KR0152241B1 - Method of preventing misuse in third party metering services - Google Patents

Abstract

The present invention relates to a fraud prevention method for monitoring and blocking fraudulent use attempts by others occurring in various types of third party billing services in a communication service, and by a non-subscriber in a third party billing service. To prevent fraudulent use of the service, the service control system monitors call usage and takes measures such as service interruption for billing numbers that exceed the threshold, and monitors the number of password mismatches at the service exchanger for outgoing lines that exceed the threshold. By stopping the service for a certain period of time, it is possible to prevent the leakage of call charges due to fraudulent use from the user's point of view. To increase your revenue It works.

Description

How to prevent fraud in third party billing services

1 is a block diagram of a communication network to which the present invention is applied.

2 is a flowchart illustrating call information transmission and reception to which the present invention is applied.

3 is a structural diagram of an outgoing line monitoring table according to the present invention;

4 is a structural diagram of a billing number monitoring table according to the present invention.

5 is a flow chart for preventing illegal use of each outgoing line according to the present invention.

6 is a flow chart for preventing illegal use for each billing number according to the present invention.

* Explanation of symbols for main parts of the drawings

11: service exchanger 12: service control system

The present invention relates to a fraud prevention method for monitoring and blocking fraudulent attempts by other persons occurring in various types of third party billing services in a communication service.

In communication services, the provision of various charging methods has been recognized as a very important problem. In the initial communication, in principle, caller billing was used, but callee billing and third-party billing are increasingly needed. In particular, in the case of a communication service requiring personal mobility, billing is required for a third number (personal number, etc.), not for an outgoing call line, but this causes an unauthorized attempt by a third party.

The use of negation is divided into two types:

The first is to keep trying to call someone else's password to find out their password. This is the case when someone steals or acquires a calling card and wants to use it, or in the case of a crediting service that allows third party billing by dialing. In this case, a pattern in which password mismatch occurs intensively on the same outgoing line is shown.

As a monitoring method, the number of password mismatches per outgoing line is periodically monitored, and if a certain threshold or more occurs, it is regarded as an unauthorized attempt. As a countermeasure, the third-party billing service is temporarily blocked on the calling line, and the information is forwarded to the operator of the telephone station for investigation. The operator should investigate this to determine if the password has been changed or transmitted due to mechanical malfunction of the calling card reader, etc., or to take the necessary measures.

Dullejae already finds the password of another person and uses it illegally as the billing number of another person. Judgment on this is very difficult. In other words, if the passwords match, it is impossible to determine whether the call originated from the original subscriber of the service or if the ineligible person is using the wrong person. Therefore, in the present invention, if there is fraudulent use, it is assumed that fraudulent users will use a lot of fraud within a short time, whether the fraudulent user is alone or notified to other people, and the number of successful calls will increase rapidly. If this occurs, it is regarded as fraudulent use and action is taken.

As a countermeasure, it is notified to the service manager to take appropriate action, or if the service subscriber pre-designates, the service is automatically closed for the billing number and notified to the service manager. The service manager investigates this through contact with the service subscriber.If it is determined that the service subscriber is temporarily using a lot of services, it is resumed immediately. Resume the service after taking action.

Therefore, the present invention monitors the call usage in the service control system to prevent fraudulent use of the service by a non-service subscriber in the third-party billing service, and takes measures such as service interruption for billing numbers exceeding a threshold. Therefore, the purpose of the present invention is to provide a method of preventing fraudulent use of the service exchanger by monitoring the number of password mismatches and stopping the service for a certain period of time for the outgoing line exceeding the threshold.

The fraud prevention method of the present invention for achieving the above object is a fraud prevention method applied to an intelligent network in which a service control system and a service exchanger interoperate with each other. Step 1: Increase the password mismatch counter value if the outgoing line watch record is present and if the outgoing line watch record is present: compare the counter value with the reporting threshold and, if the counter value is greater than or equal to, send a report message for warning and investigation grounds And a third step of comparing the counter value with the blocking threshold and determining that the counter value is greater than or equal to the illegal use attempt to block the charging service attempt on the outgoing line during the predetermined blocking period. do.

