WO2022176074A1

WO2022176074A1 - Fraud suffering prevention system, fraud suffering prevention method, enum/dns server, and program

Info

Publication number: WO2022176074A1
Application number: PCT/JP2021/005978
Authority: WO
Inventors: 政憲秋本; 宏清水
Original assignee: 日本電信電話株式会社
Priority date: 2021-02-17
Filing date: 2021-02-17
Publication date: 2022-08-25
Also published as: JPWO2022176074A1

Abstract

This fraud suffering prevention system (1000) comprises a call processing server (20) and an ENUM/DNS server (10). The call processing server (20) comprises: a warning level determination requesting unit that transmits call source numbers and call destination numbers to the ENUM/DNS server (10); and a fraud preventing unit that executes a predetermined fraud suffering prevention process according to a warning level. The ENUM/DNS server (10) comprises: a number information updating unit that acquires fraud number information and protection target number information from an external database (a number database 700); and a warning level determining unit that identifies the connection pattern of a connection request by use of the call source numbers and the call destination numbers and determines a warning level in accordance with the identified connection pattern.

Description

Fraud damage prevention system, fraud damage prevention method, ENUM/DNS server, and program

The present invention relates to a fraud damage prevention system, a fraud damage prevention method, an ENUM/DNS server, and a program that prevent fraud damage using telephones.

In recent years, the damage caused by remittance fraud (special fraud) has spread, and in particular, it's "It's me" fraud that uses telephones, which accounts for nearly half of the methods of special fraud. "It's me" fraud is a method of defrauding someone by pretending to be a relative (son, grandson, etc.) and defrauding them of money on the pretext of "I suddenly need money." The number of victims of special frauds (fictitious billing frauds, loan security deposit frauds, refund frauds, etc.), including "It's me" frauds, remains at a high level, exceeding 16,000 in FY2019.

In view of the fact that many fraud cases using telephones, such as the "It's me" fraud, have occurred, there is a technique in which the called party issues an announcement to warn against fraud before answering the telephone, or regulates the call ( For example, see Non-Patent Document 1).

For example, as shown in FIG. 10, an incoming call rejection list 101 is registered in advance in the incoming call destination device 50 located on the incoming call side. Then, in the destination device 50, the call information (originator number) of the signal received from the call processing server 20a is collated with the call rejection list 101, and the matched call is restricted or the guidance device 30a calls attention. to run. Here, the destination device 50 is, for example, an IP (Internet Protocol) telephone (receiving terminal 5) provided in each home, a PBX (Private Branch eXchange) (not shown), or the like.

In addition, we have developed a technology that records the content of calls, transfers the audio file to a special fraud countermeasure server, determines whether or not the call is a special fraud by AI (Artificial Intelligence) analysis, and notifies an alarm to call attention. (See Non-Patent Document 2).

However, there are the following problems when using the conventional technology to prevent fraud using telephones.
As in the technique described in Non-Patent Document 1, when the guidance device is used to call attention, the user of the telephone service having the destination device 50 needs to prepare a special anti-fraud guidance device. The call rejection list 101 can be created by the user or by a service provider and updated. Anti-fraud measures may be less effective.

Also, with the technology described in Non-Patent Document 2, it is necessary to record the content of the call once and then analyze it with AI. Therefore, since it is necessary to have a conversation with the malicious person of the special fraud once, it is a burden for the user, and there is a problem in terms of immediacy because it is assumed that the call is completed. Furthermore, there is a possibility that the first call may lead to damage to the user.

The present invention has been made in view of these points. An object of the present invention is to perform effective fraud damage prevention processing before starting.

A fraud damage prevention system according to the present invention includes a call processing server that connects a call originating device and a destination device, and an ENUM/ and a DNS server, wherein when the call processing server receives a connection request from the call originating device, the originating number of the originating device and the destination number of the called device are attached. a security level determination request unit that transmits a security level determination request to the ENUM/DNS server; and a security level determination result regarding the connection request from the ENUM/DNS server, and a predetermined fraud damage according to the security level. a fraud prevention processing unit that executes prevention processing, wherein the ENUM/DNS server is a fraud number information registering a fraud number indicating a number subject to fraud countermeasures, and a target to be protected from fraud damage. Number information for updating the fraudulent number information and the protected number information stored in the storage unit by acquiring the protected number information in which the protected number indicating the user's number is registered from the external database at predetermined time intervals. Using the update unit and the caller number and destination number attached to the alert level determination request, whether or not the caller number is registered in the fraudulent number information or the protected number information; The connection pattern of the connection request is determined by determining whether or not the destination number is registered in the fraudulent number information or the protected number information, and fraud damage occurs according to the determined connection pattern. and a caution level determination unit that determines a caution level that evaluates that the fraud damage prevention processing of a higher level is required as the possibility is higher.

According to the present invention, when preventing fraud using a telephone, the network side closer to the originating device (originating terminal) rather than the called party performs effective fraud prevention processing before the call starts. can be executed.

BRIEF DESCRIPTION OF THE DRAWINGS It is a figure which shows the whole structure of the fraud damage prevention system which concerns on this embodiment. It is a functional block diagram showing a configuration example of an ENUM/DNS server according to the present embodiment. It is a figure which shows the data structural example of the fraud number information which concerns on this embodiment. 3 is a diagram showing a data configuration example of protected number information according to the present embodiment; FIG. FIG. 4 is a diagram showing an example of alert levels associated with connection patterns of callers and callees; 3 is a functional block diagram showing a configuration example of a call processing server according to this embodiment; FIG. It is a figure explaining the example of the caution level countermeasure information which concerns on this embodiment. It is a sequence diagram which shows the flow of processing of the fraud damage prevention system which concerns on this embodiment. 2 is a hardware configuration diagram showing an example of a computer that implements functions of an ENUM/DNS server and a call processing server according to the present embodiment; FIG. 1 is a diagram for explaining a conventional system for preventing fraud on the receiving side; FIG.

