KR101945782B1 - Method and apparatus for providing illegal phishing call blocking services of VoIP call - Google Patents

Abstract

The present invention relates to a service providing method for detecting and blocking an illegal voice phishing call originated from abroad and whose origination number is changed to a financial and public institution telephone number.
According to the present invention, there is provided a service providing method for detecting and blocking an illegal phishing call for an Internet telephone call, the method comprising the steps of: (a) analyzing calling information of an Internet telephone set originated in a communication system and extracting calling number information and IP information; ; (b) inquiring the extracted origination number information to a database in which a telephone number of a financial institution and a public institution is recorded, and judging whether a matching number exists; (c) if there is a matching number, inquiring the extracted IP information and determining whether the calling location is overseas; And (d) if it is confirmed that the call originated from a foreign country, determining that the call originated from a foreign country, and blocking the origination call, a method for providing an Internet phone illegal phishing call blocking service is disclosed.

Description

FIELD OF THE INVENTION [0001] The present invention relates to a method and apparatus for providing an illegal phishing call blocking service,

The present invention relates to a method for detecting and blocking an illegal phishing call to an Internet telephone, and more particularly, to a service providing method for detecting and blocking an illegal voice phishing call originated from a foreign country, .

Recently, as a new type of financial fraud (voice phishing), which is a new type of financial fraud, has been increasing and the damage caused by the fraud has increased, researches on methods for preventing the fraud have been actively carried out.

Among them, a telephone number causing a telephone finance fraud is registered in advance as a black list, and a calling telephone number included in the black list is inquired and blocked at the time of telephone call, and a method in which a certain reliable telephone number is selected by a white list, And a method of providing authentication information to the terminal are conventional phishing prevention methods based on telephone number information.

In addition, a method of analyzing the voice contents at the time of telephone conversation and providing the caution information to the voice or the UI on the telephone expected to be a financial fraud has been proposed. However, there is a possibility that the blacklist method modulates outgoing phone numbers in VoIP, and the whitelist method is difficult to apply to general-purpose terminals. Furthermore, the method of analyzing the voice of the call has a problem that it is difficult to cope with all kinds of financial fraud techniques that become tricky every day.

In recent years, there has been a rapid increase in the number of voice phishing victims who use Internet telephones to change the telephone numbers of domestic financial institutions and public institutions (public / government / police / post offices, etc.) The fraud scheme for changing the origination number in this manner can not be detected by the above-described conventional anti-phishing method and can be detected by analyzing the IP band of the payload or calling terminal in the Internet telephony signaling message.

With this technique, the IP information of the outgoing call is searched based on the SIP based on Korean Patent Laid-Open Publication No. 2011-0010198 (name: method and system for providing Internet telephone service using the SIP-based calling terminal location information) To a called party to prevent voice phishing is disclosed.

However, the phishing detection and prevention techniques described above have several problems.

First, when the call origination number of the SIP (Session Initiation Protocol) packet or the SIP header of the SIP is transmitted to the domestic IP It is impossible to detect an overseas originated call through IP information.

Second, when a method of analyzing all the SIP packets received in the VoIP server group to the payload is applied, the load on the communication system will be increased, and the problems such as performance degradation and call connection delay are generated in a chain .

It is an object of the present invention to provide a separate phishing detection and blocking device for detecting a voice phishing call without imposing an additional load on the communication system.

The present invention also aims to provide an algorithm capable of detecting a voice phishing call originated from abroad which is illegally changed to a telephone number of a public institution and to provide an effective call blocking method for outgoing call determined as a voice phishing call .

Other objects and advantages of the present invention will be described hereinafter and will be understood by the embodiments of the present invention. Further, objects and advantages of the present invention can be realized by the means and the combination shown in the appended claims.

