KR100934219B1 - Internet Protocol Multimedia Spam Response Device and Method in Internet Protocol Multimedia Service Provision Network - Google Patents

Abstract

The present invention is to classify calls of IP multimedia application services by service characteristics in response to IP multimedia spam in application servers of various real-time Internet protocol (IP) multimedia application service networks, and to verify policy information of calls classified by service characteristics. If there is no policy information, filtering is performed to verify whether the call is spam or not through the dynamic filtering mechanism for each application service, and the appropriate call processing of the call is determined based on the policy information verification result or the filtering result. By delivering to the network, the IP server provides spam response services suitable for various call processing and media characteristics of the IP multimedia application at the application server layer without changing the network structure. There is a corresponding effect.

Description

Apparatus and method for dealing with Internet protocol multimedia spam in an internet protocol multimedia service providing network {APPARATUS AND METHOD FOR COUNTERING SPAM OF IP MULTIMEDIA FOR IN IP MULTIMEDIA SERVICE PROVIDE NETWORK}

The present invention relates to an internet protocol (IP) multimedia service providing network, and more particularly, to an apparatus and method for responding to an internet protocol multimedia spam in an internet protocol (IP) multimedia service providing network.

Recently, emerging Internet Protocol (hereinafter referred to as IP) multimedia applications, such as Instance Messaging and Internet Telephony (VoIP), are rapidly replacing traditional means of communication. It is threatened by the attack. Spam generally means "unsolicited commercial email." Thus, traditional spam can be extended not only to e-mail but also to unwanted messages or calls targeted to new IP multimedia applications. Spam for these new applications is sometimes referred to as Spam for Instance Messaging (SPIM) and Spam for Internet Telephony (SPIT), and SPIT is also called Voice or VoIP Spam (VAM).

All of these real-time IP multimedia application services should have different responses depending on the characteristics of the service.

Spam for instant messaging has much in common with email spam, including their content, deceptive subject lines, and manipulated sender names. However, because instant messaging is a real-time service, email spam techniques that process mail stored on the server cannot be applied to the filtering of instant messaging spam. Therefore, the prior art performs spam detection and extraction using both an address line search and a content search method instead of an email spam.

And, unlike text messages in instant messaging, spam on Internet phones is unlikely to be detected in the voice and video messages of Internet phones by detection mechanisms by subject or content checks in the subject line. have. Therefore, in the case of Internet telephony, a service provider may use a method of filtering an address by exposing the sender's caller indication on all advertisement calls as one of spam regulation policies or introducing an authentication key to all senders and receivers.

However, until now, the threat of spam on these real-time IP multimedia application services is not seen as an urgent threat such as e-mail spam or mobile phone spam. Therefore, the countermeasures against such potential threats are not actively studied.

Meanwhile, in a network provided with an IP multimedia application service, an application server such as an instance messaging server, a presence server, a VoIP proxy server, and the like provide a call connection and a distributed service to a core internet network for connection between user terminals.

Ultimately, however, many service providers are using integrated application servers for these applications to share and distribute core stacks and resources for those services. These services ultimately reside in the application server layer of the IMS platform. Can be mapped. Therefore, it is necessary to build an application server system with a system for responding to IP multimedia spam.

Accordingly, an embodiment of the present invention provides an IP multimedia application server system that provides a spam response mechanism for real-time IP multimedia applications in consideration of the present Internet IP multimedia service provision and the next generation of Internet evolution.

In the embodiment of the present invention, in the real-time IP multimedia application service providing network having various media characteristics, dynamic spam response modules suitable for each characteristic and spam response modules that can be easily ported to existing application servers are provided. The present invention provides an apparatus and method for responding to spam by building an expanded IP multimedia application server regardless of service type and easy to use and apply.

