited network resource, causing said MA-SCP to check said current count; and

causing said MA-SCP to reject said message if said current count is equal to or greater than said permitted resource occupancy number.

31. A method of mediating traffic in data packet message between a service provider service control point (SP-SCP) and an intelligent switched telephone network including a mediated access service control point (MA-SCP), comprising the steps of:

causing said MA-SCP to maintain a current count of each default treatment provided within a preselected period by said MA-SCP with respect to messages directed to said SP-SCP; and

if said current count is equal to or exceeds a preselected count of default treatment to be provided to messages directed to said SP-SCP, causing said MA-SCP to reduce the number of messages provided to said SP-SCP.

32. The method of claim 31, wherein said step of causing said MA-SCP to reduce the number of messages comprises causing said MA-SCP to reject the next message directed to said SP-SCP.

33. The method of claim 31, wherein said network includes at least one service switching point (SSP) servicing said SP-SCP, and wherein said step of causing said MA-SCP to reduce the number of messages comprises causing said MA-SCP to send an automatic cell gapping message to said SSP.

36. A method of managing mediated traffic in data packet messages between an out-of-service service provider service control point (SP-SCP) and an intelligent switched telephone network including a mediated access service control point (MA-SCP), comprising the steps of:

classifying a SP-SCP as said out-of-service SP-SCP;

causing said MA-SCP to send said out-of-service SP-SCP an Advanced Intelligent Network (AIN) test message; and

if said out-of-service SP-SCP correctly responds to said AIN test message, causing said MA-SCP to classify said out-of-service SP-SCP as an in-service SP-SCP.

37. The method of claim 36, wherein said step of sending said out-of-service service control point an AIN test message comprises sending said out-of-service SP-SCP an AIN test message on a periodic basis.

38. A method of managing mediated traffic in data packet messages between a service provider service control point (SP-SCP) and an intelligent switched telephone network including a mediated access service control point (MA-SCP), comprising the steps of:

causing said MA-SCP to recognize an auditable event with respect said mediated traffic in data packet messages between said SP-SCP and said MA-SCP wherein said auditable event comprises an invalid attempt to establish a transaction, an invalid attempt to access data or a change to a security process configuration; and

causing said MA-SCP to create an audit trail for said auditable event.

39. A method of managing mediated traffic in data packet messages between a service provider service control point (SP-SCP) and an intelligent switched telephone network including a mediated access service control point (MA-SCP), comprising the steps of:

causing said MA-SCP to recognize an auditable event with respect to said mediated traffic in data packet messages between said SP-SCP and said MA-SCP, wherein said auditable event involves a message, and

causing said MA-SCP to create an audit trail for said auditable event, wherein said audit trail comprises the date, the time, the trigger type and the triggering destination number of said message and a copy of said message, and wherein said step of causing said MA-SCP to create an audit trail for said auditable event comprises causing said MA-SCP to create said audit trail including said data, said time, said trigger type and said triggering destination of said message and said copy of said message.

40. A method of managing mediated traffic in data packet messages between a service provider service control point (SP-SCP) and a plurality of network elements in an intelligent switched telephone network, comprising the steps of:

causing a mediated access service control point (MA-SCP) to attach a security audit request parameter to a message received from the SP-SCP; and

in response to receipt of said message including said security audit request parameter at one of said plurality of network elements, causing said one of said plurality of said network elements to turn on a security parameter for said message.

41. The method of claim 40, further comprising the step of:

in response to receipt of said message including said security audit request parameter at any other one of said plurality of network elements causing said any other network element to include said security parameter with other messages that affect the particular transaction associated with said message.

42. A method for preventing unauthorized access of data packet messages from a service provider service control point (SP-SCP) to an intelligent switched telephone network, said network including a plurality of digital data communications channels among a plurality of intelligent switched network elements including at least one signal transfer point (STP) and at least one mediated access service control point MA-SCP), said MA-SCP being connected to said STP, comprising the steps of:

receiving a message in said STP from said SP-SCP;

transmitting said message from said STP to said MA-SCP; and

mediating said message in said MA-SCP by examination by said MA-SCP of the Advanced Intelligent Network (AIN) portion of said message, removing information from said AIN portion of said message, and adding substitute information to said AIN portion of said message.

43. In an intelligent switch telephone network, an apparatus for preventing unauthorized access of data packet messages from a service provider service control point (SP-SCP) in said network, said network including a plurality of digital data communication channels among a plurality of intelligent switched network elements including at least one signal transfer point (STP) and at least one mediated access service control point (MA-SCP), said MA-SCP being connected to said STP comprising:

a MA-SCP, said MA-SCP being operative to receive a message from said SP-SCP, said message including an Advanced Intelligent Network (AIN) portion, and

prior to further routing of said message in said network, said MA-SCP being further operative to mediate said message by examination of said AIN portion, by removing information from said AIN portion and by adding substitute information to said AIN portion.

44. The apparatus of claim 43, wherein said MA-SCP is further operative upon receipt of said message from said SP-SCP to read said message for message information, to compare said message information for correspondence with at least one record in a database, and to reject said message if said message information fails to correspond to said record in said database.

45. A method of managing mediated traffic in data packet messages between a service provider service control point (SP-SCP) and an intelligent switched telephone network including a mediated access service control point (MA-SCP), comprising the steps of:

causing said MA-SCP to recognize an auditable event with respect to said mediated traffic in data packet messages between said SP-SCP and said MA-SCP, wherein said auditable event involves a message, and

causing said MA-SCP to create an audit trail for said auditable event, wherein said audit trail comprises the date, the time, and a copy of said message, and wherein said step of causing said MA-SCP to create an audit trail for said auditable event comprises causing said MA-SCP to create said audit trail including said date, said time, and said copy of said message.

46. A method for preventing unauthorized access of data packet messages from a service provider service control point (SP-SCP) to an intelligent switched telephone network, said network including a plurality of digital data communications channels among a plurality of intelligent switched network elements at least one signal transfer point (STP) and at least one mediated access service control point (MA-SCP), said MA-SCP being connected to said STP, comprising the steps of:

receiving a message in said STP from said SP-SCP;

transmitting said message from said STP to said MA-SCP; and

mediating said message in said MA-SCP by examination by said MA-SCP of the Advanced Intelligent Network (AIN) portion of said message, wherein said examination includes a determination as to whether said AIN portion of said message includes valid or invalid parameters with respect to access to said network by said SP-SCP, and by rejection by said MA-SCP of said message if said MA-SCP determines that said AIN portion of said message includes said invalid AIN parameters.