Another method for preventing illegal use of the present invention for achieving the above object is a method for preventing unauthorized use applied to an intelligent network in which a service control system and a service exchanger interoperate with each other. Step 1: Retrieve the billing number watchdog record and increase the call usage counter value if the billing number watchdog record exists: compare the counter value with the reporting threshold and, if the counter value is greater than or equal to, send a report message for alert and investigation grounds And a third step of terminating the service when the counter value is greater than or equal to and the automatic shutoff is required by comparing the counter value with the blocking threshold value and checking whether the automatic shutoff is performed.

Hereinafter, with reference to the accompanying drawings will be described an embodiment according to the present invention;

1 is a configuration diagram of a communication network to which the present invention is applied, where 11 is a service switchboard and 12 is a service control system.

For third-party billing services, we maintain a centralized database within the network to keep information about subscribers who have subscribed to billing services. The third party billing service may be provided by using a calling card in a communication terminal with a card reader or dialing a billing number in a general telephone. In any case, a password must be entered, and the originating service control system 12 receiving the password accesses the database to determine whether the password matches. The exchange of information between the service exchanger 11 and the service control system 12 generally uses a signal channel of the common line signaling method (NO. 7). This call processing control structure is called an intelligent network.

In the present invention, whether or not the password is matched is made by the service control system 12, the function of monitoring the number of password mismatch per outgoing line to determine whether or not fraudulent use and take action in the service switchboard 11, billing The function of monitoring call usage per number and determining and acting on fraudulent use is divided into roles to be performed in the service control system 12. The monitoring table for this purpose is the calling line monitoring table and the charging number monitoring table, respectively.

The contents monitored and acted on by the service switchboard 11 are reported to the operation system operating and managing the service switchboard 11, and the contents monitored and monitored by the service control system 12 are responsible for data management and service management of the service subscriber. Reported to the service management system.

2 is a flow chart of call information transmission and reception to which the present invention is applied and shows information flow when a service is denied because it is determined that a password is inconsistent or illegally used.

First, the service user enters the billing number and password at the calling terminal (21). Input is via a calling card or dialing. The billing number is the service subscriber number and is the identifier (ID) of the service subscriber.

The service exchanger 11 receives the request and requests the service control system 12 to check whether the service is allowed through the signal channel (22). The check request message includes a billing number and a password.

The service control system 12 retrieves the service subscriber's record from the database using the billing number as a key, determines whether the input password matches the password specified by the subscriber, and if the password matches, the call usage amount. To determine whether or not to use illegally (23), and the service acceptance check result determined by the service control system 12 to the service exchanger 11 through a response message (24).

The service exchanger 11 checks the unauthorized use attempt (25), and if there is a password mismatch, sends a password mismatch announcement to the caller and terminates the call. Export (26). In general, when it is suspended due to fraudulent use, it is preferable to reject the service with a more general guide broadcast without sending the cause directly to the guide broadcast.

3 is a structural diagram of an outgoing line monitoring table according to the present invention, which is a number of outgoing password mismatch counter tables defined in an exchange for monitoring illegal use by a password mismatch monitored by a service exchange.

The line number is the subscriber loop number connected to each switch, and the monitoring period is a unit of time for accumulating counters. Each time the watch cycle passes, all counter values in the watch table are reset to zero. The blocking period is for closing the billing service for a certain period of time for the calling line determined to be the circuit where the fraudulent use attempt is made. The reporting threshold is a threshold for reporting to the operating system whenever a password mismatch occurs if the value of the counter is greater than a certain number of times and using it as a basis for further investigation of fraud. The blocking threshold is a threshold number of password mismatches for automatically shutting down a service on a subscriber line. The Password Mismatch Counter is a place to accumulate whenever a password mismatch occurs. It is continuously increasing and resets to zero after each monitoring period.

