Patent Publication Number: US-6701439-B1

Title: Call rejection interface for internet protocols

Description:
BACKGROUND OF THE INVENTION 
     The present invention relates to the art of internet protocols and, more specifically, to providing call rejection in the case of potential hackers or faulty internet telephony. 
     Typically, internet and data networks use a number of challenges and password routines on dial-up connections to ensure that hackers or otherwise unauthorized users cannot enter these networks using an assumed identity of another. On privileged access connections, such as wide area network (WAN) connections using frame relay or asynchronous transfer mode (ATM), the users are often assumed to be secure users or within the privileges defined by a firewall. The firewall is a sub-system of computer software and/or hardware that intercepts data packets before allowing them into or out of a data network, such as a local area network (LAN). The firewall makes decisions on whether or not to allow data to pass based upon a security policy. 
     Likewise, with tunneling protocols that allow dial-up connections to be transferred over WANs, a mixture of dial-up challenges, passwords and fraud detection programs are used to protect the network from hackers. Generally, tunneling, also known as encapsulation, refers to the practice of encapsulating a message from one protocol in a second, and using the facilities of the second protocol to traverse some number of network hops. In other words, the data packets are “wrapped” with another protocol so that they can pass through firewalls and then “unwrapped” once they reach their destination. This means that the user has a way to securely work through firewalls so that he can access network resources as if the firewalls do not exist. 
     Typically however, in these tunneling protocols, such as layer 2 tunneling protocol (L2TP), which is the emerging Internet Engineering Task Force (IETF) standard, the tunnel is torn down when a hacker is suspected on the connection. Since many users use the same tunnel, this effects the service of many users. Moreover, it does not allow the opportunity to discover the true identity of the hacker, and typically, the data network is not otherwise equipped with the proper resources or capability to accurately identify or surveil the hacker. 
     Additionally, in the case of, e.g., internet telephony, when a call is faulty or a data network handling the call is otherwise unable to handle the call due to, perhaps, routing problems, congestion, or the like, the call is merely dropped. This limitation is particularly significant in the case of toll calls where an access charge is paid even though ultimately the call is dropped and not completed. 
     The present invention contemplates a new and improved call rejection technique and/or protocol which overcomes the above-referenced problems and others. 
     SUMMARY OF THE INVENTION 
     In accordance with one aspect of the present invention, a method of call rejection is provided for use in connection with a data network. It includes establishing a point-of-presence which serves as a termination point for receiving calls from clients. Received calls are then multiplexed into a tunnel as separate identifiable tunnel sessions. The tunnel sessions are received at a network server of the data network. Next, it is determined for each tunnel session if access to the data network is to be denied. If access is denied, then a call rejection message is returned to the point-of-presence via the tunnel. 
     In accordance with a more limited aspect of the present invention, the point-of-presence is established at a telephone company central office having a telecommunications switch which is connected to a public switched telephone network. 
     In accordance with a more limited aspect of the present invention, the call rejection message identifies the tunnel session for which access is denied. 
     In accordance with a more limited aspect of the present invention, the call rejection message identifies a reason for access denial. 
     In accordance with a more limited aspect of the present invention, the method further includes receiving and interpreting the call rejection message at the point-of-presence. Then, the switch is controlled in response to the call rejection message. 
     In accordance with a more limited aspect of the present invention, if the reason for access denial is suspected intrusion into the data network by an unauthorized entity, then the method further includes holding the tunnel session identified until a call trace is completed. 
     In accordance with a more limited aspect of the present invention, if the reason for access denial is suspected intrusion into the data network by an unauthorized entity, then controlling the switch includes at least one of the following: identifying a phone number from which the unauthorized entity is calling; marking the unauthorized entity&#39;s line; monitoring the unauthorized entity&#39;s line; disconnecting the unauthorized entity&#39;s telephone service; blocking calls from the unauthorized entity; and/or reporting activities of the unauthorized entity to governmental or regulatory authorities or operators of the data network or operators of other data networks. 
     In accordance with a more limited aspect of the present invention, the method further includes storing telephone numbers from which unauthorized entities attempt to access the data network. 
     In accordance with a more limited aspect of the present invention, if the reason for access denial is an inability of the data network to handle an internet telephony call, then controlling the switch includes cranking back the call to reroute it. 