Next, a mode for carrying out the present invention (hereinafter referred to as "this embodiment") will be described. First, the outline of the present invention will be explained.

<Overview>
The fraud damage prevention system according to the present embodiment (see FIG. 1 described later) has functions for preventing fraud damage by telephone (such as a function to regulate calls and a function to play guidance using a guidance device). It is characterized in that it is provided on the network side without
More specifically, in addition to information on the blacklist that is the target of fraud countermeasures (hereinafter referred to as "fraudulent number information"), information on the user number list that is the target of fraud protection (hereinafter referred to as " Protected Number Information”) is provided by an ENUM (E.164 Number Mapping)/DNS (Domain Name System) server. Conventionally, a call processing server and an ENUM/DNS server perform connection destination information resolution processing and perform call connection between a calling terminal and a called terminal, and this ENUM/DNS system is utilized. In the fraud damage prevention system according to the present embodiment, the ENUM/DNS server that receives an inquiry from the call processing server refers to the fraud number information and the protected number information based on both the caller number and the destination number. to determine the alert level. The call processing server obtains information on the alert level determined by the ENUM/DNS server, and according to the alert level, restricts calls as preset fraud prevention processing (predetermined fraud prevention processing). (call disconnection) and delivery of guidance by the guidance device.

In addition, the ENUM/DNS server uses the ENUM/DNS protocol from an external database ("number database 700" described later) of an administrative agency or the like that stores the latest fraud number information and protected number information. Obtain and update the fraud number information and the protected number information at intervals (for example, in real time or at regular intervals).
As a result, the fraud damage prevention system according to the present embodiment prevents fraud damage more effectively than the conventional technology before the call starts on the network side closer to the originating device (originating terminal) rather than on the receiving side. Processing can be performed.
Regarding the ENUM/DNS server, Non-Patent Document 3 (“TTC Standard JJ-90.31 Carrier ENUM Interconnection Common Interface” Version 4.0, August 29, 2018, General Incorporated Association Information and Communication Technology Committee) I'm familiar with
A fraud damage prevention system of the present invention using this ENUM/DNS server will be described below.

<This embodiment>
FIG. 1 is a diagram showing the overall configuration of a fraud damage prevention system 1000 according to this embodiment.
A fraud damage prevention system 1000 according to the present embodiment, as shown in FIG. and

In the fraud damage prevention system 1000 according to this embodiment, the ENUM/DNS server 10 has fraud number information 110 and protected number information 120 . Then, using the interface between the ENUM/DNS server 10 already provided in the call processing server 20 as a conventional technique, the call processing server 20 generates the calling number and destination number for the call for which the connection request is received. to the ENUM/DNS server 10.
The ENUM/DNS server 10 determines whether the caller number is registered in the fraudulent number information 110 and whether the destination number is registered in the protected number information 120. to decide. In other words, the warning level is determined by judging whether the calling party is the number of the malicious person of the special fraud or the receiving party is the number of the protected party.
Furthermore, the ENUM/DNS server 10 determines whether the caller number is registered in the protected number information 120 and whether the destination number is registered in the fraudulent number information 110. determine the level. In other words, the warning level is determined by judging whether the caller is the number of the person to be protected or the caller is the number of the malicious person of the special fraud.

In this way, in the fraud damage prevention system 1000, the ENUM/DNS server 10 determines the pattern of the combination of the source number and the destination number ("connection pattern" to be described later), and the call from the fraud number to the protected number and calls from protected numbers to fraudulent numbers. Based on this vigilance level, the call processing server 20 executes fraud damage prevention processing (call control (call disconnection) and guidance delivery) before starting a call.
The ENUM/DNS server 10 and the call processing server 20 that constitute the fraud damage prevention system 1000 will be specifically described below.

≪ENUM/DNS Server≫
FIG. 2 is a functional block diagram showing a configuration example of the ENUM/DNS server 10 according to this embodiment.
The ENUM/DNS server 10 has a conventional function of returning connection destination information (routing information) of the destination number in response to an inquiry from the call processing server 20 . Furthermore, the ENUM/DNS server 10 acquires information on the originating number and the destination number from the call processing server 20 . Then, the ENUM/DNS server 10 determines whether the caller number is registered in the fraudulent number information 110 or the protected number information 120, and whether the destination number is registered in the fraudulent number information 110 or the protected number information 120. It determines whether or not it is safe, and determines the alert level. The ENUM/DNS server 10 returns information on the determined security level to the call processing server 20 .
This ENUM/DNS server 10 comprises an input/output unit 11 , a control unit 12 and a storage unit 13 .

The input/output unit 11 inputs and outputs information to and from other devices. For example, the input/output unit 11 transmits and receives information to and from the call processing server 20 and the number database 700 (FIG. 1). The input/output unit 11 includes a communication interface for transmitting and receiving information via a communication line, and an input/output interface for inputting and outputting information between an input device such as a keyboard (not shown) and an output device such as a monitor. Configured.

The storage unit 13 is configured by a hard disk, flash memory, RAM (Random Access Memory), or the like.
The storage unit 13 stores fraudulent number information 110, protected number information 120, and a connection destination information table 130. FIG.
The fraud number information 110 is information in which numbers (fraud numbers) targeted for fraud countermeasures are registered as a so-called blacklist.
The protected number information 120 is information registered as a number list of users to be protected from fraud damage.
The connection destination information table 130 stores connection destination information (routing information) in association with each destination number (telephone number of the destination terminal 5).
The storage unit 13 also temporarily stores a program for executing each function unit of the control unit 12 and information necessary for processing of the control unit 12 .