Therefore, the Internet protocol multimedia spam response apparatus in the Internet protocol multimedia service providing system for solving the problems of the present invention, a service for classifying all calls to the application server of the various real-time Internet protocol (IP) multimedia service providing system by application service broker; A spam correspondence control unit performing security management by exchanging policy and database information applied differently for each application service, and verifying whether each call is classified for each application service in the service broker and whether each spam is spam; Managing the policy information for each application service, the database information, and the filtering method determined to be applied for each application service, and delivering a corresponding policy to be applied at the request of the spam response controller to the spam response controller; Policy and database management interfaces; And a resource manager for managing resources required by the spam response controller.

The method for solving the problems of the present invention is a method for responding to IP multimedia spam in an application server in a variety of real-time Internet Protocol (IP) multimedia application service network, comprising: classifying a call of IP multimedia application services by service characteristics; Verifying policy information of a call classified according to the service characteristics; Performing filtering to verify whether the call is spam or not through the dynamic filtering mechanism for each application service if there is no policy information; And determining appropriate call processing of the call based on the policy information verification result or the filtering result and transferring the same to the lower network.

In accordance with the above-described problem, the present invention provides an anti-spam service suitable for various call processing and media characteristics of an IP multimedia application in an application server layer without changing the IP multimedia service network structure on the existing Internet and next-generation IMS platform. Providing an effective way to cope with spam in IP multimedia applications is diversifying.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In describing the present invention, if it is determined that detailed descriptions of related known functions or configurations may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

According to an embodiment of the present invention, an application server stage that receives a user's service request in a real-time Internet protocol (hereinafter referred to as IP) multimedia service providing network and processes a corresponding service dynamically adjusts a spam response policy and a mechanism suitable for the characteristics of the IP multimedia application. To respond to the appropriate spam by service characteristics. In other words, call setting and media characteristics of each application service such as VoIP, IM, presence, and IP conference are significantly different. Therefore, a spam response policy and mechanism suitable for each application service characteristic should be provided.

In the embodiment of the present invention, it should be noted that the IP multimedia application server does not necessarily implement each function designed for each module in one system, and does not limit an implementation method capable of providing the corresponding function. In addition, in the embodiments of the present invention, detailed descriptions of known functions such as call / message control elements of call or message, resource management, and lower network interface processing will be omitted. In this article, only the functions related to spam response will be briefly described.

1 is a diagram illustrating a structure of an internet protocol (IP) multimedia service providing network according to an embodiment of the present invention.

Referring to FIG. 1, the IP multimedia service providing network includes a plurality of application servers 20, a plurality of gateways 30, an IP connection network 40, resources & resources, which interoperate with the IMS core platform 10. It consists of an admission controller (50) and an IP transport (60), and a user device (70) is configured between the application server (20) and the IP connection network (40). Here, the gateway 30 is connected to the PSTN / SND 80, and the IP transport 60 is connected to the core IP network 90. The multimedia service providing network having such a structure is applicable to both the Internet and the next generation IMS platform.

The plurality of application servers 20 are connected to a core network such as the Internet or an IMS platform to provide network resources to application terminals. In addition, the plurality of application servers 20 provide various application services such as a user terminal for providing instant messaging, VoIP, and the like at both ends, an instant messaging server, a presence server, and a proxy server. The application server 20 is an apparatus for responding to IP multimedia spam, and provides a real-time IP multimedia application having various media characteristics such as VoIP, IM (Instance Messaging), Presence, and IP conference, which replaces PSTN communication. It is an extended application server that provides dynamic spam response policies and mechanisms tailored to the characteristics of each application.

Next, the application server for responding to the IP multimedia spam will be described in detail with reference to the accompanying drawings.

2 is a diagram illustrating a structure of an application server for responding to IP multimedia spam according to an embodiment of the present invention.

Referring to FIG. 2, the IP multimedia application server includes a service broker 110, a service event router 120, a spam response controller 130, a policy and DB management interface 140, and a database 150. ), A resource manager 160, input / output units 181 and 182, a call / message control element unit 170, and a network element unit 190. Can provide.

The service broker 110 classifies incoming application services and receives information of each element (core protocol stack, media handling interface, network interface, etc.) of the network element unit 190 through the input unit 181. The distributed application service types include application services such as instant messaging, presence, VoIP, and conferencing.

