CALL WARNING DEVICE, CALL WARNING SYSTEM, CALL WARNING METHOD, AND CALL WARNING PROGRAM

Abstract

At the time a SIP server (23) receives a call signal (44) to be transmitted to a receiving-end terminal (31), if the call signal (44) is set up with an international call identifier indicating that the call signal arrived via a foreign country, the SIP server transmits a warning signal to the receiving-end terminal (31) before transmitting the call signal (44) to the receiving-end terminal (31). Also, at the time the SIP server (23) receives a call signal (44) to be transmitted to the receiving-end terminal (31), if the call signal (44) is set up with an international call identifier indicating that the call signal arrived via a foreign country and the calling number of the call signal (44) is a number from the same country as the receiving-end terminal (31), the SIP server includes, in the warning signal, a warning that the calling number has been forged.

Description

[Technical field]

[0001] The present invention relates to a call warning device, a call warning system, a call warning method, and a call warning program. [Background technology]

[0002] In recent years, the number of special fraud cases has increased significantly, and since more than half of the cases involve "it's me" fraud (a fraud where the caller pretends to be your son), measures against telephone fraud are required. In addition, with the spread of IP networks, there are cases where special fraud call signals are transmitted over the network as SIP (Session Initiation Protocol) signals.

[0003] Patent Document 1 describes a method for providing guidance to a called user before end-end media connection between a calling terminal and a called terminal in a communication system that performs call control by SIP. This allows the called user to determine whether or not to connect by performing an operation requested by the guidance.

[0004] Patent Document 2 describes a call system in which a receiving terminal provides evaluation information of a calling terminal to the receiving terminal before responding to a call from the calling terminal, and the receiving terminal talks to the calling terminal. This allows the receiving terminal to appropriately select situations in which to make a call, such as refusing a call from a calling terminal with a bad evaluation and accepting a call from a calling terminal with a good evaluation, and to decline a call at the instruction of the receiving party. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2012-165285 A [Patent Document 2] JP 2016-163303 A Summary of the Invention [Problem to be solved by the invention]

[0006] In the conventional technology, the method of registering attackers on a blacklist requires the registration of calling numbers used in special frauds in advance. Therefore, if attackers frequently change their calling numbers, the blacklist becomes outdated and measures against special frauds may not be adequately implemented. Therefore, we consider using a different clue that shows the call tendency of special frauds, rather than a clue that directly indicates the attacker, such as the calling number.

[0007] FIG. 6 is a block diagram showing an overview of a specialized fraud attack from abroad. The following illustrates an example in which a call from a calling terminal 11z passes through three SIP servers (SIP server 21z → SIP server 22z → SIP server 23z) and reaches a called terminal 31z. Here, we focus on the recipient who uses the called terminal 31z, and the country in which the called terminal 31z is used is defined as the home country. The foreign carrier 21Dz manages a SIP server 21z that accommodates the calling terminal 11z. The international connection carrier 22Dz manages a SIP server 22z. The domestic carrier 23Dz manages a SIP server 23z that accommodates the called terminal 31z. In other words, the SIP server 22z relays a call across two countries.

[0008] Here, the attacker often uses a foreign calling terminal 11z in order to delay the identification (tracking) of the attacker as the caller of the special fraud. Therefore, it is effective to use information on whether the call is from a foreign country to a domestic country as a clue to indicate the call tendency of the special fraud. However, such a clue has not been used in the conventional technology.