The control unit 12 controls the overall processing executed by the ENUM/DNS server 10, and includes a number information update unit 121, an alert level determination unit 122, and a connection destination information search unit 123.

Number information update unit 121 acquires fraud number information 110 and protected number information 120 at predetermined time intervals from number database 700 ( FIG. 1 ) provided outside fraud damage prevention system 1000 , and stores storage unit 13 . memorize to
The number database 700 is assumed to be an external database owned by an organization capable of collecting the latest special fraud damage information nationwide, for example, in an administrative agency (National Police Agency, Consumer Affairs Agency, Ministry of Internal Affairs and Communications, etc.). The fraud number information 110 stored in the number database 700 is updated based on the latest special fraud damage. Also, it is assumed that the protected number information 120 is registered by a user who is a victim of special fraud by applying to an administrative agency or the like. By doing so, it is possible to collect information on protected numbers without depending on the service provider company or communication carrier.

Fraud number information 110, as shown in FIG. registered as
As shown in FIG. 1, the protected number information 120 includes user (protected) numbers registered to prevent damage from special fraud, such as "03-5555-5555" and "0422-77-7777". It is registered like "06-6666-6666".

Further, as shown in FIG. 3, the fraud number information 110 may include fraud numbers and fraud types. In administrative agencies, etc., numbers used for specific special frauds that have actually occurred are registered, so the types of special frauds can also be registered at that time.
In FIG. 3, for example, the fraud type "It's me fraud" is registered in association with the fraud number "03-1111-1111". , a plurality of fraud types may be registered.

In addition, as shown in FIG. 4, the protected number information 120 may register the protected number and the type of fraud. In the application for registration of a protected number by a user, the registration of the type of fraud suffered in the past is accepted, and the information is recorded. At that time, the fraud type information may be left blank. For example, if the user has not yet been victimized by a special fraud, but has registered to prevent being victimized by a special fraud in the future, the field will be blank.

The number information update unit 121 acquires the fraud number information 110 and the protected number information 120 from the number database 700 (Fig. 1) using the ENUM/DNS protocol. The ENUM standard shown in Non-Patent Document 3 has specifications for storing and synchronizing data in real time using a real-time DB. Also in the ENUM/DNS server 10 according to the present embodiment, by adopting an information updating method using the ENUM/DNS protocol, the fraudulent number information 110 and the protected number information 120 can be updated in real time from the number database 700. is the most suitable example. However, the number information updating unit 121 may acquire the fraudulent number information 110 and the protected number information 120 from the number database 700 at predetermined time intervals such as regular intervals.

Returning to FIG. 2, the alert level determination unit 122 receives from the call processing server 20 an alert level determination request to which the caller number and destination number are attached. Then, caution level determination unit 122 first determines whether or not the caller number is registered in fraud number information 110 or protected number information 120 . The vigilance level determination unit 122 also determines whether or not the destination number is registered in the fraudulent number information 110 or the protected number information 120 .

Then, the caution level determination unit 122 determines the caution level as shown in FIG. 5 according to the connection pattern based on the determination result of the caller number and the destination number.
It should be noted that here, an example will be described in which there are five alert levels as a whole, and the higher the number, the higher the alert level. This warning level is for evaluating that the higher the possibility of fraud damage, the higher the level of fraud damage prevention processing required.

・Connection pattern <a>
If the caller number is not registered in the fraudulent number information 110 and the destination number is not registered in the protected number information 120, the warning level is "1".

・Connection pattern <b>
In connection pattern <b>, the caller number is not registered in the fraudulent number information 110, and the destination number is registered in the protected number information 120. This is the case of a call to This connection pattern <b> is assumed to be alert level "2".

・Connection pattern <c>
In connection pattern <c>, the caller number is registered in the fraudulent number information 110 and the destination number is not registered in the protected number information 120. This is the case of the call of This connection pattern <c> is assumed to be alert level "3".

・Connection pattern <d>
In the connection pattern <d>, the caller number is registered in the fraud number information 110, and the destination number is also registered in the protected number information 120. This is the case of "Call". This connection pattern <d> is assumed to be alert level "4".

3 and 4 are registered in the fraud number information 110 and the protected number information 120 in the case of the connection pattern <d>, the vigilance level determination unit 122 By referring to the type, for example, detailed caution level determination may be performed as in the following connection patterns <d-1>, <d-2>, and <d-3>. In this case, the fraud type of the fraudulent number of the originating terminal and the fraud type of the protected number of the destination terminal are different.

・Connection pattern <d-1>
In the case of "a call from a person with malicious intent who commits fraud to a protected person who is a victim of fictitious billing fraud", the warning level is set to "4-1".
・Connection pattern <d-2>
In the case of "a call from a malicious person who commits fraud to a protected person who is a victim of tax refund fraud", the alert level is set to "4-1".
・Connection pattern <d-3>
In the case of "a call from a malicious person involved in refund fraud to a protected person who is a victim of mere fraud," the alert level is set to "4-2."

It should be noted that alert level "4-1" (calls made by malicious persons involved in "it's me" fraud) and alert level "4-2" (calls made by malicious persons involved in refund fraud) are "4" as an alert level. , but with information identifying the fraud type of the Service-to-Self as a branch number. Other fraud types of malicious-to-Self-originated calls are similarly branched.

・Connection pattern <d-4>
In the case of "a call from a malicious person who is a fraud victim to a protected person who is a fraud victim", the alert level is set to "5".
Although illustration is omitted, there are also "calls from malicious persons involved in fictitious billing fraud to protected persons who suffered from fictitious billing" and "calls from malicious persons involved in refund fraud to protected persons affected by refund fraud". Similarly, the caution level is set to "5".
If the fraud type of the fraudulent number of the originating terminal and the fraud type of the protected number of the destination terminal are the same, it is a combination with a high possibility of suffering from special fraud, so the alert level is set to the highest. It is. This caution level "5" means a level at which a call is disconnected as a fraud damage prevention process, as shown in FIG. 7, which will be described later.