According to another aspect of the present invention, there is provided a service providing method for blocking an illegal phishing call to an Internet telephone call, the method comprising: (a) Extracting the origination number information and the IP information by analyzing the origination information of the Internet telephone originating from the Internet telephone; (b) inquiring the extracted origination number information to a database in which a telephone number of a financial institution and a public institution is recorded, and judging whether a matching number exists; (c) if there is a matching number, inquiring the extracted IP information and determining whether the calling location is overseas; And (d) if it is confirmed that the call is originated from a foreign country, determining that the call is a phishing call and blocking the origination call.

According to another aspect of the present invention, there is provided a service providing apparatus for detecting and blocking an illegal phishing call for an Internet telephone call, the apparatus comprising: a transmission / reception unit for collecting and analyzing transmission information of an Internet telephone transmitted to a communication system, A calling information extracting module for extracting the calling information; A number inquiry module for inquiring the calling number information extracted by the calling information extracting module in a database in which a telephone number of a financial institution and a public institution is recorded to determine whether a matching number exists; A location inquiry module for inquiring the IP information extracted by the origination information extraction module and determining whether the origination location is overseas; And a location inquiry module that, when it is determined that the phone number is a call originating from abroad as a result of the determination by the location inquiry module and the phone number is a phishing phone call, An Internet telephone anti-phishing call blocking service providing device is provided.

According to another aspect of the present invention, there is provided a recording medium on which a program for performing service processing for detecting and blocking an illegal phishing call for an Internet telephone call is recorded, A procedure for extracting calling number information and IP information, a procedure for inquiring the extracted calling number information to a database in which a telephone number of a financial institution and a public institution is recorded, and judging whether or not a matching number exists, A step of inquiring the extracted IP information to determine whether or not the calling location is abroad, and a program for executing a procedure for judging by a phishing call and blocking the outgoing call when it is confirmed that the calling location is overseas A readable recording medium is provided.

According to the present invention, when an Internet telephone call is collected and analyzed, it is confirmed whether it corresponds to a telephone number of a public institution or a call originated from abroad (using SDP IP), and if both of these conditions are satisfied, The call blocking process can be effectively performed to detect an illegal phishing call.

In the call blocking process, a call release message is generated using the same message format as the illegal phishing call origination call and transmitted to the called party call processing server, and the calling party is guided as if the call release request is made, It is possible to control the release of the phishing call without the interception of call blocking control for the command and call processing apparatus, and it is possible to implement the call blocking processing for the detected phishing call without further interworking processing or interface development for the call processing apparatus to provide.

BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate preferred embodiments of the invention and, together with the description of the invention given below, serve to further augment the technical spirit of the invention. And should not be construed as limiting.
1 is a diagram illustrating a configuration of a communication system in which a method for providing an Internet phone illegal phishing call blocking service according to an embodiment of the present invention is implemented.
FIG. 2 is a block diagram of an apparatus for providing an Internet phone illegal phishing call blocking service according to an embodiment of the present invention. Referring to FIG.
3 is a flowchart illustrating a procedure of a method for providing an Internet phone illegal phishing call blocking service according to an embodiment of the present invention.
4 is a diagram illustrating a signal flow for each node in a method for providing an Internet phone illegal phishing call blocking service according to an embodiment of the present invention.
5 is a diagram illustrating an example of an outgoing call message including IP information and SDP IP information used in a method for providing an Internet phone illegal phishing call blocking service according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Prior to this, terms and words used in the present specification and claims should not be construed as limited to ordinary or dictionary terms, and the inventor should appropriately interpret the concepts of the terms appropriately It should be interpreted in accordance with the meaning and concept consistent with the technical idea of the present invention based on the principle that it can be defined. Therefore, the embodiments described in this specification and the configurations shown in the drawings are merely the most preferred embodiments of the present invention and do not represent all the technical ideas of the present invention. Therefore, It is to be understood that equivalents and modifications are possible.

1 is a diagram illustrating a configuration of a communication system in which a method for providing an Internet phone illegal phishing call blocking service according to an embodiment of the present invention is implemented.

1, the communication system embodying the present invention includes an Internet telephone system, and more particularly, a phishing call blocking apparatus 100 for providing a service for detecting and blocking an illegal phishing call in an Internet telephone origination call, An Internet telephone service server 300, an Internet telephone service subscriber terminal 400, and a ISP communication network.

