Restriction of communication in VoIP address discovery system

• US 8,274,968 B2
• Filed: 06/30/2009
• Issued: 09/25/2012
• Est. Priority Date: 07/20/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Rosenberg, Jonathan David, Jennings, Cullen F.
• Primary Examiner(s): Scheibel, Robert
• Assistant Examiner(s): Mais, Mark A
• Application Number:
  US12/495,595
• Publication Number:
  US 20100002686A1
• Time in Patent Office: 1,183 Days
• Field of Search: 370351-354, 370/356, 370/386, 370/389, 370/392, 370/395.31, 370/395.52, 370/400, 370/401, 370/402, 370/494
• US Class Current: 370/353
• CPC Class Codes: H04L 61/4557 Directories for hybrid networks, e.g. including telephone numbers
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 65/1036 at the edge
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1076 Screening of IP real time communications, e.g. spam over Internet telephony [SPIT]
• CPC Class Codes: H04M 2203/551 Call history recording a computer conference H04L12/1831
• CPC Class Codes: H04M 3/5125 with remote located operators
• CPC Class Codes: H04M 3/5232 Call distribution algorithms
• CPC Class Codes: H04M 7/0057 Services where the data services network provides a telephone service in addition or as an alternative, e.g. for backup purposes, to the telephone service provided by the telephone services network
• CPC Class Codes: H04M 7/006 Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42
• CPC Class Codes: H04M 7/0063 where the network is a peer-to-peer network

Abstract

In one embodiment, a system is provided to restrict VoIP communication. The system may validate a Voice over Internet Protocol (VoIP) call initiation message based on demonstrated knowledge of a Public Switched Telephone Network (PSTN) call.

Claims

1. A system comprising:

a memory; and

a processor in communication with the memory, the memory including computer code executable with the processor, wherein the computer code is executable to;

receive, from an originating Voice over Internet Protocol (VoIP) call agent, proof of demonstrated knowledge of an attribute of a Public Switched Telephone Network (PSTN) call, the PSTN call received at a destination call agent, the attribute of the PSTN call demonstrating knowledge of the PSTN call; and

validate a VoIP call initiation message received from the originating VoIP call agent based on a determination that the proof of demonstrated knowledge of the attribute of the PSTN call is received from the originating VoIP call agent, wherein validation of the VoIP call initiation message indicates the VoIP call initiation message is an authorized request for a VoIP call.

2. The system of claim 1, wherein the computer code is further executable to generate an authorization ticket in response to the receipt of the proof of the demonstrated knowledge of the attribute of the PSTN call from the originating VoIP call agent, wherein the computer code executable to validate the VoIP call initiation message is executable to validate the VoIP call initiation message based on receipt of the authorization ticket from the originating VoIP call agent, and wherein the authorization ticket is also proof of demonstrated knowledge of the attribute of the PSTN call.

3. The system of claim 2, wherein the authorization ticket indicates a domain for which the authorization ticket is valid, and wherein the computer code executable to validate the VoIP call initiation message is further executable to verify the VoIP call initiation message originated from the domain.

4. The system of claim 3, wherein the computer code executable to verify the VoIP call initiation message originated from the domain is executable to determine an originating domain of the VoIP call initiation message from a public key certificate.

5. The system of claim 3, wherein the computer code executable to generate the authorization ticket is further executable to generate the authorization ticket in response to verification that the domain is included in a set of trusted domains.

6. The system of claim 3, wherein the computer code executable to generate the authorization ticket is further executable to generate the authorization ticket in response to verification that the domain is not found in a set of untrusted domains.

7. The system of claim 1, wherein the computer code executable to validate the VoIP call initiation message is further executable to verify the demonstrated knowledge based on a shared-secret based protocol, wherein the attribute of the PSTN call is a shared secret.

8. Logic encoded in one or more tangible non-transitory media for execution by a processor and when executed is operable to:

store knowledge of a call data of a Public Switched Telephone Network (PSTN) call initiated over a circuit switched network from an originating domain to a telephone phone number;

determine a destination address in a destination domain for the telephone phone number; and

transmit at least one message from the originating domain to the destination address in the destination domain over a network different from the circuit switched network, the at least one message operable to demonstrate the knowledge of the call data of the PSTN call for authorization to create a Voice over Internet Protocol (VoIP) connection from the originating domain to a destination call agent in the destination domain, wherein the authorization to create the VoIP connection is granted based on a match of the knowledge of the call data of the PSTN call at the destination domain.

9. The one or more tangible media of claim 8, wherein the logic when executed is also operable to receive an authorization ticket in response to a demonstration of the knowledge of the PSTN call.

10. The one or more tangible media of claim 9, wherein the authorization ticket includes an identifier of a domain for which the authorization ticket is valid, and the logic when executed is further operable to:

transmit the authorization ticket in a Voice over Internet Protocol (VoIP) connection request; and

transmit a public key certificate to demonstrate the VoIP connection request is transmitted from the domain.

11. The one or more tangible media of claim 8, wherein the knowledge of the call data of the PSTN call includes at least one of a start time of the PSTN call and an end time of the PSTN call.

12. The one or more tangible media of claim 8, wherein the logic when executed is also operable to verify an identifier of the destination call agent is in a list of identifiers of trusted entities.

13. The one or more tangible media of claim 8, wherein the logic when executed is also operable to verify an identifier of the destination call agent is not in a list of identifiers of untrusted entities.

14. A method comprising:

receiving, from an originating Voice over Internet Protocol (VoIP) call agent, proof of knowledge of an attribute of a Public Switched Telephone Network (PSTN) call, the PSTN call received at a destination call agent, the attribute of the PSTN call demonstrating knowledge of the PSTN call; and

validating, with a processor, a VoIP call initiation message received from the originating VoIP call agent based on a determination that the proof of knowledge of the attribute of the PSTN call is received from the originating VoIP call agent, wherein validation of the VoIP call initiation message indicates the VoIP call initiation message is an authorized request for a VoIP call.

15. The method of claim 14, further comprising generating an authorization ticket based on whether the proof of knowledge of the attribute of the PSTN call is received, wherein validating the VoIP call initiation message comprises receiving the authorization ticket and verifying the authorization ticket is valid.

16. The method of claim 15, wherein generating the authorization ticket comprises cryptographically signing the authorization ticket, wherein the authorization ticket includes an identifier of the domain, and wherein verifying the authorization ticket comprises verifying a digital signature included in the authorization ticket.

17. The method of claim 15, wherein validating the VoIP call initiation message further comprises verifying that the VoIP call initiation message originated from a domain for which the authorization ticket is valid.

18. The method of claim 15, further comprising:

determining authorization for a domain is revoked, wherein the authorization ticket indicates the domain is an authorized domain;

including, at a call agent, a predetermined response code in a response to the VoIP call initiation message, the predetermined response code indicating the authorization for the domain is revoked; and

storing, at an application-level gateway, an identifier of the domain in a blacklist in response to detecting the predetermined response code in the response.

19. The method of claim 15, wherein generating the authorization ticket further comprises generating the authorization ticket for a determined domain in response to both receiving proof of knowledge of the attribute of the PSTN call and finding the determined domain in a list of authorized domains.

20. The method of claim 18, wherein generating the authorization ticket further comprises generating the authorization ticket for a determined domain in response to both receiving proof of knowledge of the attribute of the PSTN call and verifying the determined domain is not included in a list of unauthorized domains.