The spam response controller 130 receives the classified application service through the service event router 120, and applies policy and database information differently for each policy and database (DB) management interface 140 and the application service. Security management is performed by exchanging. In addition, the spam response controller 130 verifies whether or not the incoming calls are classified by service characteristics, that is, the calls to be filtered as spam and the calls to be safely delivered, and then through the output unit 182. The call determined by the call / message control element 170 is transmitted.

The policy and database (DB) management interface 140 manages security and authentication policy information for each service that the service provider has, and performs such communication when communication with an external public key center is required. The policy and DB management interface 140 manages not only a key policy but also policy information on a filtering method (dynamic filtering mechanism, etc.) determined to be applied by a service provider for each service. That is, it serves as a relay for exchanging DB update information between the spam response control unit 130 and the database unit 150. This will be described later with reference to FIGS. 3 and 4.

The database 150 includes a white list 151, a black list 152, an evaluation reflection DB 153, and other service DBs 154.

The resource manager 160 manages network resources and transmits / receives necessary resources in association with the spam response controller 130.

Meanwhile, the spam response controller 130 includes a security manager 131 and a filter manager 132, and the filtering manager 132 may include an address filtering unit (B) to verify whether or not the incoming call is spam. Address Filtering 133 and Contents Filtering 134 operate in a modular manner. Next, a detailed structure for coping with spam by the security manager 131 and the filter manager 132 will be described with reference to the accompanying drawings.

FIG. 5 is a diagram illustrating an operation for responding to IP multimedia spam in the security management unit illustrated in FIG. 2.

Referring to FIG. 5, the security manager 131 includes an event queue 201 that receives a call classified by the service from the service event router 120, a policy information, and a policy and DB management interface 140. The policy request unit 202, the requesting mechanism for receiving the mechanisms, and the verification unit 203 and the call determination handler 204 may be configured, and the key and authentication information for the received call using the received policy information. Verify. Here, the verification unit 203 searches whether the received policy information and mechanisms have an authentication key policy for each domain of a service attacker, and if there is an authentication key policy for each domain, searches for a key policy for each user. The call determination handler 204 classifies call processing according to the search result of the verification unit 203 and transfers the call to the call / message control element unit 170.

FIG. 6 is a diagram illustrating an operation for responding to IP multimedia spam in the filter manager illustrated in FIG. 2.

Referring to FIG. 6, the filter manager 132 may include an event queue 401 that receives a call without policy information from the security manager 131, and a corresponding filtering mechanism from the policy and database management interface 140. A policy request unit 402 for calling an address and an address filter unit 403 and a content filter unit 404 for filtering spam by searching the address and content of a call without the policy information using the called filtering mechanism. Can be configured. The filter manager 132 further includes a call decision handler 405 for classifying call processing and delivering the call to the call / message control element unit 170.

The operation for exchanging the information according to the policy exchange and the DB update information between the security management unit 131 and the filter management unit 132 and the policy and DB management interface unit 140 in the spam response control unit 130 is attached. This will be described with reference to FIGS. 3 and 4.

Referring to FIG. 3, the security manager 131 requests a policy and DB information on the call (Request Policy (Domain ID, Key) / (User ID, Key)) to the policy and DB management interface 140. Send it. Accordingly, the security manager 131 receives a confirmation policy message including the requested policy information (Domain ID, Key) / (User ID, Key) from the policy and DB management interface unit 140 and inputs the call. Verify the key and authentication information for. In addition, the filter manager 132 receives a policy request from the policy and the DB management interface 140, and a service ID, a policy ID, and a list ID for the incoming call. ID) is received and the corresponding mechanism is driven, and a response (Confirm Policy) is transmitted to the policy and DB management interface 140.

Meanwhile, referring to FIG. 4, the security manager 131 of the spam response controller 130 exchanges information (Service ID, List IDs, etc.) related to DB update with the policy and DB management interface 140 and filters. The management unit 132 exchanges information (Domain ID / User ID, List ID) about DB update. In this exchange process, a DB update such as spammer registration or new value registration in the evaluation reflection database 153 is required. Therefore, a value changed for each ID may occur according to a DB value or a policy for each service ID, and the changed value is reflected by communicating with the policy and the DB management interface 140.