[0009] Therefore, the main object of the present invention is to issue an appropriate warning even if special fraud numbers are frequently changed. [Means for solving the problem]

[0010] In order to solve the above problems, the call warning device of the present invention has the following features. In the present invention, a call warning device is configured to SIP The device has an execution unit that executes, upon receiving a signal, any one of the following first processing, second processing, or third processing, The first process is SIP If the signal does not have an international call identifier indicating that it has passed through a foreign country, there is no warning of special fraud attacks. Call A process of transmitting a signal to the receiving terminal, The second process is SIP The signal is set to the international call identifier, and SIP If the signal originating number is a number from said foreign country, Start call in front, In call signaling a process of transmitting a first warning signal to the receiving terminal, the first warning signal indicating that the call is from a foreign country and thus indicating that a fraudulent attack is occurring; The third process is SIP The signal is set to the international call identifier, and SIP If the signaling originating number is from the same country as the terminating terminal, Start call in front, In call signaling In addition to warning of specialized fraud attacks due to the call being from a foreign country, this process is characterized by sending a second warning signal to the receiving terminal to warn that the calling number is being spoofed. Effect of the Invention

[0011] According to the present invention, even if special fraud numbers are frequently changed, appropriate warnings can be issued. [Brief description of the drawings]

[0012] [Figure 1] 1 is a configuration diagram of a call warning system according to an embodiment of the present invention; [Diagram 2] FIG. 2 is a diagram illustrating the configuration of a SIP server according to the present embodiment. [Diagram 3] FIG. 2 is a hardware configuration diagram of a SIP server according to the present embodiment. [Figure 4] FIG. 2 is a configuration diagram of a case where the calling number is further spoofed in response to the special fraud attack of FIG. 1 according to this embodiment. [Diagram 5] FIG. 2 is a configuration diagram of the call warning system of the present embodiment shown in FIG. 1 when a regular call is made. [Figure 6] This is a block diagram showing an overview of special fraud attacks from foreign countries. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0014] FIG. 1 is a block diagram of a call warning system. 6, a case is illustrated in which a call signal 41a from the calling terminal 11 passes through three SIP servers 20 (SIP server 21 → (SIP signal 42a) → SIP server 22 → (SIP signal 43a) → SIP server 23) and arrives at the called terminal 31 as a call signal 44a. Here, attention is focused on the recipient using the called terminal 31, and the country in which the called terminal 31 is used is defined as the home country. The foreign carrier 21D manages a SIP server 21 that accommodates the calling terminal 11. The international connection carrier 22D manages a SIP server (international connection device) 22. The domestic carrier 23D manages a SIP server (call warning device) 23 that accommodates the called terminal 31. In other words, the SIP server 22 relays a call across two countries.

[0015] In this case, since there is a tendency for "it's me" scams to be made from overseas to domestic, when the call signal 44a received by the receiving terminal 31 is a call (call signal 41a) made from overseas to domestic, the SIP server 23 sends guidance (warning signal) to the receiving terminal 31 to warn it before the call starts. In other words, if an international call identifier indicating a call from a foreign country is set in the SIP signal 43a relayed from the upstream SIP server 22, the SIP server 23 determines that the call is originated from a foreign country and sends out pre-call guidance in the call signal 44a. The specific SIP procedure for sending pre-call guidance is described in Patent Document 1.

[0016] Therefore, when relaying a call across two countries, the SIP server 22 sets an international call identifier in the received SIP signal 42a and then transmits it to the relay destination as a SIP signal 43a. The international call identifier is set as "verstat=No-TN-Validation" in the P-Asserted-Identity header (hereinafter, PAID header) indicating the calling number information of the SIP signal 43a, for example. This international call identifier is information circulated between the international connection carrier 22D and the domestic carrier 23D, and is therefore not affected even if information outside the carrier (calling number) is frequently changed.

[0017] "verstat=No-TN-Validation" is an identifier that indicates that the calling number of the call has not been verified. This identifier is specified in the standardization document JJ-90.30 (IMS Interoperability Common Interface) of the Telecommunication Technology Committee to be assigned to the calling number assigned by a foreign carrier 21D. In other words, the SIP server 22 of the international connection carrier 22D is obligated to add "verstat=No-TN-Validation" when relaying a call across two countries.

