Phishing Call Detection via Signed Attribute Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting and preventing fraudulent or phishing phone calls are ineffective, as they can be easily spoofed and result in high false positives, lacking reliable verification of caller identity or attributes.
Innovation Solution
A call security management system that uses verified attributes, where a trusted authority server signs attributes such as caller identity or call topics, which are then validated by the receiving device using public keys, allowing comparison with the call content to flag potentially fraudulent calls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If voice recognition or caller ID checking is used to detect fraudulent callers, then caller identification capability is improved, but reliability is worsened because these methods can be easily spoofed by sophisticated fraudulent callers
Solution Approach 1:
The patent introduces a trusted authority server as an intermediary that issues signed certificates to legitimate callers. The receiving device validates these certificates through cryptographic verification, creating a trusted chain of verification that cannot be spoofed. This intermediary system resolves the contradiction by providing a reliable verification mechanism that goes beyond simple voice recognition or caller ID checking.
Solution Approach 2:
The patent replaces mechanical verification methods (voice recognition, caller ID matching) with cryptographic verification mechanisms. By using digital signatures and certificate validation, the system achieves reliable verification that is resistant to spoofing, substituting the unreliable mechanical systems with mathematically secure cryptographic protocols.
2Difficulty of detecting and measuring
If keyword detection is used to identify potentially fraudulent calls, then detection capability is improved, but false positive rate increases because the system cannot reliably verify keywords for legitimate calls
Solution Approach 1:
The patent performs preliminary verification of caller identity through certificate validation before the actual call content is analyzed. By establishing the caller's legitimacy in advance through cryptographic verification, the system can then reliably analyze call keywords without generating false positives, as the caller's identity and authority have already been confirmed.
Solution Approach 2:
The system uses the validated certificate information as feedback to guide keyword analysis. When a caller's certificate is verified, the system adjusts its keyword detection thresholds and interpretation, understanding the context of what keywords are appropriate for that verified entity, thereby reducing false positives while maintaining detection capability.
3Device complexity
If no verification system is implemented for phone calls, then device complexity is reduced, but security is worsened as there is no way to verify caller identity or call purpose
Solution Approach 1:
The patent extracts the complex verification logic from the receiving device and places it on the trusted authority server and sending device. The receiving device only needs to perform relatively simple certificate validation operations, while the complex certificate issuance and management functions are located elsewhere. This distribution of complexity reduces the burden on the receiving device while maintaining strong security.
Data Source
AI summary
A method for detecting and preventing phishing phone calls through verified attribute analysis is described. The method may comprise receiving, by a receiving device, a phone call from a sending device and receiving identification data in parallel with the phone call, the identification data describing context of the phone call. The method may then identify an attribute assertion from the identification data. The attribute assertion may comprise a signed attribute of the phone call and may be signed by a trusted authority. The method may comprise determining content of the phone call, analyzing the content of the phone call against the signed attribute, and performing a defined operation based on a result of the analysis of the content against the signed attribute.