In addition, the following alert levels shall apply to calls originating from a person to be protected.
・Connection pattern <e>
If the caller number is registered in the protected number information 120 and the destination number is not registered in the fraudulent number information 110, that is, in the case of "a call from a protected person to a non-malicious person of special fraud" be. This connection pattern <e> is assumed to be alert level "1".

If the caller number is not registered in the protected number information 120 and the destination number is not registered in the fraudulent number information 110, that is, if "a call from a person other than a protected person , the alert level is set to "1". In addition, since the possibility of special fraud damage is low for "a call from a person to be protected to a person to be protected", the warning level is set to "1". "Call from malicious party of special fraud to malicious party of other special fraud" can be set arbitrarily, but since the possibility of general users being victimized by special fraud is low, the alert level may be set to "1". .

・Connection pattern <f>
In the connection pattern <f>, the caller number is registered in the protected number information 120, and the destination number is also registered in the fraud number information 110. This is the case of "Call". This connection pattern <f> is assumed to be alert level "5".
Even if the type of fraud is registered in the fraud number information 110 and the protected number information 120, if the call is from a protected party to a malicious party of a special fraud, the fraud type linked to the fraud number Also, regardless of the type of fraud damage suffered by the person to be protected, the possibility of new damage is high, so the caution level is set to "5".

The alert level determination unit 122 thus determines the alert level according to the connection pattern based on the determination result of the caller number and the destination number. Alert level determination unit 122 then returns information on the determined alert level to call processing server 20 .

Returning to FIG. 2, when the connection destination information search unit 123 receives an inquiry about the connection destination information (routing information) of the called party number (telephone number of the called terminal 5 (FIG. 1)) from the call processing server 20, The information table 130 is referenced to extract connection destination information (routing information) corresponding to the destination number and return it to the call processing server 20 .

In this way, the ENUM/DNS server 10 acquires the latest fraudulent number information 110 and protected number information 120, and can determine the alert level based on the connection pattern of the calling number and the called number. .

≪Call Processing Server≫
FIG. 6 is a functional block diagram showing a configuration example of the call processing server 20 according to this embodiment.
The call processing server 20 receives a connection request (call) from each calling device (calling terminal 4) that it accommodates. Then, the call processing server 20 receives the alert level determination result by transmitting to the ENUM/DNS server 10 an alert level determination request to which the caller number and destination number of the caller device are attached. The call processing server 20 controls the call (disconnects the call) and distributes guidance by the guidance device 30 before the call starts as special fraud countermeasures according to the received security level.
This call processing server 20 comprises an input/output unit 21 , a control unit 22 and a storage unit 23 .

The input/output unit 21 inputs and outputs information to and from other devices. For example, the input/output unit 21 transmits and receives information to and from each terminal (originating device (originating terminal 4), terminating terminal 5, etc.), ENUM/DNS server 10, and the like. The input/output unit 21 includes a communication interface for transmitting and receiving information via a communication line, and an input/output interface for inputting and outputting information between an input device such as a keyboard (not shown) and an output device such as a monitor. Configured.

The storage unit 23 is configured by a hard disk, flash memory, RAM, or the like.
The storage unit 23 stores caution level countermeasure information 200 (details will be described later) indicating countermeasures against fraud according to each caution level.
The storage unit 23 also temporarily stores a program for executing each function of the control unit 22 and information necessary for processing of the control unit 22 .

The control unit 22 controls overall processing executed by the call processing server 20, and includes a warning level determination requesting unit 221, a fraud prevention processing unit 222, a connection destination information requesting unit 223, and a call connection processing unit 224. Configured.

The alert level determination requesting unit 221 receives a connection request (call) from the calling device (calling terminal 4) that it accommodates. Then, the alert level determination request unit 221 generates an alert level determination request to which the caller number and destination number of the caller device (calling terminal 4) are attached, and transmits the request to the ENUM/DNS server 10. FIG.

The fraud prevention processing unit 222 acquires security level information from the ENUM/DNS server 10 . Then, the fraud prevention processing unit 222 executes fraud prevention processing defined by the caution level countermeasure information 200 stored in the storage unit 23 .

FIG. 7 is a diagram illustrating an example of caution level countermeasure information 200 according to this embodiment.
The fraud prevention processing unit 222 executes fraud prevention processing such as call restriction (call disconnection) and guidance distribution by the guidance device 30 in association with each security level.

・ Alert level "1"
Alert level "1" is for cases where the caller number is not registered in the fraudulent number information 110 and the destination number is not registered in the protected number information 120, or when the caller number is not registered in the protected number information 120. However, the destination number is not registered in the fraudulent number information 110, for example. In this case, the fraud prevention processing unit 222 does not perform fraud prevention countermeasure processing.
Therefore, the fraud prevention processing unit 222 outputs that fact to the connection destination information requesting unit 223 to continue processing for normal call connection.

・ Alert level "2"
Alert level "2" is for "calls from non-malicious persons of special fraud to protected persons". In this case, the fraud prevention processing unit 222 distributes guidance such as "Please be careful with the other party of the call" to the destination terminal via the guidance device 30 .

・ Alert level "3"
Alert level "3" is for "calls from malicious persons of special fraud to persons other than protected persons". In this case, the fraud prevention processing unit 222 may deliver guidance such as "there is a possibility of a call from a special fraud group" to the destination terminal via the guidance device 30, for example. However, since the user of the destination terminal is not registered as a person protected by the special anti-fraud measures, it is possible to set the anti-fraud countermeasures such as distributing the guidance not to be performed.