First, a method for providing an Internet telephone anti-phishing call blocking service according to the present invention is a method in which a phishing call blocking device 100 collects Internet telephone calls transmitted to a network connecting device 200 of the Internet telephone service communication system shown in the figure , It is a service to detect the illegal phishing call and control the call to be released when it is confirmed as an illegal phishing call so that the communication service subscribers are prevented from damaging the illegal phishing call.

The phishing-call interception apparatus 100 collects Internet telephone origination calls originated in the communication system, detects illegal phishing call, and performs a call release process when a phishing call is determined. The phishing call interception device 100 is connected to the network connection device 200 in which Internet call origination calls are collected, and collects and monitors outgoing call messages when an internet telephone call is made. The phishing-call interception apparatus 100 includes a database 150 in which financial and public phone numbers are recorded, and refers to the corresponding database 150 when an illegal phishing call is detected. A more detailed description of the configuration of the phishing call interception device 100 will be described later with reference to additional drawings.

The network access device 200 connects the signal traffic of the subscriber originating from the Internet telephone service subscriber terminal 400 to the ISP communication network. The network access device 200 transmits the Internet telephone call originated from the subscriber terminal 400 to the Internet telephone service server through the ISP communication network. In addition, the network access device 200 is connected to the phishing call interception device 100 and provides Internet phone call information transmitted from the subscriber terminal 400.

The Internet telephone service server 300 performs call processing to provide Internet telephone set-up / call-out and call service to the Internet telephone service subscribers through the subscriber terminal 400. The Internet telephone service server 300 includes a VoIP server and provides a communication service in cooperation with an ISP internal network, an ISP external network, a mobile communication network, and a public switching network. In addition, Internet telephone landing / calling and calling calls include VoIP calls.

The subscriber terminal 400 is an Internet phone terminal for using an Internet telephone service of subscribers subscribed to the Internet telephone service. The subscriber terminal includes a VoIP terminal. Also, the subscriber terminal may include a terminal device for receiving a telephone service through a data communication network.

FIG. 2 is a block diagram of an apparatus for providing an Internet phone illegal phishing call blocking service according to an embodiment of the present invention. Referring to FIG.

Referring to FIG. 2, the apparatus 100 for providing a phishing call blocking service according to the present invention includes a calling information extraction module 110, a number inquiry module 120, a location inquiry module 130, a call blocking module 140, And a database 150.

The origination information extraction module 110 collects Internet telephone origination call information in the communication system and extracts origination information of the origination call. The origination information extraction module 110 may collect Internet telephone origination call information through the network access device 200 of the communication system. In addition, the calling information extracting module 110 extracts the calling number information and the IP information of the calling terminal. At this time, the extracted IP information of the calling terminal includes SDP (Session Description Protocol) IP information.

The number inquiry module 120 compares the originated telephone number of the originated Internet telephone with the telephone numbers stored in the DB 150 to inquire whether a matching telephone number exists. That is, the number inquiry module 120 inquires the calling party number information of the calling information extracted from the calling information extraction module 110 to the database 150 to be described later, Number, and whether or not the number matches the number.

The location inquiry module 130 inquires the calling location through the IP information of the calling terminal of the originated Internet telephone. That is, the location inquiry module 130 analyzes the IP information among the origination information extracted from the origination information extraction module 110 and confirms the originating location of the originating terminal. At this time, the IP information analyzed through the IP information management node of the communication system can be inquired and the location information can be confirmed. Furthermore, the present invention inquires more accurate calling location information through the SDP IP information among the IP information of the Internet telephone origination call information.

That is, by extracting and analyzing unchanged SDP information even if it passes through various VoIP servers at home and abroad, accurate location inquiry can be performed even when IP information is changed from a foreign IP to a foreign IP.

