A method for intercepting harassing calls on the network side

Abstract

The present invention discloses a method for intercepting harassing calls on the network side. The method obtains SIP TDR interface data collected by a signaling monitoring system to determine whether the interface data meets the interception rules; the SIP TDR interface is a TDR interface based on the SIP protocol; when the interception rules are met, it is determined whether the call is connected, and if so, a BYE message is constructed according to the interface data and a BYE message is sent to the calling side and the called side respectively to disconnect the call, and if not, a CANCEL message is constructed according to the interface data and a CANCEL message is sent to the called side to disconnect the call. The technical solution of the present invention does not need to be connected to the network and does not increase the complexity of the service.

Description

Technical Field

[0001] The present invention relates to the technical field of harassment call interception, and in particular to a harassment call interception method on a network side. Background Art

[0002] The existing technology for intercepting harassing calls includes interception on the user side and interception on the network side. On the user side, some high-frequency advertising and marketing calls can be rejected by number marking. On the network side, traditional 2 / 3G networks can restrict calls by issuing interception instructions to the switch or directly shut down through the HLR. IMS and VOLTE are flexible in networking and can access AS with call interception function, such as China Telecom's call rejection AS.

[0003] User-side number tagging requires the use of a smartphone, but many elderly smartphones are limited to answering and making calls. More importantly, the interception must be perceptible on the user side. Users will not be aware of interception on the network side, but the implementation cost is high. Take 2 / 3G communication switch interception as an example. The switch is designed for connectivity rather than interception, so the capacity of intercepted numbers is very limited and the interception rules are simple. 4G networks are controlled through AS, which has a high investment cost and increases the complexity of network services. More resources are needed for maintenance and support in the future. Summary of the invention

[0004] The present invention provides a method for intercepting harassing calls on the network side, which does not require interfacing with the network and does not increase the complexity of the service.

[0005] An embodiment of the present invention provides a method for intercepting harassing calls on a network side, which is applied to an interception device and includes the following steps:

[0006] Acquire SIP TDR interface data through the signaling monitoring system, and determine whether the interface data complies with the interception rules; the SIP TDR interface is a TDR interface based on the SIP protocol;

[0007] When the interception rule is met, it is determined whether the call is connected. If so, the interface data constructs a BYE message and sends a BYE message to the calling side and the called side respectively to disconnect the call. If not, a CANCEL message is constructed according to the interface data and a CANCEL message is sent to the called side to disconnect the call.

[0008] Furthermore, the interface data includes: signaling time, network layer source IP, network layer destination IP, transport layer source port, transport layer destination port, SIP method, user name of request URL, host IP of request URL, port of request URL, address of Via header field, port of Via header field, diversion parameter of Via header field, user name of To header field, host IP of To header field, identifier of To header field, user name of From header field, host IP of From header field, identifier of From header field, identifier of From header field, SIP call identifier and SIP call sequence number.

[0009] Furthermore, the calling number, called number and network layer source IP are extracted from the interface data, and it is determined whether the calling number, called number and network layer source IP meet the interception rules.

[0010] Furthermore, when the calling number is in the blacklist, and the called number is not a special service number, and the network layer source IP is in the interception network element list, it is determined to comply with the interception rule.

[0011] Furthermore, an identification string is added to the BYE message and the CANCEL message, and the identification string is used to identify the interception device that sends the current message.

[0012] The embodiments of the present invention have the following beneficial effects:

[0013] The present invention provides a method for intercepting harassing calls on the network side, which obtains SIP TDR interface data collected by a signaling monitoring system to determine whether the interface data meets the interception rules; when the interception rules are met, different disconnection schemes are adopted according to whether the current call is connected to achieve the interception of harassing calls on the network side, that is, a CANCEL message is constructed according to the interface data and a CANCEL message is sent to the called side to disconnect the call, or a BYE message is constructed according to the interface data and a BYE message is sent to the calling side and the called side respectively to disconnect the call. Compared with the commonly used method of stringing in intercepting AS equipment, the present invention does not need to be stringed in the network, does not increase the complexity of the business, uses the existing architecture of the existing network, has a small transformation, reduces the investment cost, and improves the network quality and user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a flowchart of a method for intercepting harassment calls on the network side provided by an embodiment of the present invention;

[0015] Figure 2 It is a flowchart of sending a CANCEL message to disconnect the call in a method for intercepting harassing calls on the network side provided by an embodiment of the present invention;

[0016] Figure 3 The present invention is a flowchart of sending a BYE message to disconnect a call in a method for intercepting harassment calls on the network side provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0017] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] like Figure 1 As shown, an embodiment of the present invention provides a method for intercepting harassing calls on the network side, comprising the following steps:

[0019] Step S101: obtaining SIP TDR interface data through a signaling monitoring system, and determining whether the interface data complies with an interception rule; the SIP TDR interface is a TDR interface based on the SIP protocol;

[0020] The interface data includes: signaling time, network layer source IP, network layer destination IP, transport layer source port, transport layer destination port, SIP method, user name of request URL, host IP of request URL, port of request URL, address of Via header field, port of Via header field, diversion parameter of Via header field, user name of To header field, host IP of To header field, identifier of To header field, user name of From header field, host IP of From header field, identifier of From header field, identifier of From header field, SIP call identifier and SIP call sequence number.