[0018] FIG. 2 is a diagram showing the configuration of the SIP server 20. The SIP server 20 includes a call receiving unit 51, a SIP receiving unit 52, a call processing unit 53, a SIP processing unit 54, a call transmitting unit 55, and a SIP transmitting unit 56. The processing of the SIP server 20 will be described below along the contents of each signal (call signals 41a, 44a, SIP signals 42a, 43a) in FIG.

[0019] First, the SIP server 21 of the foreign carrier 21D will be described. The call receiving unit 51 of the SIP server 21 receives a call signal 41a from the calling terminal 11. This call signal 41a includes the calling number of the calling terminal 11, "+663-2222-2222", and the called number of the called terminal 31, "0422-88-8888". The call processing unit 53 recognizes that the called number of the received call signal 41a is destined for another country. The SIP processing unit 54 creates a SIP signal 42a (INVITE, PAID) from the call signal 41a (calling number, called number). The SIP transmission unit 56 relays the created SIP signal 42a to the SIP server 22 of the international connection carrier 22D.

[0020] Next, the SIP server 22 of the international connection carrier 22D will be described. The SIP receiving unit 52 of the SIP server 22 receives the SIP signal 42a from the SIP server 21. The SIP processing unit 54 recognizes that the called number (INVITE) of the received SIP signal 42a is destined for a country different from that of the calling number (PAID). The SIP processing unit 54 creates a SIP signal 43a by adding "verstat=No-TN-Validation" as an international call identifier to the SIP signal 42a. The SIP transmission unit 56 relays the created SIP signal 43a to the SIP server 23 of the domestic carrier 23D.

[0021] Next, the SIP server 23 of the domestic carrier 23D will be described. The SIP receiving unit 52 of the SIP server 23 receives the SIP signal 43a from the SIP server 22. The SIP processing unit 54 recognizes that the called number of the received SIP signal 43a is its own responsibility. Here, the SIP processing unit 54 recognizes that a warning is necessary because the SIP signal 43a includes an international call identifier. The call processor 53 converts the SIP signal 43a (INVITE, PAID) into a call signal 44a (calling number, called number). Then, the call transmitter 55 sends a guidance message to the called terminal 31 to warn the user before starting a call based on the call signal 44a.

[0022] FIG. 3 is a diagram showing the hardware configuration of the SIP server 20. As shown in FIG. The SIP server 20 is configured as a computer 900 having a CPU 901 , a RAM 902 , a ROM 903 , a HDD 904 , a communication I / F 905 , an input / output I / F 906 , and a media I / F 907 . The communication I / F 905 is connected to an external communication device 915. The input / output I / F 906 is connected to an input / output device 916. The media I / F 907 reads and writes data from a recording medium 917. Furthermore, the CPU 901 controls each processing unit by executing a program (also called an application or its abbreviation, an app) loaded into the RAM 902. This program can be distributed via a communication line, or can be recorded on a recording medium 917 such as a CD-ROM and distributed.

[0023] FIG. 4 is a configuration diagram of the special fraud attack shown in FIG. 1 in which the calling number is further spoofed. The difference is that while the call signal 41a in Fig. 1 includes the unspoofed calling number "+663-2222-2222" of the calling terminal 11, the call signal 41b in Fig. 4 includes the spoofed calling number "+8163-2222-2222" of the calling terminal 11. The number starting with "+81" indicates a domestic number for the called terminal 31. Also, unlike the SIP signals 42a and 43a in Fig. 1, the SIP signals 42b and 43b in Fig. 4 also include the spoofed calling number "+8163-2222-2222" of the calling terminal 11. Even if the calling number is spoofed, the calling number (PAID) to be notified to the recipient in the SIP signal and the information indicating the actual location of the caller are managed in separate headers. Therefore, the SIP server 20 through which the call passes cannot exclude spoofed calls, and there is a risk that a call connection for special fraud will be made between the calling terminal 11 and the receiving terminal 31.