The call blocking control module 140 determines whether or not an illegal phishing call is made for the originated Internet telephone call and performs a process for releasing the call originated when it is determined to be an illegal phishing call. The call blocking module 140 determines whether to block the outgoing call based on the inquiry information through the number inquiry module 120 and the location inquiry module 130. [ When determining whether or not to block the call, the originating phone number matches the financial and public phone number and, at the same time, if the originating location is overseas, it is suspected to be a voice phishing call and is considered to be blocked.

That is, the call blocking control module 140 determines that the calling telephone number of the outgoing call is a telephone number of a domestic financial institution or a public institution, And performs call blocking control processing.

In addition, when the call blocking control module 140 determines that the call is a block to-be-blocked, the call blocking control process is performed, and a call release message is transmitted to the called party so as to release the call. Here, the call release message is made to correspond to the IP information of the outgoing call and the message format of the outgoing call, and a message including a command for releasing the call is generated and transmitted to the called party so as to block the call as if the caller requested the call release .

More specifically, in the call blocking process, the call status of the called party is first checked to confirm whether it is before the call connection or after the call connection. In the pre-call connection state, a CANCEL message is generated in the same manner as the format of the outgoing call message, and the generated IP address is used as the IP of the outgoing call to transmit the generated message to the called VoIP server. In this way, the called party recognizes that the calling terminal requests a call cancellation prior to the call connection, and naturally, the phishing call can be blocked before the call connection.

When the call is already connected, a call termination (BYE) message is generated in the same manner as the format of the outgoing call message, and a message generated in the called VoIP server is transmitted as the IP of the outgoing call. In this case, the called party recognizes that the calling party has requested the termination of the call even after the call is connected, so that the phishing call is naturally terminated during the call, and the called party user can prevent the damage by the phishing call in advance.

In this way, the call blocking control module 140 determines whether or not the outgoing call is blocked. If the call blocking is blocked, the call blocking control module 140 generates a call release message such as a call cancellation or a call termination message according to the call connection status of the called party, Control processing is performed. At this time, the call release message to be generated uses the same format and originating IP as the origination call at the calling side, so that the calling party naturally calls the call blocking process as if requesting the call release.

The database 150 records and manages telephone numbers of domestic financial institutions and public entities. The financial institution may be, for example, a bank, a securities company, or an insurance company. Examples of the public institution include a government agency, a city hall, a post office, and a police station.

3 is a flowchart illustrating a procedure of a method for providing an Internet phone illegal phishing call blocking service according to an embodiment of the present invention.

Referring to FIG. 3, a process of collecting an outgoing call of an Internet telephone originated in a communication system is first performed. At this time, outgoing call information is acquired and collected through the network connection device of the communication system. In addition, the outgoing call information is collected in real time, and it is checked whether the outgoing call is continuously transmitted to collect the outgoing call information immediately after the outgoing call.

When the outgoing call information is collected, a process of extracting the outgoing information from the collected outgoing call information is performed. The origination information extracted at this time includes the originating phone number information and the originating IP information or the SDP IP information of the originating IP information. (S11)

When the calling information is extracted, the calling telephone number of the calling information is searched first in the telephone number database of the public institution, and the procedure for confirming whether or not it matches the telephone number of the public institution is performed (S12)

If the inquiry result shows that the originating telephone number does not match the telephone number of the public institution telephone number DB, the procedure is terminated without further processing of the phish call detection and blocking process.

On the other hand, when it is confirmed that the originating telephone number matches the telephone number of the public institution, the procedure of inquiring the originating IP information out of the origination information extracted by the following procedure is performed. At this time, the originating IP information extracted by the IP information management node can be inquired to check the originating location, or the originating location can be confirmed through the self-managed IP information. In order to confirm the transmission position more accurately, the IP address of the SDP information among the IP information included in the outgoing call information message is checked and the calling position is confirmed (S13)

When it is confirmed that the call origination location is originated in Korea, it is determined that the call origination is a normal general outgoing call, and the above-described phish call detection and blocking process termination process is performed.

