DE102005046377B3 - Preventing reception of unwanted messages in Internet Protocol communications network involves storing signaling data in list related to signaling route of communications connection between trusted first subscriber and second subscriber - Google Patents

Abstract

The method involves storing originator data (A) of a trusted first subscriber (A) in a list (WL) associated with a second subscriber (B) for managing subscriber-specific data in relation to trusted subscribers. It involves storing signaling data in the list related to the signaling route of a communications connection between the trusted first subscriber and the second subscriber : An independent claim is also included for a storage system for preventing reception of unwanted messages in Internet Protocol communications network.

Description

The The invention relates to a method and a device for avoidance the reception of unwanted News, in particular so-called spam over Internet telephony messages, abbreviated SPIT messages, in an IP communication network.

Of the The term "spamming" refers to the masses Sending unwanted News ("spam"). "Spamming" is favored by the simple and cheap Access to electronic media, which is generally available in the short term and cost the sending of messages to a large number of recipients enable. The content of such "spam" messages is often of a commercial nature, with "spam" of dubious content predominating. A well-known form of "spam" is the massive one Sending e-mails for advertising purposes. Besides e-mail "spam" there are more Forms such as "spam" regarding instant Messaging, Usenet newsgroups, WWW search engines, weblogs or mobile communications.

As already mentioned spam is favored by that the causers, for example, advertisers, almost none effective costs aside from managing the appropriate email address lists caused by the "spamming" the obvious disadvantages caused by shipping unwanted News for the respective recipient arise, causing "spamming" meanwhile high Costs to be borne by the general public. These are for an indirect cost, for example, due to productivity loss or overcrowded electronic mailboxes arise. Even more serious are the costs of each affected infrastructure providers, such as Internet Service Providers (ISP) arise: Often is an increase in the band width capacities necessary because the existing Bandwidths are no longer sufficient to handle the flood of "spams".

Although "spamming" is outlawed by the general public and the legal situation in Germany and other countries is currently being adjusted, rather takes the "spamming", because the hurdle for this Type of message delivery is very low.

With the increasing spread of Internet telephony (Voice over IP, short VoIP) is expected that VoIP subscribers increasingly so-called SPIT (SPAM over Internet Telephony) will be exposed. Currently Make calls to conventional PSTN subscribers (PSTN Public Switched Telephone Network) usually always at the expense of the caller billed. Calls to VoIP subscribers can however, due to the deviating billing model for the caller almost free of charge become what a massive SPIT advent for the future can be expected. Especially the possibility, to send recorded voice files in bulk, is likely for advertisers to be interesting. It is assumed that the affected VoIP subscribers to their respective VoIP provider to take appropriate action be in order to avoid unwanted Call protected to be.

While in the PSTN connections are circuit-switched or can be made in the mobile identification via the SIM card of the caller, identification of a caller in IP telephony is problematic:
Communication between two subscribers takes place only virtually from endpoint to endpoint, since these are packet-switched connections.

When countermeasure against SPIT, among other things, so-called White Lists (English: White lists). A white one List contains for one Participant X participant-specific information about such others Participants Y in the communication network, which are classified as trustworthy and are therefore entitled to call subscriber X.

such white However, lists do not provide protection against SPIT when a SPIT originator For example, its sender address in the SIP header of the SPIT message falsifies, for example, by adding a sender address from the White List of the called subscriber X abusive as his sender address used.

From the publication DE 10 2004 054 900 A1 is a method for automatically analyzing an e-mail known in which the signaling route of an e-mail is analyzed. In case the e-mail was sent over untrusted signaling points, the e-mail is treated as spam. However, this method is not applicable to Internet telephony.

The The object of the invention is a method and a device to avoid receiving unwanted messages in an IP communication network embody.

This object is achieved by the features of claim 1 with regard to the method and by the features of claim 9 with respect to the device. Further developments of the invent tion are given in the dependent claims.

object The invention is a method for avoiding unwanted reception News, in particular so-called spam over Internet telephony messages, abbreviated SPIT messages in an IP communication network, thus sender data of a trusted first Subscriber in a list associated with a second subscriber for managing subscriber-specific data regarding trusted participants get saved. additional are signaling data regarding the signaling route of a communication link between the trusted first participant and the second participant in the list.