・ Alert level "4"
Alert level "4" covers "calls from malicious persons in special frauds to protected persons". In this case, the fraud prevention processing unit 222 delivers guidance such as "There is a possibility of a call from a special fraud group" to the destination terminal via the guidance device 30. Further, the fraud prevention processing unit 222 distributes guidance such as "This call is being recorded" to the malicious person of the special fraud of the originating terminal via the guidance device 30. FIG.

・Warning level "4-1"
Alert level "4-1" targets "a call from a malicious person who commits an 'it's me' fraud to a protected person who suffers from a special fraud other than the 'it's me'fraud". In this case, the fraud prevention processing unit 222 distributes guidance such as, for example, "There is a possibility of a call from a fraudulent group." Further, the fraud prevention processing unit 222 distributes guidance such as "This call is being recorded" to the malicious person of the special fraud of the originating terminal via the guidance device 30. FIG.

・ Alert level "4-2"
Alert level "4-2" is for "calls from malicious persons involved in refund fraud to protected persons who are victims of special fraud other than refund fraud". In this case, the fraud prevention processing unit 222 distributes guidance to the destination terminal via the guidance device 30, such as "There is a possibility of a call from a refund fraud group." Further, the fraud prevention processing unit 222 distributes guidance such as "This call is being recorded" to the malicious person of the special fraud of the originating terminal via the guidance device 30. FIG.
In addition, in the case where the fraud type of the fraudulent number of the calling terminal and the fraud type of the protected number of the called terminal are different, the fraud prevention processing unit 222 Deliver guidance to both the Special Fraud STS.

・ Alert level "5"
Alert level "5" is, for example, "a call from a malicious person who is a fraud victim to a protected person who is a victim of "It's me" fraud. Cases with the same type of fraud are covered. In this case, the fraud prevention processing unit 222 discards (disconnects) the connection request (call) and rejects the incoming call because there is a high possibility of being victimized by special fraud.
Another case with alert level "5" is the case of "Call from Protected Person to Special Fraud Service-to-Self". In this case as well, the fraud prevention processing unit 222 discards (disconnects) the connection request (call) because there is a high possibility of being victimized by special fraud, and disallows outgoing calls.

In addition, the special fraud countermeasures associated with this alert level may change the fraud prevention countermeasure processing for each protected number at the request of each protected person. For example, in the case of "a call from a malicious person of a special fraud to a protected person" with an alert level of "4", guidance is delivered to both the protected person of the called terminal and the malicious person of the special fraud of the originating terminal. Instead, the connection request (call) may be discarded (call disconnection), and the setting may be made such that the call cannot be made. Further, the content of the special fraud countermeasures associated with the alert level may be changed according to the setting of the telecommunications carrier or the like.

Returning to FIG. 6, when the fraud prevention processing of the fraud prevention processing unit 222 is other than abandonment (call disconnection) of the connection request (call), the connection destination information requesting unit 223 sends the connection destination information with the destination number. and send it to the ENUM/DNS server 10.

When the call connection processing unit 224 receives connection destination information (routing information) corresponding to the called party number from the ENUM/DNS server 10, it makes a call connection to the connection destination indicated by the called party information.

By doing so, the call processing server 20, as a fraud prevention countermeasure process according to the security level received from the ENUM/DNS server 10, restricts (discards) the call and provides guidance by the guidance device 30 before the call starts. delivery can be performed.

≪Processing of Fraud Damage Prevention System≫
Next, processing executed by the fraud damage prevention system 1000 will be described.
FIG. 8 is a sequence diagram showing the processing flow of the fraud damage prevention system 1000 according to this embodiment.

The number information updating unit 121 of the ENUM/DNS server 10 acquires the latest fraudulent number information 110 and protected number information 120 from the number database 700 held by an administrative agency or the like, and stores them in the storage unit 13 (step S1). .
The update of the fraud number information 110 and the protected number information 120 may be saved and synchronized in real time, for example, by an information update method using the ENUM/DNS protocol.

Next, the call processing server 20 receives a connection request (call) from the calling terminal 4 to the called terminal 5 (step S2). This connection request (call) is attached with the destination number of the receiving terminal 5 and the caller number of the calling terminal 4 .

Subsequently, the alert level determination requesting unit 221 of the call processing server 20 generates an alert level determination request to which the caller number of the calling terminal 4 and the destination number of the called terminal 5 are attached, and the ENUM/DNS server 10 (step S3).

The ENUM/DNS server 10 (alert level determination unit 122) receives the alert level determination request to which the caller number and destination number are attached. Alert level determination unit 122 then determines whether the caller number is registered in fraud number information 110 or protected number information 120 . The vigilance level determination unit 122 also determines whether or not the destination number is registered in the fraudulent number information 110 or the protected number information 120 . Accordingly, the caution level determination unit 122 determines the connection pattern (see FIG. 5) based on the caller number and the destination number, and determines the caution level according to the connection pattern (step S4).
Then, the alert level determination unit 122 sends back the determined alert level information to the call processing server 20 (step S5).

Subsequently, when the fraud prevention processing unit 222 of the call processing server 20 acquires information on the security level from the ENUM/DNS server 10, the special Anti-fraud measures are executed (step S6).

