Communication network having a data channel

Abstract

The object is to cater for the long-standing need for a failsafe device that consumes as little data capacity as possible, said device being intended to effectively enable authentication of a caller ID and associated telephone number at the receiver. Proceeding from the good approaches from the field of ISDN technology, the solution is provided by a data channel, in the form of a parallel, strictly assigned authentication network consisting of a multiplicity of interfaces that does not make available any additional data payload whatsoever besides for the purpose of authentication. Consistently restricting the data packets able to be received to a few bytes and the responses able to be issued to a few bits enables a high degree of redundancy and allows implementation in the form of a system-relevant security component.

Description

[0001] Communication network with data channel

[0002] SCIENTIFIC AREA

[0003] The invention is in the field of computer-implemented inventions. Simple methods or algorithms have long been available as hardware and software implementations and hybrid combinations. For example, JP 06201782A disclosed a chipset as early as 1994 in which a linear feedback shift register is provided as part of a test circuit; further developments of this can be found in the 1990s in the documents JP10207695 A and JP 10301492 A. US 6,091,821 A discloses how a hash algorithm can be mapped at the hardware level; US 6,289,023 B discloses a more efficient checksum generator; US 6,348,881 B1 discloses a hardware-implemented compression algorithm. The KR 10 2003 005 111 1 A provides a hardware-implemented AES encryption; the KR 10 2005 0005 054 A provides a hardware white noise generator.Thus, methods and products for implementing simple, established data processing methods using a hardware module can be considered known. Measures such as AND operations, XOR operations, encryption, compression, signing, checksum validation, intercorrelation, and even the creation of internally correlated key data can be considered established and implementable in both software and hardware. For particularly fast and efficient hardware, block-based parallel processing is used, as described, for example, in DE 10 2005 018 248 B4. Against this background, the subject matter defined in this invention describes both hardware and software that can be implemented in the same way, as well as hybrid models in which the functions of the invention can be implemented proportionally and combined to form the claimed subject matter. GENERAL BACKGROUND.

[0004] The present invention relates to a communications network according to the preamble of the independent claims. A fundamental problem of communications networks operating with multiple data layers and parallel data channels is, on the one hand, the provision of interfaces that are as widely compatible and adaptable as possible, and, on the other hand, the prevention of misuse. US 4,031,512 A already describes in 1977 how a communications network, despite a structure consisting of individual lines, can be effectively divided and operated into multiple data layers or data channels. Against this background, the terms 'data layer' and 'data channel' can describe both assigned lines and assigned data identifiers, or combinations thereof. US 5,335,227 A describes advanced, reconfigurable communications networks that can be restructured as needed, while user terminals remain identified and assigned to users via an identifier.In addition, WO 1995024791 A discloses how a radio network and a landline network can be better combined, coordinated via a parallel control channel, and operated more effectively together by collecting operational data. To enable these and similar communication networks to cooperate, switching modules at the software and / or hardware level provide many usable, intermediary ports. However, this has the disadvantage that data can be manipulated during transmission.

[0005] In particular, the concealment and unauthorized anonymization of a caller's identity, hereinafter referred to as caller ID, is a common problem, which comes into play, for example, in identity and billing fraud.

[0006] Possible countermeasures for the telecommunications sector are described, for example, in documents US 5,495,521 A; US 5,907,602 A; US 6,058,301 A; EP 1 076 951 B; KR 10 2001 004 3378 A; US 6,675,153 B1 and US 7,496,345 B1. However, none of the established devices and measures has been able to achieve global and widespread adoption. The large number of compatible networks quickly leads to excessively high and expensive data loads with the conventional approaches within the complex, correlated data layers.

[0007] DESCRIPTION OF THE STATE OF THE ART

[0008] ISDN telephony: The present invention is based on the concepts known from ISDN telephony. ISDN devices rely on the principle of US 4,031,512 A already mentioned and initially provide two types of data channel: a plurality of B channels, via which user data can be exchanged, and a parallel D channel, which was intended for coordinating the devices and network functions with one another. JP 620 380 52 A proposes monitoring an ISDN network via the D channel. JP 02246652 A suggests using the D channel for parallel data transmission; JP 06188936 A additionally describes parallel data transmission via several B channels. JP 04220857 A proposes to restrict the available services on ISDN systems using access data or passwords.JP 03254261 A proposes subjecting device identifiers to a preparatory register check to accelerate requests and activations. JP 03270543 A describes a test procedure in which an outgoing start communication from an ISDN device is intercepted, modified, and forwarded for validation. If the modified start communication matches a target value, the line and device are assessed as suitable and approved / activated.