[0024] The processes of the SIP server 21 and the SIP server 22 in the case of Fig. 4 are the same as those in the case of Fig. 1. The SIP server 23 of the domestic carrier 23D in the case of Fig. 4 will be described below. The SIP receiving unit 52 of the SIP server 23 receives the SIP signal 43b from the SIP server 22. The SIP processing unit 54 recognizes that the called number of the received SIP signal 43b is its own responsibility.

[0025] Here, the SIP processing unit 54 judges that an international call identifier is included in the SIP signal 43b, and therefore warns that the call is from a foreign country before starting the call (first warning). Furthermore, when the calling number (PAID) of the SIP signal 43b is a domestic number (number starting with "+81") despite the international call identifier being included, the SIP processing unit 54 judges that a warning is issued that the calling number is spoofed (second warning). The SIP processing unit 54 converts the SIP signal 43b (INVITE, PAID) into a call signal 44b (calling number, called number). Then, the call transmitting unit 55 transmits guidance for issuing a second warning to the called terminal 31 in addition to the first warning before starting a call based on the call signal 44b.

[0026] An example in which an appropriate warning guidance is given when a fraudulent attacker launches a special fraud attack from the calling terminal 11 to the called terminal 31 has been described above with reference to Figs. On the other hand, not only unauthorized attackers but also legitimate users may call the receiving terminal 31. Therefore, an example will be described below that shows how to prevent a false warning from being issued to a legitimate user.

[0027] FIG. 5 is a configuration diagram of the call warning system of FIG. 1 when a regular call is made. First, it is assumed that the calling terminal 11 used by the attacker in FIG. 1 is accommodated in a foreign SIP server 21, whereas the calling terminal 12 used by the legitimate user in FIG. 5 is accommodated in a domestic SIP server 22.

[0028] The call receiving unit 51 of the SIP server 22 receives a call signal 41c from the calling terminal 12. This call signal 41c includes the calling number of the calling terminal 12, "03-1234-5678", and the called number of the called terminal 31, "0422-88-8888". The call processing unit 53 recognizes that the called number of the received call signal 41c is addressed to its own country. Therefore, the SIP processing unit 54 creates a SIP signal 43c (INVITE, PAID) from the call signal 41c (calling number, called number) without adding an international call identifier. The SIP transmission unit 56 relays the created SIP signal 43c to the SIP server 23.

[0029] The SIP receiving unit 52 of the SIP server 23 receives the SIP signal 43c from the SIP server 22. The SIP processing unit 54 recognizes that the called number of the received SIP signal 43c is its own responsibility. Here, the SIP processing unit 54 recognizes that a warning is not necessary because the SIP signal 43c does not include an international call identifier. The call processing unit 53 converts the SIP signal 43c (INVITE, PAID) into a call signal 44c (calling number, called number). Then, the call transmitting unit 55 transmits the call signal 44c without a warning to the called terminal 31.

[0030] [effect] The present invention is characterized in that when the SIP server 23 receives a SIP signal 43a destined for the receiving terminal 31, if an international call identifier indicating that the SIP signal 43a has passed through a foreign country is set in the SIP signal 43a, the SIP server 23 sends a warning signal to the receiving terminal 31 before sending the SIP signal 43a to the receiving terminal 31.

[0031] This makes it possible to warn callers without using information on attackers obtained in advance (blacklists), and it is also possible to respond to tactics such as frequently changing numbers by issuing real-time warnings.In addition, it is possible to clearly warn callers who are unfamiliar with foreign numbers that they are calling from a foreign country.

[0032] The present invention is characterized in that when the SIP server 23 receives a SIP signal 43a destined for the receiving terminal 31, if an international call identifier is set in the SIP signal 43a indicating that the signal has passed through a foreign country and if the calling number of the SIP signal 43a is a number from the same country as the receiving terminal 31, the warning signal includes a warning that the calling number is spoofed.