On the other hand, when it is confirmed that the call is originated from outside the country, it is determined that the outgoing call is an illegal phishing call,

If it is determined that the call is a block to-be-blocked, the call blocking procedure for the outgoing call is performed to prevent damage caused by the phishing call (S15)

4 is a diagram illustrating a signal flow for each node in a method for providing an Internet phone illegal phishing call blocking service according to an embodiment of the present invention.

First, an outgoing call is transmitted from a VoIP terminal or a VoIP server to a network access device. At this time, the outgoing call is transmitted to the network access device in the SIP protocol INVITE message (S21)

The network access device transmits an INVITE message to the called VoIP server in accordance with a general Internet phone call origination process to guide the call incoming process according to the call origination (S22)

At the same time, the INVITE message of the Internet telephone call received from the network access device is collected in the phishing call blocking server. That is, the SIP INVITE message transmitted through the network access device is transmitted to the VoIP server, and the same packet is copied and transmitted to the phishing call blocking server (S31)

The phishing-call blocking server extracts the origination number and IP information, preferably SDP IP, from the collected outgoing call message (S32)

Then, the extracted calling number is searched in the public institution number DB, and the calling location is inquired through the extracted SDP IP (S33)

Through the number and IP inquiry, it is judged whether or not the collected outgoing call is blocked. At this time, if the calling number is a telephone number of a public institution and the calling location is abroad, it is determined as a phishing call and determined as a blocking target.

On the other hand, when the calling number is not the telephone number of the public institution or the calling location is in the home country, it is determined that the calling number is a normal calling number and the blocking process is terminated (S34)

When the phishing call blocking server determines that the collected outgoing call is to be blocked, it checks the call status of the call. That is, the call state of the current time is confirmed (S35)

It is determined whether the call state of the outgoing call is a state prior to the current call connection (call waiting state) or during a call connection state (during a call) (S36)

If it is confirmed that the state before call connection is established, the phishing-call blocking server generates a CANCEL message in the call release message. At this time, a CANCEL message is generated using the same SIP Call-ID and SIP header as the initially received INVITE message, so that the generated message can be judged as a message received from the sender of the first INVITE message. (S41)

The phishing-call blocking server transmits a message generated in the VoIP server after generating the call cancellation message, and transmits the generated IP as the IP of the first originated VoIP terminal instead of the IP of the phishing-call blocking server in step S42 )

Upon receipt of the call cancel message from the phishing-call blocking server, the VoIP server recognizes the call as a call cancellation request from the calling terminal according to the call cancellation request included in the message, cancels the corresponding call in the call waiting state, Side VoIP terminal to complete the call cancellation process. Thus, the phishing call determined as the blocking target can cancel the call naturally before the call connection, and can perform the call blocking process without interworking with another communication device. (S43)

On the other hand, if it is confirmed that the call connection is established, the phishing call blocking server generates a call end (BYE) message among the call release messages. At this time, a BYE message is generated using the same SIP Call-ID and SIP header as the initially received INVITE message, so that the first INVITE message can be determined as a message received from the transmitting side (S51)

The phishing-call blocking server generates a call termination message, and then transmits a message generated in the VoIP server. The phishing-call blocking server transmits the generated IP as the IP of the VoIP terminal that originated the call instead of the IP of the phishing-call blocking server. )

Upon receipt of the call termination message from the phishing-call blocking server, the VoIP server recognizes the call termination request from the calling terminal according to the call termination request included in the message, terminates the corresponding call in the call connection state, The call termination response message is transmitted to the VoIP terminal, and the call termination process is completed. Thus, the phishing call determined to be the blocking object is naturally terminated during the call connection, and the call blocking process can be performed without interworking with another communication device (S53)

5 is a diagram illustrating an example of an outgoing call message including IP information and SDP IP information used in a method for providing an Internet phone illegal phishing call blocking service according to an embodiment of the present invention.