Next, specific operations of the security manager 131 and the filter manager of the spam response controller 130 will be described with reference to the accompanying drawings.

FIG. 5 is a diagram illustrating an operation for responding to IP multimedia spam in the security management unit illustrated in FIG. 2.

First, all calls inputted to verify whether there is a security policy applied by the service provider are transmitted to the security manager 131.

Accordingly, referring to FIG. 5, the event queue 201 of the security manager 131 receives a call from the service event router 120, and generates an event for the policy request unit 202. Accordingly, the policy request unit 202 transmits the policy request message to the policy and DB management interface 140 to receive the policy information through the response message.

Then, the verification unit 203 of the security management unit authenticates each call input in steps 301 to 303 for each service provider's domain and checks whether there is an authentication key policy applied in the received policy information. If there is an authentication key policy as in step 302, it is additionally checked whether there is a user key policy in steps 304 to 306.

Then, in all cases where the authentication policy should be reflected, the security management unit 131 checks whether an appropriate key value and other authentication information is included, and rejects it through the internal decision handler 204. It is divided into drop, mark, report, accept, and the like, and transferred to a call / message control element 170 for proper call processing.

If there is no domain authentication key policy as shown in step 307, the security manager 131 proceeds to step 304 to check whether only the user key policy is applied. After step 302 and step 307, the verification unit 203 checks the user key policy as shown in step 308 and passes it to the filter management unit 132 for address and content search to verify whether the input call is spam if there is no special authentication policy. do.

Next, a dynamic policy application process for each service of the filter management unit in the spam response controller will be described.

FIG. 6 is a diagram illustrating an operation for responding to IP multimedia spam in the filter manager illustrated in FIG. 2.

Referring to FIG. 6, a dynamic thread operates for each call entering the event queue 301 through the security manager 131. Accordingly, when an event for each call coming from the event queue 301 is generated, the policy request unit 302 calls the filtering mechanism suitable for the service with the policy and DB management interface 140 to receive the filtering mechanism. Accordingly, the address filter 403 of the security management unit 131 searches for the address of the call without the policy information by using the received filtering mechanism to filter spam. The content filter 404 searches for the content of the call without the policy information by using the called filtering mechanism using the received filtering mechanism to filter spam. That is, in case of IM service, it basically consists of Buddy List, so the White List policy is managed, and spam filter is possible by keyword search of subject line and contents. Can be applied dynamically. On the other hand, in the case of Internet telephony services, content filtering is not possible with current technology, so address filtering can be applied. An embodiment of the present invention provides an operation of a system based on a policy of dynamically applying a filtering mechanism for each service, without being limited to a specific filtering mechanism.

As such, all calls passing through the filtering mechanism by applying the filtering policy are rejected, dropped, and displayed through the decision handler 405 as in the security management unit 131. mark ',' report ',' accept 'and the like, and are transferred to the' Call / Message Control Element 'for proper call processing.

As described above, the present invention provides an IP server application server system including a spam response policy and a mechanism suitable for various call setup and media characteristics. According to the present invention, the spam response control unit configured for each module provides a spam response mechanism for various applications through an interface between a service broker and a spam response controller even though IP multimedia application services are more diversified and media characteristics are different. It may be easy to expand to provide.

In addition, modularized Security Management and Filtering Management can be operated by dynamically calling various mechanisms according to media or service characteristics, so that the detailed mechanisms can be changed and expanded regardless of other service provisions. Can be provided.

Meanwhile, in the detailed description of the present invention, specific embodiments have been described, but various modifications are possible without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined not only by the scope of the following claims, but also by the equivalents of the claims.