[0033] This makes it possible to distinguish between calls with normal calling numbers and calls with spoofed calling numbers and to issue a more severe warning to spoofed calls, making it possible to detect and warn about special fraud calls made by unscrupulous businesses.

[0034] The present invention is a call warning system including SIP server 23 and SIP server 22, and is characterized in that when SIP server 22 receives a SIP signal 43a from a country different from the country in which receiving terminal 31 is accommodated, it sets an international call identifier for the SIP signal 43a indicating that the signal has passed through a foreign country, and then relays the signal to SIP server 23.

[0035] This ensures that an international call identifier is set for the SIP signal 43a that has passed through a foreign country.

[0036] The present invention is characterized in that the SIP server 22 sets, as an international call identifier, an identifier of the PAID header indicating that the calling number of the SIP signal 43a is unverified, in the SIP signal 43a.

[0037] This allows the existing implementation (No-TN-Validation, indicating that the foreign identifier has not been verified) to be used for the foreign identifier, so that the SIP server 22 can continue to use the existing server as is, and only the warning determination logic of the SIP server 23 needs to be added. [Explanation of symbols]

[0038] 11,12 Calling terminal 20,21 SIP Server 21D Foreign business operator 22 SIP server (international connection device) 22D International connection carrier 23 SIP server (call warning device) 23D Domestic business operator 31 Destination terminal 41,44 Call Signal 42,43 SIP signal (call signal) 51 Call receiving unit 52 SIP receiver 53 Call Processing Unit 54 SIP Processing Section 55 Call sending unit 56 SIP transmitter

Claims

1. The call warning device has an execution unit that executes any one of the following first process, second process, or third process when receiving a SIP signal with a destination terminal as a destination, The first process is a process of transmitting a call signal without a warning against a special fraud attack to the receiving terminal when an international call identifier indicating that the SIP signal has been sent via a foreign country is not set in the SIP signal, the second process is a process of, when the international call identifier is set in the SIP signal and the calling number of the SIP signal is the number from the foreign country, transmitting a first warning signal to the called terminal before starting a call, the first warning signal indicating that the call signal indicates a foreign call and warning of a specialized fraud attack; The third process is a process of, when the international call identifier is set in the SIP signal and the calling number of the SIP signal is a number from the same country as the called terminal, sending a second warning signal to the called terminal before starting a call, in addition to warning of a special fraud attack by the fact that the call signal indicates a call from a foreign country, warning that the calling number is spoofed. Call alert device.

2. A call warning system including the call warning device according to claim 1 and an international connection device, When the international connection device receives the SIP signal from a country different from the country in which the receiving terminal is accommodated, the international connection device sets the international call identifier indicating that the SIP signal has passed through a foreign country to the SIP signal, and then relays the SIP signal to the call warning device. Call alert system.

3. The international connection device sets an identifier indicating that the calling number of the call signal is unverified as the international call identifier in the SIP signal.

3. The call alert system of claim 2.

4. The call alert device has an execution unit, When the execution unit receives a SIP signal having a destination terminal as a transmission destination, the execution unit executes any one of the following first processing, second processing, or third processing, The first process is a process of transmitting a call signal without a warning against a special fraud attack to the receiving terminal when an international call identifier indicating that the SIP signal has been sent via a foreign country is not set in the SIP signal, the second process is a process of, when the international call identifier is set in the SIP signal and the calling number of the SIP signal is the number from the foreign country, transmitting a first warning signal to the called terminal before starting a call, the first warning signal indicating that the call signal indicates a foreign call and warning of a specialized fraud attack; The third process is a process of, when the international call identifier is set in the SIP signal and the calling number of the SIP signal is a number from the same country as the called terminal, sending a second warning signal to the called terminal before starting a call, in addition to warning of a special fraud attack by the fact that the call signal indicates a call from a foreign country, warning that the calling number is spoofed. Call alert method.

5. A call warning program for causing a computer serving as the call warning device to execute the call warning method according to claim 4.

Images