4 is a structural diagram of a billing number monitoring table according to the present invention, which is defined in the service control system in order to determine whether or not fraudulent use by monitoring a call volume of a billing service that is legally permitted due to a password monitored by the service control system. This is a table of the number of call allowed counters by billing number.

A billing number is a billing number of a service subscriber who is subscribed to a billing service, and a monitoring cycle is a unit of time for accumulating a counter. Each time the watch cycle passes, all counter values in the watch table are reset to zero. Whether or not to automatically block is for determining whether or not to automatically close the billing number determined to be the number where fraud is occurring. This is specified by the service subscriber at the time of service subscription. If it is not automatic closure, the service manager decides to close the service, or the service manager simply reports to the subscriber that the service is suspected of misuse, and the action should be taken in accordance with the agreement. The reporting threshold is a threshold for reporting to the service management system when the value of the counter is more than a certain number of times and using it as a basis for investigation into future fraud. The blocking threshold is a call usage threshold that determines that fraud has occurred. The call usage counter is a place to accumulate whenever a password is matched and the call is accepted. The call usage counter continuously increases and resets to zero after each monitoring period.

5 is a flowchart for preventing unauthorized use of each outgoing line according to the present invention.

First, if the password mismatch is notified from the service control system 12 as a result of the service permission check, the corresponding outgoing line monitoring record is retrieved from the outgoing line monitoring table (51). It is determined whether the outgoing line monitoring record exists (52). If it does not exist, a new outgoing line monitoring record is created (53) using the outgoing line number as a key in the outgoing line monitoring table. At this time, the monitoring period, the blocking period, the reporting threshold and the blocking threshold are designated according to the group of the subscriber line. Then, the password mismatch counter value is registered as one.

As a result of the determination, if the outgoing line monitoring record exists, the password mismatch counter value is increased by one (54). Thereafter, the counter value is compared with the reporting threshold (55). If the counter value is small, the processing is terminated. If the counter value is greater than or equal to 56, the report message for warning and investigation basis is transmitted to the operating system (56). This message includes the calling line number, billing number, input password, counter value, date and time, etc.

Next, the counter value and the blocking threshold value are compared (57). If the counter value is small, the processing is terminated. If the counter value is large or equal, the processing is judged to be a fraudulent use attempt. . Since the service attempt is blocked and unnecessary for the blocked calling number, the corresponding record is deleted from the calling line monitoring table and terminated (59). If the number of subscriber lines to be monitored at the service exchange is not large enough to maintain the monitoring counters of all subscribers at all times, deletion or addition of records in the outgoing line monitoring table may be unnecessary.

6 is a flowchart for preventing illegal use of each billing number according to the present invention.

First, when the service control system 12 determines that the password is matched as a result of the service acceptance check, the corresponding billing number monitoring record is searched for in the billing number monitoring table (61). It is determined whether a billing number monitoring record exists (62), and if a billing number monitoring record does not exist, a billing number monitoring record is created using a new billing number as a key in the billing number monitoring table (63). At this time, the monitoring period, whether to automatically block, the reporting threshold, and the blocking thresholds are specified by the service subscriber at the time of service subscription. Then, the call usage counter value is registered as one.

As a result of the determination, if the billing number monitoring record exists, the call usage counter value is increased by one (64). The counter value is compared with the reporting threshold (65). If the counter value is small, the processing is terminated. If the counter value is greater than or equal to, the report message for warning and investigation basis is transmitted to the service management system (66). This message includes the billing phone, the calling area or calling line number, the counter value, and the date and time.