1 is a diagram showing the structure of an Internet Protocol (IP) multimedia service providing network according to an embodiment of the present invention;

2 is a diagram illustrating a structure of an application server system for responding to IP multimedia spam according to an embodiment of the present invention;

3 and 4 are diagrams illustrating an information exchange state for security and filter management in an application server according to an embodiment of the present invention;

FIG. 5 is a diagram illustrating an operation for responding to IP multimedia spam in the security manager shown in FIG. 2;

FIG. 6 is a diagram illustrating an operation for responding to IP multimedia spam in the filter manager shown in FIG. 2; FIG.

Claims (10)

delete A service broker for classifying all calls coming to an application server of various real-time Internet protocol (IP) multimedia service providing networks by application services; A spam correspondence control unit performing security management by exchanging policy and database information applied differently for each application service, and verifying whether each call is classified for each application service in the service broker and whether each spam is spam; A policy for managing policy information for each application service, database information, and a filtering method determined to be applied for each application service, and delivering a corresponding policy to be applied according to a request of the spam response controller to the spam response controller. And a database management interface; A resource manager for managing resources required by the spam response controller; An input / output unit which transmits network elements to the service broker and classifies calls determined by the spam counterpart to the call / message control element unit; A service event router for transferring the calls classified by the service broker to the spam response controller; And And a database that is connected to the policy and database management interface and stores the result information according to the spam verification in the spam response controller. The method of claim 2, wherein the spam response control unit, Upon receiving the call classified by the application service through the service event router, request the policy information on the received call to the policy and database management interface, and use the received policy information to request the policy information on the received call. A security manager for verifying a key and authentication information; And And a filter management unit for searching spam and filtering the spam by searching the address and contents of the received call when there is no policy information on the received call. The method of claim 3, wherein the security management unit, An event queue configured to receive a call divided by the application service through the service event router; A policy request unit for receiving policy information from the policy and database management interface; A verification unit for searching whether the received policy information includes an authentication key policy for each domain of a service provider, and searching for the existence of a key policy for each user if the authentication key policy for each domain exists; And And a call determination handler for classifying call processing according to a search result of the verification unit and delivering the call to a call / message control element.   The method of claim 3, wherein the filter management unit, An event queue for receiving a call without policy information from the security manager; A policy request unit for calling a corresponding filtering mechanism from the policy and database management interface; An address filter unit for filtering spam by searching an address of a call without the policy information by using the called filtering mechanism; A content filter unit for searching spam and filtering spam by using the called filtering mechanism; And In the Internet protocol multimedia service providing network characterized in that it comprises a call determination handler for classifying the call processing according to the filtering result of the address filter unit and the content filter unit and forwards the call without the policy information to the call / message control element. Internet Protocol Multimedia Spam Response Device. A method for responding to IP multimedia spam in an application server in various real-time Internet protocol (IP) multimedia application service networks, Classifying calls of IP multimedia application services by service characteristics; Verifying policy information of a call classified according to the service characteristics; Performing filtering to verify whether the call is spam or not through the dynamic filtering mechanism for each application service if there is no policy information; And Determining the appropriate call processing of the call according to the policy information verification result or the filtering performance result and transferring the same to the lower network; The process of verifying the policy information of the call classified by the service characteristics, Requesting policy information from a policy and a database management interface when a call classified according to the service characteristics is received; Searching whether there is an authentication key policy of each service provider in policy information received according to the request; Retrieving whether there is a key policy for each user in the policy information when the authentication key policy for each domain exists; And And classifying call processing according to the key policy search result for each user and transferring the received call to a call / message control element. The method of claim 6, And exchanging information regarding a database update according to the verification of the policy information and the performing of the filtering. delete The method of claim 6, And transmitting the received call to a filter manager for verifying spam, if there is no authentication key policy for each domain. The method of claim 6, wherein the filtering to verify whether the call is spam or not through the dynamic filtering mechanism for each application service is performed. Upon receiving a call without the policy information, invoking a filtering mechanism of the received call; Performing spam filtering by searching the address and contents of the received call using the called filtering mechanism; And And classifying call processing according to the spam filtering result, and forwarding the received call to a call / message control element.

Images