Farther The invention relates to a device for carrying out the illustrated method.

The Invention has the advantage that the reception of unwanted News is significantly reduced.

One embodiment The invention is illustrated in the drawing and will be described below described in more detail.

It shows:

1 Schematic structure of a communication connection

1 shows the schematic structure of a communication link C and the storage of subscriber-specific data D _x . The term "subscriber-specific data D _x " here summarizes sender data D _{1 of} the first subscriber A and signaling data D ₂ with respect to the signaling route of the communication link C. A first subscriber A sets up a communication link C to a second subscriber B. The sender data D _{1 of} the first Subscriber A are stored in a so-called whitelist WL (White List) assigned to the second subscriber B. In addition to the sender data D ₁ , signaling data D ₂ relating to the signaling route of the communication link C between the trusted first subscriber A and the second subscriber B are stored in the list WL The signaling data D ₂ with respect to the signaling route of the communication connection C are, for example, in the case of the SIP protocol through the relay header fields "Via: ..." and / or "Record Route: ..." represents. Relay header fields make it possible to trace the signaling route of a communication link C.

In one embodiment of the invention, a new connection request for a communication connection C between the first subscriber A and the second subscriber B is checked as to whether the sender data D _{1 of} the first subscriber A matches one or more entries in the list WL of the second subscriber B. In addition, for the connection request, it is checked whether the entries in the relay header fields match the connection question with one or more entries in the list WL. If this is the case, the connection request is accepted, otherwise the connection question is rejected, for example, and / or redirected to, for example, a voicebox system.

In an expression The invention is a complete match of the entries in the relay header fields of a connection request with one or more several entries in the list WL requirement for a successful connection.

In another expression the invention is additionally to match of the entries in the relay header fields of a connection request, the sequence checked the relay header fields. The Connection request is accepted only if the sequence of Relay header fields of the current connection request with one or matches multiple stored sequences in list WL.

In another expression The invention compares the sequence of relay header fields a connection request in the course of the calculation of a similarity value. The connection request is in this case depending from the calculated similarity value and a limit. For example, the connection request accepted if the calculated similarity value exceeds the Limit value is. The limit is, for example, the network operator preset and / or adjustable by the second participant B.

The calculation of the similarity value is based on the comparison of a known sequence of relay header fields stored in the list WL as trusted with the sequence of the relay header fields of the new connection request. An example of such a comparison is shown below:
Participant Alice is with the sender address
"From: Alice <sip: alice@atlanta.example.com>" in the WL list of Participant Bob Additionally, the following Relay headers were recorded at the last contact:
Via: SIP / 2.0 / TCP ss2.biloxi.example.com:5060; branch = z9hG4bK72 ...
Via: SIP / 2.0 / TCP ssl.atlanta.example.com:5060; branch = z9hG4bK2d ...; received = 192.0.2.111
Via: SIP / 2.0 / TCP client.atlanta.example.com:5060;branch=z9hG4bK74 ...; received = 192.0.2.101
Max forwards: 68
Record route: <sip: ss2.biloxi.example.com; lr>,
<Sip: ssl.atlanta.example.com; lr>

The following relay headers are sent for a new call:
Via: SIP / 2.0 / TCP ss2.biloxi.example.com:5060;branch=z7ff3bK72 ...
Via: SIP / 2.0 / TCP ssl.atlanta.example.com:5060;branch=z7ff3bK2c ...; received = 192.0.2.111
Via: SIP / 2.0 / TCP client.atlanta.example.com:5060;branch=z7ff3bK78 ...; received = 192.0.2.101
Max forwards: 68
Record route: <sip: ss2.biloxi.example.com; lr>,
<Sip: ssl.atlanta.example.com; lr>

Of the New incoming call is accepted as the relay header is complete with the already known and in the whitelist WL of the participant Bob stored sequence match. The "branch" entries will be not included in the comparison.