Next, the counter value and the blocking threshold are compared (67). If the counter value is small, the processing is terminated. If the counter value is large or the same, the processing is judged to be a fraudulent attempt, and the automatic blocking is not necessary (68). In step 69, the process ends, and if automatic blockage is required, the service is terminated by displaying the service unavailable mark on the corresponding service subscriber record. For the blocked billing number, since the service attempt is blocked by the unavailability indication of the service subscriber record and unnecessary, the corresponding billing number record is deleted from the billing number monitoring table (70). If there is not a lot of billing numbers to be monitored in the service control system, so that the monitoring counters of all subscribers can be maintained at all times, deletion or addition of records in the billing number monitoring table may be unnecessary.

The present invention as described above can prevent the leakage of call charges due to fraudulent use from the user's point of view, and prevents billing with the user from the telecommunications operator's point of view and creates new call demand due to the popularization of the billing service. There is an effect that can increase.

Claims (18)

In the fraud prevention method applied to the intelligent network in which the service control system 12 and the service exchanger 11 interoperate with each other, if the password mismatches, the calling line monitoring table is retrieved from the calling line monitoring table and the calling line monitoring record is retrieved. First step (51, 52, 54) of increasing the password mismatch counter value if there is a watch record: comparing the counter value with the reporting threshold and sending a report message for warning and investigation basis if the counter value is equal or greater. Step 55,56: and comparing the counter value with the blocking threshold and determining that the counter value is greater than or equal to 3, determining that fraudulent attempt is made and blocking the charging service attempt on the outgoing line during the predetermined blocking period (57, 56). 58). The method as claimed in claim 1, further comprising the step (53) of determining whether the originating line monitoring record is present and adding the originating line monitoring record to the originating line monitoring table using the originating line number as a key if the originating line monitoring record does not exist. Fraud prevention method further comprises a. The method according to claim 2, further comprising the step (59) of deleting the corresponding outgoing line monitoring record from the outgoing line monitoring table for the blocked outgoing number after performing the third step (57, 58). How to avoid use. The method of claim 2, wherein the step of adding the outgoing line monitoring record comprises: specifying a monitoring period, a blocking period, a reporting threshold, and a blocking threshold according to a group of subscriber lines, and registering a password mismatch counter with a predetermined value. The illegal use prevention method characterized by the above-mentioned. 4. The calling line monitoring table according to any one of claims 1 to 3, wherein the outgoing line monitoring table indicates a line number indicating a subscriber loop number connected to each switch: a monitoring period indicating a unit of time for accumulating a counter: negative Blocking period indicating a period of time for closing the billing service for the outgoing line determined to be the line that attempts to use: If the value of the counter is over a certain number of times, every time a password mismatch occurs, the operating system is reported to the operating system for further use. Reporting thresholds indicating thresholds for use as evidence for investigations: Blocking thresholds indicating the number of password mismatches for automatically closing services on subscriber lines: and accumulating them whenever a password mismatch occurs. As a place, keep increasing And a password mismatch counter that is reset every time a period passes. The method according to any one of claims 1 to 3, wherein the first steps (51, 52, 54), when a password mismatch is notified as a result of the service permission check, sends the corresponding outgoing line monitoring record from the outgoing line monitoring table. Searching fourth step 51: Determining whether or not there is an outgoing line monitoring record Fifth step 52: Determining whether there is an outgoing line monitoring record If the outgoing line monitoring record exists, a password mismatch counter value And a sixth step (54) of increasing by one. 4. The method of claim 1, wherein the second steps 55, 56 comprise: a fourth step 55 comparing the counter value and the reporting threshold: as a result of the comparison of the fourth step 55, 5. A fifth step of terminating the process if the counter value is small; and a sixth step 56 of transmitting a report message for warning and investigation basis to the operating system if the counter value is large or equal as a result of the comparison of the fourth step 55; Method for preventing the use of fraud, characterized in that it comprises a). 