Note that in the example shown in FIG. 7 where the alert level is five stages, the fraud prevention processing unit 222 distributes guidance from the guidance device 30 to the receiving terminal 5 at the alert levels "2" and "3". and call attention to fraud damage. At alert level "4", the fraud prevention processing unit 222 causes the receiving terminal 5 to execute the process of distributing guidance from the guidance device 30, and also distributes guidance from the guidance device 30 to the calling terminal 4. to execute the process to be performed. Note that the actual timing at which guidance is delivered to the called terminal 5 and the calling terminal 4 by the guidance device 30 is determined by the connection destination information requesting unit 223 after receiving the connection destination information (routing information) corresponding to the destination number. Before connection.
At alert level "5", the fraud prevention processing unit 222 performs call regulation processing (call disconnection) to cut off the communication between the malicious person who is the victim of special fraud and the person to be protected, and terminates the processing. finish.
Note that the fraud prevention processing unit 222 does not take special fraud countermeasures when the alert level is "1" in the example of the alert level countermeasure information 200 showing five alert levels shown in FIG.

Subsequently, the connection destination information requesting unit 223 of the call processing server 20 sets the alert level to "5", and except when the call restriction processing (call disconnection) is performed, the connection destination information with the destination number is sent. An inquiry message is generated and transmitted to the ENUM/DNS server 10 (step S7: connection destination information inquiry).

When the connection destination information search unit 123 of the ENUM/DNS server 10 receives the connection destination information inquiry, the connection destination information search unit 123 refers to the connection destination information table 130 and extracts the connection destination information (routing information) corresponding to the destination number. , to the call processing server 20 (step S8: connection destination information response).

Next, when the call processing server 20 (call connection processing unit 224) receives connection destination information (routing information) corresponding to the destination number from the ENUM/DNS server 10, the connection destination indicated in the destination information Call connection is made (step S9), and communication connection between the calling terminal 4 and the called terminal 5 is established.

By doing so, in the fraud damage prevention system 1000, the ENUM/DNS server 10 determines the combination pattern (connection pattern) of the source number and the destination number, and makes a call from the fraudulent number to the protected number, A vigilance level can be determined for both calls from protected numbers to fraudulent numbers. Based on this vigilance level, the call processing server 20 executes fraud damage prevention processing (call control (call disconnection) and guidance delivery) before starting a call.
Therefore, according to the fraud damage prevention system 1000, when preventing fraud using a telephone, the network side, which is closer to the originating device (originating terminal) than the receiving side, before the call starts, effectively Fraud damage prevention processing can be executed.

<Hardware configuration>
The ENUM/DNS server 10 and the call processing server 20 according to this embodiment are implemented by a computer 900 configured as shown in FIG. 9, for example.
FIG. 9 is a hardware configuration diagram showing an example of a computer 900 that implements the functions of the ENUM/DNS server 10 and the call processing server 20 according to this embodiment. The computer 900 includes a CPU (Central Processing Unit) 901, a ROM (Read Only Memory) 902, a RAM 903, a HDD (Hard Disk Drive) 904, an input/output I/F (Interface) 905, a communication I/F 906 and a media I/F 907. have.

The CPU 901 operates based on programs stored in the ROM 902 or HDD 904, and performs control by the control units 12 and 22 (FIGS. 2 and 6). The ROM 902 stores a boot program executed by the CPU 901 when the computer 900 is started, a program related to the hardware of the computer 900, and the like.

The CPU 901 controls an input device 910 such as a mouse and keyboard, and an output device 911 such as a display and printer via an input/output I/F 905 . The CPU 901 acquires data from the input device 910 and outputs the generated data to the output device 911 via the input/output I/F 905 . A GPU (Graphics Processing Unit) or the like may be used together with the CPU 901 as a processor.

The HDD 904 stores programs executed by the CPU 901 and data used by the programs. Communication I/F 906 receives data from other devices via a communication network (for example, NW (Network) 920) and outputs it to CPU 901, and transmits data generated by CPU 901 to other devices via the communication network. Send to device.

The media I/F 907 reads programs or data stored in the recording medium 912 and outputs them to the CPU 901 via the RAM 903 . The CPU 901 loads a program related to target processing from the recording medium 912 onto the RAM 903 via the media I/F 907, and executes the loaded program. The recording medium 912 is an optical recording medium such as a DVD (Digital Versatile Disc) or a PD (Phase change rewritable Disk), a magneto-optical recording medium such as an MO (Magneto Optical disk), a magnetic recording medium, a semiconductor memory, or the like.

For example, when the computer 900 functions as the ENUM/DNS server 10 and the call processing server 20 of the present invention, the CPU 901 of the computer 900 executes the program loaded on the RAM 903 to perform the ENUM/DNS server 10 and the call processing server. It implements the functions of the server 20 . Data in the RAM 903 is stored in the HDD 904 . The CPU 901 reads a program related to target processing from the recording medium 912 and executes it. In addition, the CPU 901 may read a program related to target processing from another device via the communication network (NW 920).

<effect>
Effects of the fraud damage prevention system and the like according to the present invention will be described below.
A fraud damage prevention system according to the present invention includes a call processing server 20 that connects a calling device (calling terminal 4) and a called device (called terminal 5); In a fraud damage prevention system 1000 comprising an ENUM/DNS server 10 that performs connection destination information resolution processing, when the call processing server 20 receives a connection request from a calling device, the caller number of the calling device and a warning level determination request unit 221 that transmits a warning level determination request to the ENUM/DNS server 10 to which the destination number of the destination device is attached; a fraud prevention processing unit 222 that executes predetermined fraud damage prevention processing according to the alert level, and the ENUM/DNS server 10 registers fraud number information 110 indicating a fraud countermeasure target number. , and protected number information 120 in which a protected number indicating the number of a user to be protected from fraud damage is registered is obtained from an external database (number database 700) at predetermined time intervals, and stored in the storage unit 13. Using the number information updating unit 121 for updating the stored fraud number information and protected number information, and the caller number and destination number attached to the alert level determination request, the caller number is updated to the fraud number information 110 or the protected number information. The connection pattern of the connection request is discriminated by determining whether it is registered in the target number information 120 and whether the called party number is registered in the fraudulent number information 110 or the protected number information 120. and a warning level determination unit 122 for determining a warning level for evaluating that a higher level of fraud prevention processing is required as the possibility of fraud damage is higher according to the connection pattern.