Referring to FIG. 5, a SIP protocol message among origination call messages included in the origination information will be described as an example. As shown in the figure, the source IP information and the destination IP information are recorded at the top of the message. When this information is passed through the VoIP server group due to the nature of the SIP protocol, the source IP of the first terminal is not maintained, and the packet is changed to the IP of the group of the VoIP server that has passed through. Therefore, when a call is made to a domestic subscriber by sending an Internet phone call from abroad, the foreign IP of the originating terminal may be changed to a domestic IP at an intermediate stage since it flows into the domestic VoIP server group through various VoIP server groups. Accordingly, when the source IP of the SIP message or the IP in the SIP header is checked by a domestic VoIP server or a phishing call interception device, the IP address is changed to the domestic IP so that it is impossible to accurately grasp whether or not the call originated from abroad.

However, an SDP having IP information for transmitting and receiving RTP (Real Time Protocol), which is included in SIP and transmits and receives voice call packet information during a call, can maintain the first terminal IP. As shown in the figure, the source IP of the INVITE message is '211.253.124.89', and it is understood that the IP is domestic IP, and the SDP IP is '110.16.123.3'. Therefore, in the embodiment of the present invention, the IP information in the SDP is additionally checked at the time of confirming the IP information in the calling information, so that the calling location can be confirmed more accurately.

The method of the present invention as described above may be embodied as a program and stored in a computer-readable recording medium (such as a CD-ROM, a RAM, a ROM, a floppy disk, a hard disk, or a magneto-optical disk).

While the specification contains many features, such features should not be construed as limiting the scope of the invention or the scope of the claims. In addition, the features described in the individual embodiments herein may be combined and implemented in a single embodiment. Conversely, various features described herein in a single embodiment may be implemented in various embodiments individually or in a suitable subcombination.

It is to be understood that, although the operations have been described in a particular order in the figures, it should be understood that such operations are performed in a particular order as shown, or that a series of sequential orders, or all described operations, . In some circumstances, multitasking and parallel processing may be advantageous. It should also be understood that the division of various system components in the above embodiments does not require such distinction in all embodiments. The above-described program components and systems can generally be implemented as a single software product or as a package in multiple software products.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention. The present invention is not limited to the drawings.

110: Originating information extraction module 120: Position inquiry module
130: Number inquiry module 140: Call blocking control module

Claims (15)

