KR20150047378A - Device of blocking voice phishing calls - Google Patents

Abstract

The present invention relates to a device for blocking voice phishing calls, more specifically for deciding a voice phishing call based on the information from a transmitting terminal. The device includes: an extension interface part connected to a call processing device connected to a transmitting user terminal; a state data collecting part which collects state data for a call of the transmitting user terminal from the call processing device; a call information extracting part which extracts call information of the transmitting user terminal from the collected state data for a call; and a server interface part which provides call information on a request of phishing managing server outside.

Description

[0001] DEVICE OF BLOCKING VOICE PHISHING CALLS [0002]

FIELD OF THE INVENTION The present invention relates to a voice phishing prevention apparatus, and more particularly, to a voice phish prevention apparatus capable of determining whether or not a voice phishing call is based on information on a calling terminal side.

Voice phishing is a compound word of voice, private data, and fishing. It usually refers to a phone finance fraud that illegally extracts personal information by phone.

Here, the criminals who use voice phishing can trick the other person by using a telephone or the like to find out personal financial information corresponding to a password of a financial institution, withdraw money or remit money in the name of a refund, The leakage of personal information and infringement of property rights are increasing.

Various techniques have been provided to prevent crime through voice phishing. The following prior patents provide techniques related thereto.

Korean Patent Laid-Open No. 10-2010-0126044 relates to a voice phishing prevention technique, and more particularly, to a voice phishing prevention technique, in a wired or wireless Voip telephone network, an announcement message indicating an international call is connected And a method for providing a voice phishing announcement service for an international call in a telephone network by making a call between an originating call and an incoming call.

The present invention has the effect of preventing voice phishing by informing the calling terminal in advance when the calling terminal is an international call in a situation where the damage of voice phishing to the international call is increased. However, this technique has a problem that sophisticated detection of voice phishing can not be performed by providing a voice phishing suspicion announcement broadcast to the called terminal for all international calls.

Korean Patent Laid-Open No. 10-2009-0129179 relates to a technique for preventing voice phishing, and more specifically, a billing information storing means for storing billing-related information, a subscriber information storing means for storing subscriber information, A voice phishing black list storing means for storing a black list for voice phishing; a voice phishing processing means for inquiring the charging information storing means, the subscriber information storing means and the voice phishing black list storing means, And a transmitting means for transmitting the voice phishing discrimination result (voice phishing discrimination information) from the voice phishing processing means to the receiving side, thereby discriminating (judging) the voice phishing and transmitting the voice phishing discriminating information to the receiving side, Accordingly, information on the voice phishing can be collected according to the corresponding voice phishing on the receiving side.

The present invention has an effect of receiving an incoming telephone number from a user terminal and comparing the incoming telephone number with a black list associated with voice phishing, and informing the user terminal that voice phishing is included if the incoming telephone number is included in the black list . However, this technique only determines whether the incoming telephone number corresponds to a previously stored blacklist, so that the criminal attempts to steal the telephone number of the other person, i.e., voice phishing using another telephone number not stored in the blacklist There is a problem that it can not be utilized.

Currently, there are various techniques for preventing voice phishing. However, there is no technology for accurately determining whether voice phishing is performed in the case of voice phishing attempted by stealing a telephone number of another person, and informing the user terminal of the result.

Korean Patent Publication No. 10-2010-0126044 Korean Patent Laid-Open No. 10-2009-0129179

The present invention provides a voice phishing prevention apparatus connected to a call processing apparatus and capable of collecting data on a call state of an originating user terminal and determining whether or not it corresponds to a voice phishing telephone.

The present invention intends to provide a voice phishing prevention apparatus capable of determining whether or not it is a voice phishing telephone using a call detail record (CDR), a call log, or a real time call database of a call processing apparatus.

The present invention provides a voice phishing prevention apparatus capable of storing or deleting data required for voice phishing confirmation according to a call state of a calling user terminal.

The present invention intends to provide a voice phishing prevention apparatus capable of determining whether or not a voice phishing call is made in an Internet telephone terminal or a wireless user terminal.

In one embodiment, the voice phishing prevention apparatus includes an extension interface unit connected to a call processing apparatus connected to a calling user terminal, a status data collecting unit collecting call status data of the calling user terminal from the call processing apparatus, A call information extracting unit for extracting call information of the calling user terminal from the collected call state data, and a server interface unit for providing the call information according to a request from an external phishing management server.

The call information may include at least one of call progress information, calling user terminal identification information, and receiving user terminal identification information of the calling user terminal.