8. The method according to claim 7, wherein the message of the sixth step (56) comprises a calling line number, a billing number, an input password, a counter value, and a date and time. 4. A third step (57) according to any one of the preceding claims, wherein the third step (57, 58) comprises: a fourth step (57) of comparing a counter value and a cutoff threshold: as a result of the comparison of the fourth step (57), A fifth step of terminating the process if the counter value is small: and as a result of the comparison of the fourth step 57, if the counter value is equal to or greater than the counter value, the attempt to charge the service on the outgoing line is blocked during the blocking period. And a sixth step (58). In the fraud prevention method applied to the intelligent network in which the service control system 12 and the service exchanger 11 interoperate with each other, if the passwords match, the billing number monitoring record is retrieved from the billing number monitoring table to monitor the billing number monitoring. First steps (61, 62, 64) of incrementing a call usage counter value if a record exists; A second step (65,66) for comparing the counter value with the reporting threshold and sending a report message for warning and investigation basis if the counter value is greater than or equal to; And a third step (67 to 69) for terminating the service when the counter value is equal to or greater than the counter value and the automatic blocking is performed by checking the counter value and the blocking threshold value. . 11. The method as claimed in claim 10, wherein the method further comprises: determining whether the billing number monitoring record is present and adding a billing number monitoring record to the billing number monitoring table using a new billing number as a key if the billing number monitoring record does not exist. Fraud prevention method further comprises a. 12. The method according to claim 11, further comprising the step (70) of deleting the corresponding billing number monitoring record from the billing number monitoring table for the blocked billing number after performing the third step (67 to 69). How to avoid use. The method of claim 10, wherein the adding of the billing number monitoring record comprises: specifying a monitoring period, whether to automatically block, a reporting threshold, and a blocking threshold by the service subscriber at the time of service subscription, and setting a call usage counter value to a predetermined value. The illegal use prevention method characterized in that the registration. 13. The billing number monitoring table according to any one of claims 10 to 12, wherein the billing number monitoring table comprises: a billing number indicating a billing number of a service subscriber subscribed to a billing service: a monitoring period indicating a unit of time for accumulating a counter; Whether to block automatically when the user designates at the time of subscription to determine whether to automatically close the billing number determined to be the number where fraud is occurring; A reporting threshold indicating a threshold for reporting to the service management system when the value of the counter is greater than or equal to a certain number of times and using the counter as evidence for further investigation into fraud; A blocking threshold indicating a call usage threshold that determines that fraud has occurred; And a call usage counter which is a place for accumulating each time a password is matched and the call is allowed, and is continuously increased and reset every time the monitoring period is reached. 13. The method according to any one of claims 10 to 12, wherein the first steps (61, 62, 64), if the password is matched as a result of the service permission check, retrieve the corresponding billing number monitoring record from the billing number monitoring table. A fourth step 61 of making; A fifth step 62 of determining whether a billing number monitoring record exists; And a sixth step (64) of increasing the call usage counter value by one if the billing number monitoring record exists as a result of the determination in the fifth step (62). 13. The method of claim 10, wherein the second step (65, 66) comprises: a fourth step (65) of comparing a counter value and a reporting threshold; A fifth step of terminating the process if the counter value is small as a result of the comparison in the fourth step (65); And a sixth step 66 of transmitting a report message for warning and investigation basis to the service management system if the counter value is greater than or equal to the determination result of the fourth step 65. . 17. The method of claim 16, wherein the message of the sixth step (66) comprises a billing number, origination area, counter value, and date and time. 13. The method according to claim 10 or 12, wherein the third steps (67 to 69) comprise: a fourth step (67) of comparing the counter value with the cutoff threshold value and ending the processing if the counter value is small; A fifth step (68) of determining whether the counter value is greater than or equal to the fourth step (67) as a result of the illegal use attempt and checking whether or not the automatic shut-off is necessary and ending the processing if the automatic shut-off is not necessary; And a sixth step (69) of terminating the service by displaying a service unavailable mark on the corresponding service subscriber record when the automatic blocking is necessary as a result of the investigation in the fifth step (68). .