[0009] US 5,218,680 A discloses a combination of ISDN functions and expanded CPU functions integrated on a chip; in the same way, EP 0 833 529 A2 proposes the operation of an ISDN system expanded with a radio network. Finally, US 5,805,570 A from 1998 discloses software with which an ISDN communications node can be simulated on a PC. Against this background, the functions that were essentially provided via hardware in the ISDN field in the 1980s and 1990s can be made available both as software with modern PCs and as hardware or in suitable partial combinations.

[0010] From JP 0 205 464 5 A it is suggested to use the D-channel to prevent misuse, e.g. by password query.

[0011] EP 0 817 484 A2 proposes to interconnect networks for communication, comprising multimedia data streams, via an ISDN system.

[0012] Therefore, communication networks are known from the state of the art in which, in parallel to a plurality of channels for user communication data, a parallel D-channel can be used to prevent misuse.

[0013] A disadvantage of this concept is that the D channel of an ISDN network also provides a data volume for parallel communication. DE 199 37 098 A1 therefore proposes that all preparatory communications be carried out free of charge before a chargeable connection is established. This regularly led to abusive, cost-avoiding communication directly via the D channel in the market, which also corresponds to the shared use as a communications data channel proposed in the Japanese document. Against this background, network operators regularly switched off the D channel, and there was no meaningful further development of an efficient, parallel channel for validating call data and preventing abuse.

[0014] The object of the present invention was therefore to overcome the disadvantages of the prior art and to design a data channel which, despite the possibility of parallel communication, is able to provide efficient protection against misuse which is attractive for network operators.

[0015] This problem is solved according to the features of the independent claims. Advantageous embodiments emerge from the dependent claims and the following description.

[0016] Another problem is the fact that communication security is a core aspect of modern societies; a system contributing to this should therefore require as little computing load or data volume as possible in order not to slow down communication.

[0017] Another problem is the fact that safety-relevant systems should have a high degree of reliability; partial failures should be compensable.

[0018] Another problem is the fact that communication via a parallel data channel would in principle be available to third parties; access to these functions should be limited in time and / or for users.

[0019] Another problem is the fact that call data allows conclusions to be drawn about the private data and characteristics of the communicators; data security should be taken into account.

[0020] Another problem is the fact that system-relevant functions should be subject to continuous monitoring; an important system should be able to detect and compensate for overload or increased demand. SUMMARY OF THE INVENTION

[0021] According to the invention, the claimed communications network has a data channel. Furthermore, a plurality of channels for user data and user communication are provided. The parallel data channel consists of an authentication network comprising a plurality of interfaces. It is essential that the data channel is strictly dedicated to the security query function and does not offer any data volume as available payload. For this purpose, only a data packet containing a caller ID and a telephone number can be input into the interfaces; the data packet can be input as a request or as a query.

[0022] DESCRIPTION OF THE INVENTION AND ADVANTAGEOUS FEATURES

[0023] According to the invention, the claimed communication network has a data channel analogous to a D-channel of ISDN technology.

[0024] A number of channels, similar to the B channels of ISDN technology or the data layers of established mobile networks, are available for user data and user communication.

[0025] The parallel data channel consists of an authentication network with a number of interfaces. It is essential that the data channel is strictly dedicated to the security query function and does not offer any data volume as an available payload.

[0026] For this purpose, only a data packet containing a caller ID and a telephone number can be entered into the interface.

[0027] The caller ID and the phone number are pieces of information that are checked in the established radio networks before the connection is established to ensure payment for the call. Therefore, the caller ID includes at least the clearly identifiable contractual partner, who has their own phone number, and / or the corresponding credit account, through which the call is preliminarily authorized. The caller ID and phone number therefore form a small data packet of just a few bytes. The data packet can be entered as a request or as a query. A request is recorded in the data channel and saved for timely comparison, and an acknowledgment of receipt is sent.

[0028] When a request is made, the request data packet is compared with the existing request data packets and, if a match is found, is confirmed or rejected if there is no match.