In one embodiment, the status data collecting unit may collect call status data by mirroring data of the call processing apparatus. Wherein the call information extracting unit extracts and stores the call information from the collected call state data when the call of the calling user terminal is started and deletes the stored call information when the call of the calling user terminal ends .

In another embodiment, the status data collector may collect call status data from at least one of a call detail record (CDR), a call log, or a real-time call database of the call processing device. The call information extracting unit extracts and stores call call information from the start CDR signal upon receiving the start CDR signal of the calling user terminal and deletes the stored call call information upon receiving the stop CDR signal of the calling user terminal .

The call information extraction unit may extract a call start pattern from the call log and store the call start pattern as call call information. When the call end pattern is extracted from the call log, the call information extraction unit deletes the stored call call information.

A call information extracting unit for extracting call information of the calling user terminal from the collected call state data and a call information extracting unit for extracting call information of the calling user terminal from the collected call state data and an external phishing management server And provides the call information according to a request from the server interface unit.

The status data collecting unit may include at least one of a call detail record (CDR), a call log, and a real-time call database.

The call information extracting unit extracts and stores call call information from the start CDR signal upon receiving the start CDR signal of the calling user terminal and deletes the stored call call information upon receiving the stop CDR signal of the calling user terminal .

The call information extraction unit may extract a call start pattern from the call log and store the call start pattern as call call information, and delete the call call information when the call end pattern is extracted from the call log.

Among the embodiments, the voice phishing prevention system includes a call processing device connected to an originating user terminal, a voice phishing prevention device connectable to the call processing device, and a phishing management server connectable to the call processing device and the receiving user terminal The voice phishing prevention device may collect call state data of the calling user terminal from the call processing device and extract call information of the calling user terminal.

The voice phishing prevention apparatus may collect call state data from at least one of a call detail record (CDR), a call log, and a real time call database of the call processing apparatus.

In one embodiment, the phishing management server receives the call information, extracts the calling number information, and checks whether the extracted calling number information and the calling information in the calling user terminal are inconsistent, And a notification message is transmitted to the mobile station.

In another embodiment, the phishing management server may have a database of identification numbers of terminals participating in a separate anti-phishing service among the receiving user terminals, and the called number extracted from the call information may be stored in the stored identification number It is possible to transmit a notification message to the corresponding receiving user terminal.

The voice phishing prevention apparatus and related arts according to an embodiment of the present invention can accurately detect whether or not the call is a voice phishing by grasping the call state of the calling user terminal in real time.

The voice phishing prevention apparatus and the related arts according to an embodiment of the present invention can extract voice call information that can grasp the call state among data recorded in the call processing apparatus, thereby performing an accurate and effective voice phishing prevention function.

The voice phishing prevention apparatus and related techniques according to an embodiment of the present invention can efficiently manage the user terminals connected through the call processing apparatus so as not to be abused by voice phishing.

1 is a view for explaining a voice phishing prevention system according to an embodiment of the present invention.
Fig. 2 is a block diagram illustrating the voice phishing prevention apparatus shown in Fig. 1. Fig.
3 is a flowchart illustrating an operation procedure of the voice phishing prevention system of FIG.
FIG. 4 is a diagram for explaining a call state data collection process by a mirroring technique.
5 is a diagram for explaining a process of collecting call status data through a CDR, a call log, or a real-time call database.

The description of the present invention is merely an example for structural or functional explanation, and the scope of the present invention should not be construed as being limited by the embodiments described in the text. That is, the embodiments are to be construed as being variously embodied and having various forms, so that the scope of the present invention should be understood to include equivalents capable of realizing technical ideas. Also, the purpose or effect of the present invention should not be construed as limiting the scope of the present invention, since it does not mean that a specific embodiment should include all or only such effect.

Meanwhile, the meaning of the terms described in the present application should be understood as follows.

The terms "first "," second ", and the like are intended to distinguish one element from another, and the scope of the right should not be limited by these terms. For example, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component.

It is to be understood that when an element is referred to as being "connected" to another element, it may be directly connected to the other element, but there may be other elements in between. On the other hand, when an element is referred to as being "directly connected" to another element, it should be understood that there are no other elements in between. On the other hand, other expressions that describe the relationship between components, such as "between" and "between" or "neighboring to" and "directly adjacent to" should be interpreted as well.

It should be understood that the singular " include "or" have "are to be construed as including a stated feature, number, step, operation, component, It is to be understood that the combination is intended to specify that it does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

In each step, the identification code (e.g., a, b, c, etc.) is used for convenience of explanation, the identification code does not describe the order of each step, Unless otherwise stated, it may occur differently from the stated order. That is, each step may occur in the same order as described, may be performed substantially concurrently, or may be performed in reverse order.