[0021] As one embodiment, the interface data includes the following fields:

[0022]

[0023]

[0024] Among them, the TDR interface field event_time is used to calculate the signaling uplink delay and does not participate in signaling packetization. If the delay exceeds 3 seconds, the message needs to be discarded, otherwise the subsequent signaling packetization back injection will not achieve the interception effect;

[0025] The TDR interface field sip.Method is used to send two types of TDR messages, namely, the call initiation message (INVITE) and the response message (200OK for INVITE), which are respectively used for the CANCEL message and BYE message of the signaling package;

[0026] The TDR interface field sip.to.tag has not been generated in the call origination message, so it is set to null in the CANCEL message;

[0027] The TDR interface field sip.Cseq.seq is usually sent with a value of 1 and remains unchanged in the CANCEL message. It is set to a fixed value of 5 or a fixed step of 10 in the BYE message to prevent the peer device from sending a 500 error message indicating "Sequencenumber in CSeq is invalid", which fails to achieve the interception effect.

[0028] As one embodiment, the calling number, the called number and the network layer source IP are extracted from the interface data, and it is determined whether the calling number, the called number and the network layer source IP meet the interception rules;

[0029] When the calling number is in the blacklist, the called number is not a special service number, and the source IP is in the interception network element list, it is determined that the interception rule is met.

[0030] Among them, the blacklist and interception network element list are dynamically issued in real time by the command interface, such as: 189*****0001,5.0.0.1, the first field is the number to be intercepted, and the second field is the network element IP to be intercepted, and batch delivery of numbers is supported. Special service numbers are statically specified by the configuration file, such as: 110,112,114,117,119,120,...

[0031] Step S102: When the interception rule is met, determine whether the call is connected. If so, construct a BYE message based on the interface data and send the BYE messages to the calling side and the called side respectively to disconnect the call. If not, construct a CANCEL message based on the interface data and send the CANCEL message to the called side to disconnect the call.

[0032] As one embodiment, the CANCEL message and BYE message specified in the SIP protocol are constructed by using the SIP TDR interface data collected from the signaling monitoring system. Description of constructing the CANCEL and BYE messages sent to the called party:

[0033] The L2 data link layer is 14 bytes, of which the peer device MAC address is 6 bytes read from the configuration file, the local server MAC address is 6 bytes read from the configuration file, and the type is 2 bytes fixed to 0x0800.

[0034] The L3 network layer is 20 bytes, of which the network layer source IP and the network layer destination IP are taken from the interface fields ip.src and ip.dst, and the rest is filled according to the IP protocol.

[0035] The L4 transport layer is 8 bytes, where the transport layer source port and the transport layer destination port are taken from the interface fields udp.srcport and udp.dstport, and the rest is filled according to the UDP protocol.

[0036] The L5 application layer is encapsulated according to the SIP protocol. The request line includes the request method and request URL, which is composed of the fields sip.Method, sip.r-uri.user, sip.r-uri.host, and sip.r-uri.port.

[0037] The message header contains Via, From, To, Call-ID, CSeq, User-Agent and Content-Length information elements, where Via is composed of the interface fields sip.Via.sent-by.address, sip.Via.sent-by.port, and sip.Via.branch; From is composed of the interface fields sip.from.user, sip.from.host, and sip.from.tag; To is composed of the interface fields sip.to.user and sip.to.host, and if it is a BYE message, it should also contain the field sip.to.tag; Call-ID is the interface field sip.Call-ID; CSeq is adapted according to the interface field sip.CSeq.seq. When constructing a CANCEL message, CSeq remains unchanged, and a fixed step of 5 or 10 is added when constructing a BYE message; User-Agent is the user agent, which is optional; Content-Length is set to 0, that is, there is no message body.

[0038] When constructing the BYE message sent to the calling side, the following adjustments need to be made: Among them, the L3 network layer source IP and network layer destination IP are taken from the interface fields ip.dst and ip.src; the L4 transport layer source port and destination port are taken from the interface fields udp.dstport and udp.srcport; the L5 application layer request URL is composed of the interface fields sip.from.user, sip.from.host and 5060, From is composed of the interface fields sip.to.user, sip.to.host and sip.to.tag, and To is composed of the interface fields sip.from.user, sip.from.host and sip.from.tag.