[0029] On the part of the caller's network operator, the above-described concept merely requires the forwarding of the caller ID and telephone number to the respective operator of the telephone number connection. Thanks to the parallel data channel, which is strictly tailored to its purpose, the operator of the telephone number connection can request the data packet as described above with minimal effort: The received data simply needs to be marked as a request and fed into the data channel. Upon confirmation, the call can then be established; upon rejection, the connection is refused.

[0030] Preferably, only a response of just a few bits can be output via the interfaces. If the size of possible responses is significantly smaller than the data packet, misuse of the data channel as a communications channel becomes very unattractive. Just a few bits are sufficient to classify a successful transmission, a checksum, or similar. Particularly preferably, the response, as call-related information, comprises only 2 bits for statements consisting of the group of statements consisting of 'valid', 'ID invalid', 'number invalid' and 'invalid'. This sufficiently enables the operator of the telephone number to form groups based on the caller ID and the statement. These groups can enable statements to be made about the quality of the communications channels and / or the trustworthiness of the caller ID and can be incorporated into other established measures.

[0031] Preferably, the interfaces are designed to allow only encrypted and / or secure communication. Encrypted communication can provide end-to-end encryption so that input data packets cannot be used by third parties; furthermore, each user can be assigned a personal code using additional cryptographic tools to identify unauthorized or forged entries. Furthermore, security can include recording the respective sender ID and continuously increasing a minimum waiting time for incorrect entries in order to prevent DOS attacks. Furthermore, both hardware and software can provide common and possible simple functions such as those known in the scientific field.

[0032] Preferably, the interfaces are configured as a peer-to-peer network with redundant multiple storage of incoming data. By distributing the data packets across multiple, preferably physically distant, interfaces, a high degree of reliability is achieved. Preferably, the degree of redundancy is adjustable for hazardous situations and / or specific user groups, in order to adapt the system's reliability to changing circumstances and / or increased system relevance for a user group.

[0033] The interfaces are preferably synchronized via at least one clock. This allows the assignment of passwords or access data with a time-dependent component and / or validity. Particularly if compromised access data is suspected, rapid, time-dependent modulation of the access data and its transmission via various data paths can help to identify and disable the compromised data paths. Data packets in the authentication network can preferably be provided with a timestamp upon receipt. When a request is made, the data packet is thus supplemented with a timestamp. A comparison of the time of receipt and the query time or response time allows an estimate of the current utilization of the data channel.The latter can be used to increase the number of available interfaces by creating and / or connecting additional interfaces during load changes, or to reduce them by deleting and / or switching off interfaces in order to ensure a continuous minimum performance of the data channel in the sense of optimized efficiency and ecological balance.

[0034] Preferably, the authentication network is designed to be amnesic, whereby at least received data packets cannot be stored permanently; regular deletion of the data packets additionally prevents misuse / compromise of the data packets.

[0035] Data packets should preferably have a maximum storage time of 300 seconds; in practical tests, a maximum storage time of 5 minutes was sufficient to establish a connection, even on extremely unstable line sections with multiple requests and rerouting; data packets are preferably deleted after 50 to 150 seconds, which was always a sufficiently long storage time for normal connections; data packets are particularly preferably deleted after 70 to 120 seconds, which was particularly sufficient for national calls in areas with average, uniform network coverage. In principle, a shorter minimum storage time reduces the load on the data channel accordingly. Against this background, a user- and situation-dependent regulation of the minimum storage time is particularly attractive in order to be able to achieve an optimum balance between customer satisfaction and energy consumption.Network operators preferably store call-related information at the user data level for further analysis and misuse prevention using known mechanisms and measures. As explained in the introduction, various approaches and concepts are known that can be used to initiate further steps and preventive measures in a communications network when attempts at forgery or fraud are detected.

[0036] Further advantages emerge from the exemplary embodiments. The features and advantages described above and the following exemplary embodiments are not to be understood as exhaustive combinations of features, unless explicitly described as such. Additional, advantageous features and additional combinations of features, as explained in the description and established according to the documents cited and the references cited therein, can be implemented in the claimed subject matter, both individually and in different combinations, within the scope of the independent claims, without departing from the scope of the invention.