The present invention can be embodied as computer-readable code on a computer-readable recording medium, and the computer-readable recording medium includes all kinds of recording devices for storing data that can be read by a computer system . Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like, and also implemented in the form of a carrier wave (for example, transmission over the Internet) . In addition, the computer-readable recording medium may be distributed over network-connected computer systems so that computer readable codes can be stored and executed in a distributed manner.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs, unless otherwise defined. Commonly used predefined terms should be interpreted to be consistent with the meanings in the context of the related art and can not be interpreted as having ideal or overly formal meaning unless explicitly defined in the present application.

1 is a view for explaining a voice phishing prevention system according to an embodiment of the present invention.

1, the voice phishing prevention system 100 includes an originating user terminal 110, a call processing device 120, a voice phishing prevention device 130, a phishing management server 140, and a receiving user terminal 150 , And each configuration can be interconnected via a network (communication network, Internet, etc.).

The calling user terminal 110 is a general communication terminal, and may correspond to a terminal whose identification number is stolen by a third party. The originating user terminal 110 may correspond to a terminal of a government office (for example, a police agency, a fire department, etc.) or a terminal of a public institution (hospital, financial institution, etc.).

The calling user terminal 110 is connected to the call processing device 120 and connected to an external communication network. The call record of the originating user terminal 110 may be recorded or processed by the call processing device 120.

The call processing device 120 is an extension device of an enterprise, a building, or the like, and provides a usable number in an extension line in which each unique number is set, and handles the external or internal connection of the connected user terminal. The call processing apparatus 120 may correspond to a private branch exchange (PBX).

The voice phishing prevention apparatus 130 is connected to the call processing apparatus 120 and collects call data of the calling user terminal 110 processed by the call processing apparatus 120 and extracts specific information. The voice phishing prevention apparatus 130 will be described in detail with reference to FIG.

The phishing management server 140 requests the voice phishing prevention apparatus 130 for information on the calling state of the calling user terminal 130 when there is a confirmation request for voice phishing from the receiving user terminal 150. [ The phishing management server 140 informs the receiving user terminal 150 of the voice call from the voice phishing prevention apparatus 130 when the corresponding call is determined to correspond to voice phishing.

The receiving user terminal 150 is a terminal for receiving a call suspected of voice phishing, and may correspond to a wireless communication terminal such as a general telephone, an Internet telephone, or a smart phone. The receiving user terminal 150 may provide authentication management, updating, automatic confirmation number processing, and phishing alert sound generation by an application in the case of a smartphone.

Fig. 2 is a block diagram illustrating the voice phishing prevention apparatus shown in Fig. 1. Fig.

2, the voice phishing prevention apparatus 130 includes an extension interface unit 210, a status data collection unit 220, a call information extraction unit 230, a server interface unit 240, and a control unit 250 do.

The extension interface unit 210 provides an interface necessary for exchanging data with the call processing apparatus 120. [ Related information to the calling user terminal 110 between the call processing device 120 and the voice phishing prevention device 130 when the environment for data communication is determined through the extension interface 210. [

When the environment for data communication is determined through the extension interface unit 210, the state data collection unit 220 may collect call state data of the calling user terminal 110 through data exchange with the call processing apparatus 120 have. The call status data collection method of the status data collection unit 220 will be described in detail with reference to FIG. 5 and FIG.

The call information extracting unit 230 extracts call information necessary for determining voice phishing from the call state data collected by the state data collecting unit 220. [ Here, the call information may include at least one of call progress information, calling user terminal identification information, and receiving user terminal identification information of the calling user terminal 140. The call information extracting unit 230 will be described in detail with reference to FIG. 5 and FIG.

The server interface unit 240 receives the call information extracted by the call information extracting unit 230 when the external phishing management server 140 requests information on the call status of the calling user terminal 130 To the external phishing management server (140).

The control unit 250 controls operations of the extension interface unit 210, the status data collection unit 220, the call information extraction unit 230, and the server interface unit 240 and the flow of data.

3 is a flowchart illustrating an operation procedure of the voice phishing prevention system of FIG.

In FIG. 3A, the call processing apparatus 120 is responsible for external connection or internal connection of the calling user terminal 110, and may store a CDR (Call Detail Record) or a call log necessary for the connection.

The voice phishing prevention apparatus 130 is connected to the call processing apparatus 120 and collects call data processed by the call processing apparatus 120 and extracts specific information.