[0039] When the interception rule is met, it is determined whether the call is after the 200OK for INVITE message. If so, a BYE message is constructed according to the interface data and a BYE message is sent to the calling side and the called side respectively to disconnect the call. If not, a CANCEL message is constructed according to the interface data and a CANCEL message is sent to the called side to disconnect the call. Figure 2 As shown, the interception device injects a Cancel(5) message to user B or user B's proxy server through the network before the call is connected, thereby achieving the purpose of harassing call interception. Figure 3 As shown, after the call is connected, the interception device injects a Bye(12) message and a Bye(13) message back through the network. The Bye(12) message is sent to user B or the proxy server of user B and is regarded as a call disconnection initiated by the caller. The Bye(13) message is sent to user A or the proxy server of user A and is regarded as a call disconnection initiated by the callee, thereby achieving the purpose of harassment call interception.

[0040] As one of the embodiments, an identification string is added to the BYE message and the CANCEL message, and the identification string is used to identify the interception device that sent the current message. Specifically, a specific string such as "User-Agent: Sendi sdss.fzp / 6.0" is added during signaling packaging to identify the interception device that sent the current message, which facilitates problem location. Among them, "User-Agent" is the user agent header field identifier, and "Sendi sdss.fzp / 6.0" is the manufacturer, system and version number.

[0041] The SIP protocol specifies two types of signaling: BYE and CANCEL. When a call is terminated, the party that terminates the conversation first hangs up the phone and sends it to the other party. The other party accepts and replies with 200OK, and the call is terminated at this time. The CANCEL signaling is used to terminate a previous call request to a client. It requires the UAS to stop the current request and generate an error message for the request. When an INVITE is received and no response is received, the UAS will stop the call when it receives CANCEL, and then reply to the INVITE with an error (such as a 487 message).

[0042] The signaling monitoring system is one of the important support systems for the operation and maintenance of the communication network. It collects various types of signaling and protocol data by means of high-impedance cross-connection, port mirroring, TAP splitting, splitter splitting, etc. that do not affect the operation of the network, and then performs signaling protocol decoding to synthesize CDR (Call Detail Record) or TDR (Transaction Detail Record). Among them, CDR is used for network troubleshooting and network performance statistics, while TDR is used for various value-added services, and the latter has very high real-time performance, and the delay requirement is basically less than 3 seconds. The present invention utilizes the original TDR uplink channel of the signaling monitoring system, and only adds some necessary fields to the TDR interface to realize harassment call interception, and the cost of modifying the existing signaling monitoring system is very small.

[0043] The present invention has the following beneficial effects:

[0044] 1. The present invention performs harassment interception on the network side without user perception, and the interception rules are flexible and convenient for subsequent upgrades without affecting existing network services.

[0045] 2. Compared with the AS device that is connected in series, the present invention does not need to be connected in series to the network, does not increase the complexity of the business, and has a low investment cost.

[0046] 3. The present invention constructs and sends CANCEL and BYE messages according to SIP TDR interface data, thereby effectively intercepting harassing calls on the network side, with low investment cost and without increasing the complexity of network services, thus better protecting existing telecommunication network investments and improving network quality and user experience.

[0047] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

[0048] Those skilled in the art can understand that all or part of the processes in the above embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes in the above embodiments. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

Claims

1. A method for intercepting harassing calls on the network side, characterized in that: Applied to interception equipment, including the following steps: Acquire SIP TDR interface data through the signaling monitoring system, and determine whether the interface data complies with the interception rules; the SIP TDR interface is a TDR interface based on the SIP protocol; When the interception rule is met, determine whether the call is connected, if so, construct a BYE message according to the interface data and send BYE messages to the calling side and the called side respectively to disconnect the call, if not, construct a CANCEL message according to the interface data and send a CANCEL message to the called side to disconnect the call; The interface data includes: signaling time, network layer source IP, network layer destination IP, transport layer source port, transport layer destination port, SIP method, user name of request URL, host IP of request URL, port of request URL, address of Via header field, port of Via header field, diversion parameter of Via header field, user name of To header field, host IP of To header field, identifier of To header field, user name of From header field, host IP of From header field, identifier of From header field, SIP call identifier and SIP call sequence number.

2. The method for intercepting harassing calls on the network side according to claim 1, characterized in that: The calling number, called number and network layer source IP are extracted from the interface data, and it is determined whether the calling number, called number and network layer source IP meet the interception rules.

3. The method for intercepting harassing calls on the network side according to claim 2, characterized in that: When the calling number is in the blacklist, the called number is not a special service number, and the network layer source IP is in the interception network element list, it is determined to comply with the interception rule.

4. The method for intercepting harassing calls on the network side according to any one of claims 1 to 3, characterized in that: An identification string is added to the BYE message and the CANCEL message, where the identification string is used to identify the interception device that sends the current message.

Images