Thus, according to the fraud damage prevention system 1000, the ENUM/DNS server 10 determines the connection pattern using the fraud number information 110 and the protected number information 120 obtained from the external database (number database 700), A security level is determined according to the determined connection pattern, and the call processing server 20 can execute fraud damage prevention processing for each security level.
Therefore, fraud damage prevention processing can be executed not on the receiving side but on the network side closer to the calling device (calling terminal 4). In addition, since the fraud damage prevention system 1000 executes fraud damage prevention processing before the start of a call, there is no burden on the user. In addition, by determining the connection pattern, the ENUM/DNS server 10 can also execute fraud damage prevention processing for a call from a person to be protected to a malicious party of a special fraud. Therefore, it is possible to prevent fraud damage more effectively than in the prior art.

In addition, in the fraud damage prevention system 1000, the alert level determination unit 122 of the ENUM/DNS server 10 has the caller number registered in the protected number information 120 and the destination number registered in the fraud number information 110. In this case, the alert level of the connection request is determined to be the alert level of disconnecting the call as fraud damage prevention processing.

By doing this, for "a call from a protected person to a malicious party of a special fraud", which has a very high possibility of being victimized by a special fraud, the call is regulated (call disconnection) before the call starts, and protection is provided. Damage to the target can be prevented.

Further, in the fraud damage prevention system 1000, the fraud number information 110 registers a fraud type indicating the type of special fraud in association with the fraud number, and the protected number information 120 registers a fraud number associated with the protected number. The type of fraud is registered in the ENUM/DNS server 10, and the warning level determination unit 122 of the ENUM/DNS server 10 determines that the caller number is registered in the fraud number information 110 and the destination number is registered in the protected number information 120. case, when the type of fraud attached to the fraudulent number matches the type of fraud attached to the protected number, the alert level of the connection request is set to the alert level at which the call is disconnected as fraud damage prevention processing. It is characterized by determining.

In this way, in the fraud number information 110, the fraud type related to the special fraud is registered in association with the fraud number, and in the protected number information 120, the fraud type of the special fraud that the protected person suffered is registered. Keep As a result, when the fraud type of the fraudulent number, which is the source number, matches the fraud type of the protected number, which is the destination number, the alert level determination unit 122 of the ENUM/DNS server 10 issues the connection request. Call can be disconnected. Therefore, for example, like "a call from a malicious person to a victim of an 'It's me' fraud" type of special fraud (e.g., it's me fraud) is the same, and the combination of calls with a high possibility of being victimized is restricted. (Call disconnection) can be performed to prevent damage in advance.

Further, in the fraud damage prevention system 1000, the number information updating unit 121 of the ENUM/DNS server 10 exchanges the fraud number information 110 and the protected number with the external database (number database 700) using the ENUM/DNS protocol. It is characterized in that the information 120 is acquired in real time and the fraud number information 110 and the protected number information 120 stored in the storage unit 13 are updated.

In this way, the ENUM/DNS server 10 can acquire fraud number information 110 and protected number information 120 in real time from an external database (number database 700) using the ENUM/DNS protocol. Therefore, it is possible to prevent fraud damage more effectively by using the latest information.

In addition, in the fraud damage prevention system 1000, the call processing server 20 is provided with a guidance device 30, and the fraud prevention processing unit 222 of the call processing server 20 performs a predetermined fraud prevention process to prevent fraud damage. At least one of delivering guidance from the guidance device 30 to the destination device, delivering guidance for preventing fraud damage from the guidance device 30 to the originating device, and disconnecting the connection request call. Characterized by

As a result, the call processing server 20 distributes guidance from the guidance device 30 provided on the network side to the receiving device (the receiving terminal 5) and the calling device (the calling terminal 4), and disconnects the call for the connection request. you can go Note that the call processing server 20 prevents damage by distributing, for example, guidance calling attention to special fraud to the receiving device. In addition, the call processing server 20 distributes guidance such as recording the call to the originating device, thereby prompting the malicious party of the special fraud to voluntarily disconnect the call. to reduce the distribution and prevent damage.

The ENUM/DNS server according to the present invention is the ENUM/DNS server 10 connected to the call processing server 20, and the ENUM/DNS server 10 is a fraudulent fraud number registering a fraud countermeasure target number. It is connected to an external database that stores number information 110 and protected number information 120 in which a protected number indicating the number of a user to be protected from fraud damage is registered. A number information updating unit 121 that acquires fraudulent number information 110 and protected number information 120 and updates the fraudulent number information 110 and protected number information 120 stored in the storage unit 13, and a call processing server 20 that accepts a connection request. receives a warning level determination request to which the caller number and the called party number are attached, and determines whether the caller number is registered in the fraud number information 110 or the protected number information 120, and whether the called party number is the fraud number information. 110 or the protected number information 120 to determine the connection pattern of the connection request. and a caution level determination unit 122 that determines a caution level that is evaluated to require level fraud damage prevention processing.

Thus, according to the ENUM/DNS server 10, the connection pattern is determined using the fraudulent number information 110 and the protected number information 120 obtained from the external database (number database 700), and according to the determined connection pattern Determine alert level. Therefore, by transmitting the alert level information to the call processing server 20, the call processing server 20 can execute fraud damage prevention processing according to the alert level.
Therefore, fraud damage prevention processing can be executed not on the receiving side but on the network side closer to the calling device (calling terminal 4). In addition, since the ENUM/DNS server 10 causes the call processing server 20 to perform fraud damage prevention processing before the start of a call, there is no burden on the user. do not have. In addition, by determining the connection pattern, the ENUM/DNS server 10 can also execute fraud damage prevention processing for a call from a person to be protected to a malicious party of a special fraud. Therefore, it is possible to prevent fraud damage more effectively than in the prior art.