The extension interface unit 210 provides an interface necessary for exchanging data with the call processing apparatus 120. [

When the environment for data communication is determined through the extension interface unit 210, the state data collection unit 220 may collect call state data of the calling user terminal 110 through data exchange with the call processing apparatus 120 have. The status data collecting unit 220 may collect all or a part of a CDR (Call Detail Record) or a call log (Log) stored in the call processing device 120 as call status data.

In one embodiment, the status data collecting unit 220 may collect call status data by mirroring the data of the call processing apparatus 120. [ The process of the state data collecting unit 220 to mirror the data of the call processing apparatus 120 will be described with reference to FIG.

The call information extracting unit 230 extracts the call information required to determine whether or not voice phishing is performed from the call state data collected by the state data collecting unit 220. Here, the call information may include at least one of call progress information of the calling user terminal 110, identification information of the calling user terminal 110, and identification information of the receiving user terminal 150.

In FIG. 3A, the call information extracting unit 230 may extract identification information of the calling user terminal 110 and identification information of the receiving user terminal 150 as call call information (step S310a).

In one embodiment, the anti-phishing device 130 may be implemented integrally with the call processing device 120. That is, the voice phishing prevention apparatus 130 may be implemented by including a voice phishing prevention module in the existing call processing apparatus 120.

The server interface unit 240 receives the call information extracted by the call information extracting unit 230 when the external phishing management server 140 requests information on the call status of the calling user terminal 130 To the external phishing management server 140 (step S320a).

The server interface unit 240 may provide the phishing management server 140 with the call information for all calls or may provide only a confirmation signal as to whether the call corresponds to voice phishing.

 In one embodiment, the server interface 240 may provide the phishing management server 140 with a management station number list of the originating user terminal 130 managed by the voice phishing prevention device 130.

The phishing management server 140 can extract the calling number from the call information received from the voice phishing prevention device 130. [ The phishing management server 140 notifies the receiving user terminal 150 of the extracted calling number by the PUSH transmission (step S340a) when the extracted calling number is inconsistent with the calling information that the receiving user terminal 150 is talking to (step S330a).

In one embodiment, the phishing management server 140 may have a database for the identification number of a separate anti-phishing service subscription terminal. The phishing management server 140 can confirm whether or not the called number extracted from the call call information matches the identification number of the phishing protection service subscriber stored in the database. The phishing management server 140 can notify the receiving user terminal 150 by PUSH transmission only when the corresponding identification numbers match.

Upon receiving the PUSH, the receiving user terminal 150 can inform the user whether the voice phishing is performed through a popup form or the like (step 350a)

In one embodiment, the phishing management server 140 may be based on a Short Message Service (SMS) -based message, a MultiMedia Messaging System (MMS) based message, an Instant message, and a Transmission Control Protocol / Internet Protocol It is possible to notify the receiving user terminal 150 of the presence of voice phishing.

3B, when the receiving user terminal 150 is a separate anti-phishing service subscription terminal, the phishing management server 140 can perform a uniform notification without checking whether the calling number is inconsistent.

Specifically, the phishing management server 140 can receive call call information for all calls connected to the external communication network through the call processing device 120 equipped with the voice phishing prevention device 130. [

For example, the phishing management server 140 can receive all the call information of a government office or a financial institution having the voice phishing prevention apparatus 130, and the user of the receiving user terminal 150 can reliably receive And a separate PUSH transmission can be performed to receive the call.

In one embodiment, the phishing management server 140 may be configured to provide notification by separate PUSH transmissions only to a separate anti-phishing service subscribed receiving user terminal 150. [

FIG. 4 is a diagram for explaining a call state data collection process by a mirroring technique.

The status data collecting unit 220 may collect call status data by mirroring the data of the call processing apparatus 120. [ The mirroring technology refers to a technique of collecting call state data necessary for monitoring communication traffic from the call processing device 120 to the external communication device 410 to confirm whether voice phishing is performed. The mirroring method has an advantage that the voice phishing prevention apparatus 130 can be implemented without affecting the operation of the existing call processing apparatus 120.

In one embodiment, the call information extraction unit 230 extracts and stores call information from the call state data collected by mirroring when the call of the originating user terminal 110 is started, When the call is terminated, the stored call information is deleted, and the real-time list information of the calling user terminal 110 currently in communication can be efficiently managed.

5 is a diagram for explaining a process of collecting call status data through a CDR, a call log, or a real-time call database.