In a new message to subscriber Bob, a SPIT originator uses a fake sender address by entering the sender address of subscriber Alice in the header of the message. The transmitted relay header fields of this SPIT message have the following content, for example:
Via: SIP / 2.0 / TCP ss2.biloxi.example.com:5060; branch = zayT4bK72 ...
Via: SIP / 2.0 / TCP ss5.siphub.att.com:5060; branch = zayT4bK2 ...; received = 192.5.7.20
Via: SIP / 2.0 / TCP sipsrv.sprint.com:5060; branch = zayT4bK2 ...; received = 201.7.8.2
Via: SIP / 2.0 / TCP sl.sprint.com:5060; branch = zayT4bK2 ...; received = 201.7.8.20
Via: SIP / 2.0 / TCP client.atlanta.example.com:5060; branch = zayT4bK7 ...; received = 192.0.1.1
Max forwards: 65
Record route: <sip: ss2.biloxi.example.com; lr>,
<sip: ss5.siphub.att.com; lr>, <sip: sipsrv.sprint.com; lr>,
<Sip: sl.sprint.com.lr>

Of the Comparison of the relay header sequence of this message leads to Rejection of the message, because except the sequence of relay headers depends heavily on the first and last entry of a "via" header the known and in the white List of the participant Bob's stored sequence differs.

Of the in one form Similarity value to be calculated according to the invention is for example by comparing the relay header line by line a new incoming message calculable. The similarity value corresponds, for example, the degree of agreement between the Sequence of the Relay header of the new message and the known and in the whites List of the participant Bob saved relay header sequence and is represented by a percentage, for example. For example for the Calculation of the similarity value the number of relay header entries of the new incoming message used: Diverge this number from the number of relay header entries in one or more known and in the whitelist of the participant Bob stored Relay header sequences falls, the calculated similarity value smaller than for Messages whose number of relay header entries equals the number of relay header entries in the known and in the whites List of the participant Bob corresponds to stored relay header sequences. The one in another form The invention adjustable threshold serves as a threshold, the the similarity value the relay header sequence of the new call must be exceeded for that to happen the new call is accepted.

Another variant of the calculation of the similarity value compares the relay header sequence of the new call with stored relay header sequences as follows:
Let v1 through vN be the N for a caller A at a destination subscriber B in the white list entered "Via" header, where N is the number of headers entered in the White List for A.

• 1. In beide Listen werden Leerelemente eingefügt, so dass in den resultierenden Listen an einer Stelle j entweder beide Listen dasselbe Element beinhalten oder eine der Listen ein Leerelement enthält. Beide Listen haben somit dieselbe Anzahl NX von Elementen.
• 2. Die Punktesumme SP wird durch die Anzahl der Leerelemente in beiden Listen bestimmt. Dabei zählen Leerelemente an der ersten oder letzten Stelle einer Liste doppelt.
• 3. Der Ähnlichkeitswert wird berechnet als AW = 1 – SP/SN, wobei SN = NX + 2 gesetzt wird.

If, on a new call from caller A, the "via" headers w1, w2, ..., wM are received, the following steps are performed on two lists, the first list being the list of "via" known to caller A - Header from the whitelist and the second list contains the "Via" header of the new call:

• 1. Blank elements are inserted into both lists, so that in the resulting lists at a position j either both lists contain the same element or one of the lists contains a blank element. Both lists thus have the same number NX of elements.
• 2. The sum of points SP is determined by the number of empty elements in both lists. In this case, empty elements at the first or last position of a list count twice.
• 3. The similarity value is calculated as AW = 1 - SP / SN, where SN = NX + 2 is set.

If in step 2 the empty elements at the first or last list position are weighted differently (eg k times), then SN = NX + 2 * (k-1) too put.

Example of a new call:
N = 5
v1 = "p"
v2 = "q"
v3 = "r"
v4 = "s"
v5 = "t"
M = 4
w1 = "u"
w2 = "p"
w3 = "r"
w4 = "t
after step 1 (inserting the empty elements):
NX = N '= M' = 6
v1 '= "", w1' = "u"
v2 '= "p", w2' = "p"
V3 '= "q", w3' = ""
v4 '= "r", w4' = "r"
v5 '= "s", w5' = ""
v6 '= "t", w6' = "t"
Step 2:
2 points for v1 ', 1 point each for w3' and w5 ', ie SP = 4 Step 3:
Sum SN = NX + 2 = 8, similarity value AW = 1 - SP / SN = 0.5

Further Variants of the calculation of the similarity value are conceivable.