delete delete A service providing method for detecting and blocking an illegal phishing call for an Internet telephone call,
(a) extracting origination number information and IP information by analyzing origination information of the Internet telephone when a call forwarding process of an Internet telephone originated in the communication system proceeds;
(b) inquiring the extracted origination number information to a database in which a telephone number of a domestic financial institution and a public institution is recorded, and judging whether or not a matching number exists;
(c) if there is a matching number, inquiring the extracted IP information and determining whether the calling location is overseas; And
(d) blocking the outgoing call when it is determined that the outgoing call is originated from a foreign country, the outgoing call of the Internet telephone is changed into a calling number, and the outgoing call is determined as a phishing call originated from abroad,
In the step (d), the outgoing call interception processing may include:
Generates the call release message in the same format as the message of the outgoing call and transmits the call release message to the called party call processing server,
The step (d)
(d1) judging a call state of the current outgoing call if it is determined to be a phishing call;
(d2) when the outgoing call is in a pre-call connection state, generating a CANCEL message using the same SIP Call-ID and SIP header as the originally originated INVITE message; And
(d3) transmitting the source IP of the originally originated INVITE message as a source IP of the generated call cancel message to the called party call processing server . A service providing method for detecting and blocking an illegal phishing call for an Internet telephone call,
(a) extracting origination number information and IP information by analyzing origination information of the Internet telephone when a call forwarding process of an Internet telephone originated in the communication system proceeds;
(b) inquiring the extracted origination number information to a database in which a telephone number of a domestic financial institution and a public institution is recorded, and judging whether or not a matching number exists;
(c) if there is a matching number, inquiring the extracted IP information and determining whether the calling location is overseas; And
(d) blocking the outgoing call when it is determined that the outgoing call is originated from a foreign country, the outgoing call of the Internet telephone is changed into a calling number, and the outgoing call is determined as a phishing call originated from abroad,
In the step (d), the outgoing call interception processing may include:
Generates the call release message in the same format as the message of the outgoing call and transmits the call release message to the called party call processing server,
The step (d)
(d4) judging a call state of the current outgoing call if it is determined to be a phishing call;
(d5) generating a call termination (BYE) message using the same SIP Call-ID and SIP header as the originally originated INVITE message when the outgoing call is connected; And
(d6) transmitting the source IP of the originally originated INVITE message as a source IP of the generated call end message to the called party call processing server . The method according to claim 3 or 4,
In the step (a)
SDP (Session Description Protocol) IP information for voice call packet transmission and reception,
In the step (c)
Searching the extracted SDP IP information to determine whether the calling location is overseas or not. The method according to claim 3 or 4,
In the step (b)
And if it is determined that there is no matching number, then the illegal phishing call detection and blocking procedure is terminated. The method according to claim 3 or 4,
In the step (c)
Wherein the illegal phishing call detection and blocking procedure is terminated when it is determined that the call origination position is originated in Korea. The method according to claim 3 or 4,
Wherein the Internet telephone call is a VoIP call. The method according to claim 3 or 4,
Wherein the incoming call processing server is a VoIP server. A service providing apparatus for detecting and blocking an illegal phishing call for an Internet telephone call,
An origination information extracting module for extracting origination number information and IP information by collecting and analyzing origination information of the Internet telephone when call incoming processing of an Internet telephone originated in a communication system proceeds;
A number inquiry module for inquiring the calling number information extracted by the calling information extracting module to a database in which a telephone number of domestic financial and public institutions is recorded to determine whether a matching number exists;
A location inquiry module for inquiring the IP information extracted by the origination information extraction module and determining whether the origination location is overseas; And
If it is determined by the number inquiry module that there is a matching number and that the location inquiry module is originated from abroad as a result of the determination, the outgoing call of the Internet telephone is changed to the outgoing phishing call And a call blocking control module for blocking the outgoing call by judging,
Wherein the call blocking module comprises:
The IP address extracted by the origination information extracting module is used as the source IP information, a call release message is generated in the same format as the message of the outgoing call, and the call release message is transmitted to the destination call processing server. (CANCEL) message using the same SIP Call-ID and SIP header as the message of the outgoing call when the state of the current outgoing call is in a pre-call connection state as a result of the discrimination, And transmits the source IP of the call message to the destination call processing server as the source IP of the generated call cancellation message. delete 11. The method of claim 10,
Wherein the call blocking module comprises:
If it is determined by the number inquiry module that there is no matching number, or if it is determined that the number is originated in the domestic area as a result of the determination by the location inquiry module, the outgoing call of the Internet telephone is determined as a general call, And terminating the blocking procedure. 11. The method of claim 10,
Wherein the calling information extraction module comprises:
SDP (Session Description Protocol) IP information for voice call packet transmission and reception,
The location inquiry module,
And searching the extracted SDP IP information to determine whether the calling location is overseas or not. 11. The method of claim 10,
Wherein the calling information extraction module collects calling information of an Internet telephone from a network access device of a communication system. 1. A recording medium on which a program for performing service processing for detecting and blocking an illegal phishing call for an Internet telephone call is recorded,
A procedure for analyzing origination information of the Internet telephone and extracting origination number information and IP information when call forwarding processing of the Internet telephone originated in the communication system proceeds;
A step of inquiring the extracted origination number information to a database in which a telephone number of a domestic financial institution and a public institution is recorded to determine whether a matching number exists,
If there is a matching number, inquiring the extracted IP information and determining whether the calling location is overseas;
A procedure for determining that an outgoing call of the Internet telephone is a phishing call originated from an overseas country when the origination number is changed;
If it is determined to be a phishing call, a procedure for determining the call state of the current outgoing call and
And generating a call end (BYE) message using the same SIP Call-ID and SIP header as the message of the outgoing call if the current outgoing call is connected to the generated outgoing call, And transmitting the call termination message to the called party call processing server as the source IP of the call termination message, thereby blocking the outgoing call.

Images