The state data collection unit 220 may collect call state data from at least one of a call detail record (CDR), a call log, or a real time call database 510 of the call processing apparatus 130.

Here, the CDR (Call Detail Record) may correspond to the standard data for accounting information recording of the calling user terminal 110, and the call log may correspond to the call history of the calling user terminal 110 May correspond to a recording file for < / RTI >

The real-time call database may correspond to a storage device in the call processing device 130 that classifies and stores call records of the calling user terminal 110 in real time.

When the call state data includes the CDR, the call information extracting unit 230 extracts and stores the call call information from the start CDR signal when the start CDR signal of the calling user terminal 150 is received, ), The stored call information is deleted, and the efficiency of data management can be improved.

When the call state data includes a call log, the call information extracting unit 230 extracts a call start pattern from the call log and stores the extracted call start pattern as call call information. If the call end pattern is extracted from the call log, The data management efficiency can be improved.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the present invention as defined by the following claims It can be understood that

100: Voice phishing prevention system 110: Outgoing user terminal
120: call processing device 130: voice phishing prevention device
140: Phishing management server 150: Receiving user terminal
210: extension interface unit 220: status data collecting unit
230: Call information extracting unit 240: Server interface unit
250:
410: External communication device
510: CDR, call log or real time call database

Claims (16)

An extension interface unit which can be connected to a call processing apparatus connected to an originating user terminal;
A status data collecting unit capable of collecting call state data of the calling user terminal from the call processing apparatus;
A call information extracting unit for extracting call information of the calling user terminal from the collected call state data; And
A server interface unit for providing the call information in response to a request from an external phishing management server;
And a voice phishing prevention device.
2. The method of claim 1,
Wherein the caller information includes at least one of call progress information, calling user terminal identification information, and receiving user terminal identification information of the calling user terminal.
The apparatus of claim 1, wherein the status data collecting unit
Wherein the voice processing unit collects call state data by mirroring data of the call processing device.
4. The apparatus of claim 3, wherein the call information extracting unit
Extracting and storing the call information from the collected call state data when the call of the calling user terminal is started,
And when the call of the calling user terminal ends, the stored voice call information is deleted.
The apparatus of claim 1, wherein the status data collecting unit
And collects call state data from at least one of a CDR (Call Detail Record), a call log, and a real-time call database of the call processing apparatus.
6. The apparatus of claim 5, wherein the call information extractor
Upon receiving the start CDR signal of the calling user terminal, extracts and stores the call call information from the start CDR signal,
And when the stop CDR signal of the calling user terminal is received, the stored voice call information is deleted.
6. The apparatus of claim 5, wherein the call information extractor
Extracts a call start pattern from the call log, stores the extracted call start pattern as call call information,
And extracts the call termination pattern from the call log to delete the stored call call information.
A status data collecting unit capable of collecting call state data of an originating user terminal;
A call information extracting unit for extracting call information of the calling user terminal from the collected call state data; And
A server interface unit for providing the call information according to a request from an external phishing management server;
To the call processing apparatus.
The apparatus of claim 8, wherein the status data collector
A call detail record (CDR), a call log, and a real time call database.
The apparatus of claim 9, wherein the call information extractor
Upon receiving the start CDR signal of the calling user terminal, extracts and stores the call call information from the start CDR signal,
And upon receiving the stop CDR signal of the calling user terminal, deletes the stored call information.
The apparatus of claim 9, wherein the call information extractor
Extracts a call start pattern from the call log, stores the extracted call start pattern as call call information,
And deletes the stored call information when a call termination pattern is extracted from the call log.
A call processing device connected to the calling user terminal;
A voice phishing prevention device connectable to the call processing device; And
And a phishing management server connectable to the call processing device and the receiving user terminal,
Wherein the voice phishing prevention device collects call state data of the calling user terminal from the call processing device and extracts the call information of the calling user terminal.
13. The voice phishing prevention device according to claim 12, wherein the voice phishing prevention device
And collects call state data from at least one of a call detail record (CDR), a call log, and a real time call database of the call processing device.
13. The system according to claim 12, wherein the phishing management server
Extracts calling number information by receiving the call information,
Wherein the control unit checks whether the extracted calling number information and the calling user information are inconsistent with each other and transmits a notification message to the receiving user terminal.
13. The system according to claim 12, wherein the phishing management server
And a database for an identification number of a terminal subscribed to a separate anti-phishing service among the receiving user terminals.
16. The system according to claim 15, wherein the phishing management server
And a notification message is transmitted to the corresponding receiving user terminal if the called number extracted from the call information matches the stored identification number.

Images