In another expression The invention will be in the case of several in the White List WL stored, Relative to the subscriber Alice relay header sequences younger in time Posts the whites List when calculating the similarity value for the Relay header sequence of a new incoming message more heavily weighted as older in time Posts in the whites List WL. This has the advantage of misclassification of messages due to obsolete entries can be avoided in the list WL.

In another expression The invention is the whiteness List WL in case of classifying a new message as "non-SPIT" automatically Store the sequence of relay header entries of the new message in the List WL updated. The classification of the new message as "non-SPIT" is for example Manually by the participant vornehmbar. The update of the white For example, list WL is overridden by an existing one Entries regarding made by the calling subscriber and / or by supplementing the Posts the whites List WL by means of an alternative entry.

In another expression The invention derives a memory system for avoiding reception undesirable Messages a message for which a similarity value has been calculated according to the method described above, which is below a specified limit, for example a voicebox system.

In another expression The invention provides whiteness List WL a personal one white List WL of a subscriber B, for example, on the terminal of the subscriber B is stored.

In another expression The invention provides whiteness List WL a public white List WL, for example, on a publicly available Storage system is stored.

In another expression The invention provides whiteness List WL a net-based whitelist WL, for example, stored on a server system on the Internet is.

The inventive method is not limited to the above examples. Further Combinations and variants are conceivable.

Claims (11)

Method for preventing the reception of spam over Internet telephony messages, abbreviated SPIT messages, in an IP communication network, thus sender data (D ₁ ) of a trusted first subscriber (A) in a list (WL) assigned to a second subscriber (B) for the management of subscriber-specific data relating to trusted subscribers, characterized in that signaling data (D ₂ ) relating to the signaling route of a communication connection (C) between the trusted first subscriber (A) and the second subscriber (B) are stored in the list (WL) , A method according to claim 1, characterized in that the sequence of the signaling data (D ₂ ) is stored with respect to the signaling route in the list (WL). Method according to one of the preceding claims, characterized in that in the case of a connection request, a comparison of the sequence of signaling data (D ₂ ) takes place with respect to the signaling route of the connection request with in the list (WL) stored sequences of signaling data. Method according to one of the preceding claims, characterized in that in the case of an unknown sequence of signaling data (D ₂ ) with respect to the signaling route, the connection request is rejected. A method according to claim 1 to 3, characterized in that in the case of a known sequence of signaling data (D ₂ ) with respect to the signaling route, the connection request is accepted. A method according to claim 3 to 5, characterized in that the comparison of the sequence of signaling data (D ₂ ) takes place with respect to the signaling route of the connection request in the course of a calculation of a similarity value. Method according to claim 6, characterized in that the calculation of similarity value by comparing the relay header fields of the connection request line by line with trusted sequences of relay header fields stored in the list (WL) he follows. A method according to claim 6 to 7, characterized in that the connection request depending on from the calculated similarity value and a limit is accepted if the calculated similarity value is above the Limit value is. Memory system for preventing the reception of spam over Internet telephony messages, abbreviated SPIT messages, in an IP communication network with means for storing sender data (D ₁ ) of a trusted first party (A) in a list associated with a second party (B) (WL) for managing subscriber-specific data relating to trusted subscribers, characterized by means for storing signaling data (D ₂ ) relating to the signaling route of a communication connection (C) between the trusted first subscriber (A) and the second subscriber (B) in the list (WL ). A memory system according to claim 9, wherein the sequence of signaling data (D ₂₎ with respect to the signaling route a communication connection (C) is stored. A memory system according to claim 9 or 10 having means for comparing the sequence of the signaling data (D ₂₎ with respect to the signaling route of the connection request with the list (WL) stored sequences of signaling data in case of a connection request.