[0037] DETAILED EXPLANATION OF THE INVENTION USING EMBODIMENTS

[0038] In an advantageous embodiment according to the invention, a communications network with a data channel has a plurality of channels for user data and user communication. The parallel data channel consists of an authentication network with a plurality of interfaces. Only a data packet containing a caller ID and a telephone number can be entered into the interfaces as a request or as an inquiry. Only a response a few bits long can be output via the interfaces, whereby the response, as call-related information, comprises exclusively 2 bits for statements. The statements can be selected from the group of statements consisting of 'valid', 'ID invalid', 'telephone number invalid' and 'invalid'. The interfaces are designed to only permit encrypted and / or secured communication.Furthermore, the interfaces are configured as a peer-to-peer network with redundant multiple storage of incoming data and synchronized via at least one clock. The data packets can be time-stamped upon arrival in the authentication network. The authentication network is designed to be amnesic, with at least received data packets not being permanently storable, but having a maximum storage time of 300 seconds, preferably 50 to 150 seconds, particularly preferably 70 to 120 seconds.

[0039] When a call is initiated, the caller's network operator first authenticates the caller by checking their caller ID and creditworthiness. The data packet is created by the caller's network operator, marked as a request, encrypted, and transmitted as a request once a secure, permissible connection to the data channel has been established. The request is given a timestamp, and its complete receipt is confirmed. The network operator of the telephone number is contacted, and the caller ID and telephone number are transmitted. The network operator of the telephone number, in turn, creates a data packet and, once the connection has been established, sends this as a request to the data channel as described above. Receipt of the complete and effective request is confirmed. In the authentication network, the request is compared with the existing requirements.The corresponding response information is created and sent back to the network operator of the phone number. The call is only established if the response information is 'valid'. For all other responses, the call setup is aborted.

[0040] INDUSTRIAL APPLICABILITY

[0041] Despite promising approaches in ISDN technology, no practical method for authenticating caller ID and dialed numbers has yet been established. The increasing use of digital communication over data networks has, in fact, increased the number of compromised interfaces and manipulable data.

[0042] The task is to meet the long-standing need for a device that is fail-safe and uses as little data capacity as possible, while effectively enabling the recipient to authenticate a caller ID and the associated phone number.

[0043] Based on the good approaches from the field of ISDN technology, the solution is achieved through a data channel, designed as a parallel, strictly assigned authentication network comprising a plurality of interfaces, which, apart from the purpose of authentication, does not provide any additional data payload. By consistently limiting the number of receivable data packets to a few bytes and the number of outputtable responses to a few bits, a high degree of redundancy is possible and permits implementation as a system-relevant security component. The surprisingly efficient authentication of caller ID and telephone number, using the simplest of devices, is thus achieved for the first time in a secure, encrypted, fast, adaptable, amnesic authentication network with a high level of reliability, before the network operators have to activate channels for user data or user communication.The required data capacity is minimal, and common fraud strategies can be effectively prevented. This significantly improves the reliability and efficiency of number-based communication, both ecologically and economically.

Claims

CLAIMS 1. Communication network with data channel, comprising a plurality of channels for user data and user communication and the parallel data channel, characterized in that - the parallel data channel consists of an authentication network comprising a plurality of interfaces, where - only one data packet containing a caller ID and a phone number is sent to the interfaces - as a requirement or as a request - can be entered.

2. Communication network according to the preceding claim, characterized in that only a few bits long response can be output via the interfaces.

3. Communication network according to the preceding claim, characterized in that the response as call-related information exclusively comprises 2 bits for statements, the statements consisting of the group of statements consisting of 'valid', 'ID invalid', 'number invalid' and 'invalid'.

4. Communication network according to one of the preceding claims, characterized in that the interfaces are designed to permit only encrypted and / or secured communication.

5. Communication network according to one of the preceding claims, characterized in that the interfaces are configured as a peer-to-peer network with redundant multiple storage of the incoming data. 6 . Communication network according to one of the preceding claims, characterized in that the interfaces are synchronized via at least one clock.

7. Communication network according to one of the preceding claims, characterized in that data packets in the authentication network can be provided with a time stamp upon arrival.

8. Communication network according to one of the preceding claims, characterized in that the authentication network is constructed amnesically, wherein at least received data packets cannot be stored permanently.

9. Communication network according to the two preceding claims, characterized in that data packets have a maximum storage time of 300 seconds, preferably 50 to 150 seconds, particularly preferably 70 to 120 seconds. 10 . Communications network according to all preceding claims .

11. Communications network according to the preceding claim, wherein the call-related information can be stored at the user data level for further analysis and misuse prevention according to known devices and measures.