It should be noted that the present invention is not limited to the embodiments described above, and many modifications are possible within the technical concept of the present invention by those who have ordinary knowledge in this field.

4 calling terminal 5 called terminal 10 ENUM/

DNS server

11, 21 input/

output unit

12, 22

control unit

13, 23 storage unit 20 call processing server 30 guidance device 110 fraud number information 120 protected number information 121 number information update unit 122 vigilance Level determination unit 123 Connection destination information search unit 130 Connection destination information table 200 Security level countermeasure information 221 Security level determination request unit 222 Fraud prevention processing unit 223 Connection destination information request unit 224 Call connection processing unit 700 Number database (external database)
1000 Fraud damage prevention system

Claims

A fraud damage prevention system comprising: a call processing server that connects a calling device and a destination device; There is
The call processing server
an alert level determination requesting unit that, upon receiving a connection request from the originating device, transmits to the ENUM/DNS server an alert level determination request attached with the originating number of the originating device and the destination number of the destination device; ,
a fraud prevention processing unit that receives, from the ENUM/DNS server, a warning level determination result regarding the connection request and executes a predetermined fraud damage prevention process according to the warning level;
The ENUM/DNS server,
Fraud number information, in which fraud numbers are registered as fraud countermeasures, and protected number information, in which protected numbers are registered as user numbers to be protected against fraud, are retrieved from an external database. a number information update unit that acquires at predetermined time intervals and updates the fraud number information and the protected number information stored in a storage unit;
Using the caller number and the called party number attached to the alert level determination request, whether or not the caller number is registered in the fraudulent number information or the protected number information is determined. The connection pattern of the connection request is determined by determining whether or not it is registered in the fraudulent number information or the protected number information, and there is a high possibility that fraud damage will occur according to the determined connection pattern. a warning level determination unit that determines a warning level that evaluates that a higher level of fraud damage prevention processing is necessary as the degree is higher;
A fraud damage prevention system comprising:
The alert level determination unit of the ENUM/DNS server determines whether the connection request is issued when the caller number is registered in the protected number information and the destination number is registered in the fraudulent number information. 2. The fraud damage prevention system according to claim 1, wherein the alert level is set to a level at which a call is disconnected as the fraud damage prevention processing.
In the fraud number information, a fraud type indicating a type of special fraud is registered in association with the fraud number, and in the protected number information, the fraud type is registered in association with the protected number. and
When the caller number is registered in the fraud number information and the destination number is registered in the protected number information, the alert level determination unit of the ENUM/DNS server When the affixed fraud type matches the fraud type affixed to the protected number, the alert level of the connection request is determined as a level of alert level for disconnecting the call as the fraud damage prevention processing. The fraud damage prevention system according to claim 1, characterized by:
The number information updating unit of the ENUM/DNS server acquires the fraudulent number information and the protected number information in real time from the external database using the ENUM/DNS protocol, and stores the information in the storage unit. The fraud damage prevention system according to any one of claims 1 to 3, wherein the fraud number information and the protected number information that have been received are updated.
The call processing server includes a guidance device,
The fraud prevention processing unit of the call processing server, as the predetermined fraud prevention processing, distributes guidance for preventing fraud damage from the guidance device to the destination device; The fraud according to any one of claims 1 to 4, wherein at least one of delivering guidance from the guidance device to the originating device and disconnecting the connection request is performed. Damage prevention system.
A fraud damage prevention system comprising: a call processing server that connects a call originating device and a destination device; A fraud damage prevention method,
The call processing server
receiving a connection request from the originating device, transmitting to the ENUM/DNS server an alert level determination request to which the originating number of the originating device and the destination number of the destination device are attached;
a step of receiving, from the ENUM/DNS server, a warning level determination result regarding the connection request, and performing a predetermined fraud damage prevention process according to the warning level;
The ENUM/DNS server,
Fraud number information, in which fraud numbers are registered as fraud countermeasures, and protected number information, in which protected numbers are registered as user numbers to be protected against fraud, are retrieved from an external database. updating the fraudulent number information and the protected number information acquired at predetermined time intervals and stored in a storage unit;
Using the caller number and the called party number attached to the alert level determination request, whether or not the caller number is registered in the fraudulent number information or the protected number information is determined. The connection pattern of the connection request is determined by determining whether or not it is registered in the fraudulent number information or the protected number information, and there is a high possibility that fraud damage will occur according to the determined connection pattern. A fraud damage prevention method characterized by: determining a vigilance level that evaluates that a higher level of fraud damage prevention processing is necessary than the above.
An ENUM/DNS server connected to a call processing server,
The ENUM/DNS server,
An external database that stores fraud number information in which fraud numbers indicating numbers to be targeted for fraud countermeasures are registered, and protected number information in which protected numbers indicating user numbers to be protected against fraud damage are registered. is connected with
a number information updating unit that acquires the fraud number information and the protected number information from the external database at predetermined time intervals and updates the fraud number information and the protected number information stored in a storage unit;
From the call processing server that accepted the connection request, whether a warning level determination request with a caller number and a called party number is received, and whether the caller number is registered in the fraudulent number information or the protected number information The connection pattern of the connection request is discriminated by determining whether the destination number is registered in the fraud number information or the protected number information. a vigilance level determination unit that determines a vigilance level that evaluates that a higher level of fraud damage prevention processing is required as the possibility of damage occurring increases;
An ENUM/DNS server comprising:
A program for causing a computer to function as the ENUM/DNS server according to claim 7.