     In accordance with another aspect of the present invention, a call rejection system for use by a data network is provided. It includes a local access concentrator located at a point-of-presence for the data network. A tunnel is supported at one end by the local access concentrator and at an opposing end by a network server for the data network. A call rejection interface runs on the network server. In response to a tunnel session for which access to the data network is denied, the call rejection interface returns, via the tunnel, a call rejection message to the point-of-presence. 
     In accordance with a more limited aspect of the present invention, the local access concentrator includes a pool of voice band modems which act as a termination point for incoming analog calls. Also included is a multiplexer which multiplexes multiple incoming calls into the tunnel as separate identifiable tunnel sessions. 
     In accordance with a more limited aspect of the present invention, the data network is an internet service provider. 
     In accordance with a more limited aspect of the present invention, the tunnel employs layer two tunneling protocol. 
     In accordance with a more limited aspect of the present invention, the call rejection message identifies the tunnel session and indicates a reason for denying access. 
     In accordance with a more limited aspect of the present invention, the tunnel includes a control channel over which the call rejection message is returned. The control channel is secure from tunnel sessions. 
     In accordance with a more limited aspect of the present invention, the point-of-presence is a telephone company central office having a telecommunications switch which is connected to a public switched telephone network. 
     In accordance with a more limited aspect of the present invention, the system further includes a control processor located at the point-of-presence. The control processor receives and interprets returned call rejection messages and in response thereto controls the switch to take a course of action based on the identified tunnel session and the reason for denying access. 
     In accordance with a more limited aspect of the present invention, if the reason for denying access is suspected intrusion into the data network by an unauthorized entity, then the course of action includes employing fraud detection and nuisance reporting features of the telephone switch to discourage the unauthorized entity from attempting to access the data network and to surveil the unauthorized entity. 
     In accordance with a more limited aspect of the present invention, the fraud detection and nuisance reporting features employed are selected from a group consisting of identification of the unauthorized entity via automatic number identification; marking the unauthorized entity&#39;s telephone line; monitoring the unauthorized entity&#39;s telephone line; disconnecting the unauthorized entity&#39;s telephone service; blocking calls from the unauthorized entity; and/or reporting activities of the unauthorized entity to governmental or regulatory authorities or operators of the data network or operators of other data networks. 
     In accordance with a more limited aspect of the present invention, the system further includes a database into which the control processor loads identified phone numbers from which unauthorized entity&#39;s attempt to access the data network. 
     In accordance with a more limited aspect of the present invention, if the reason for denying access is an inability of the data network to handle an internet telephony call, then the course of action includes employing a crank back function of the switch to reroute the call. 
     In accordance with another aspect of the present invention, a data network is provided to which clients gain access via a tunnel which is capable of carrying multiple tunnel sessions simultaneously and is supported on a first end by a local access concentrator located at a point-of-presence for the data network. The data network includes a network server which supports a second end of the tunnel. Running on the network server is a call rejection interface. The call rejection interface returns, via the tunnel, a call rejection message to the point-of-presence when a tunnel session on the tunnel is denied access to the data network. 
     In accordance with a more limited aspect of the present invention, the call rejection message identifies the tunnel session which is denied access to the data network. 
     In accordance with a more limited aspect of the present invention, the call rejection message identifies a reason the tunnel session is denied access to the data network. 
     In accordance with a more limited aspect of the present invention, the call rejection interface returns the call rejection message over a control channel of the tunnel. The control channel is secure from clients&#39; tunnel sessions. 
     In accordance with another aspect of the present invention a method of handling data calls from clients to a data network is provided for when access to the data network is denied. The method includes establishing a point-of-presence for the data network. The point-of-presence serves as a termination point for data calls from clients to the data network. The data calls are then multiplexed into a tunnel as separate identifiable tunnel sessions. The tunnel is supported by the data network at an end opposite that into which the data calls are multiplexed. At the point-of-presence, a call rejection message is received when a tunnel session is denied access to the data network. The call rejection message is received over the tunnel. Ultimately, the received call rejection message is interpreted, and a telecommunications switch controlled based upon the interpretation. 
     In accordance with a more limited aspect of the present invention, the interpretation step includes identifying the tunnel session for which access is denied, and/or identifying a reason for its denial. 
     One advantage of the present invention is that it provides for identification and surveillance of suspected hackers so that appropriate action may be taken against them to deter and/or prevent unauthorized intrusion into a data network. 
     Another advantage of the present invention is that the legal framework of existing wire fraud statutes may be employed in dealing with suspected hackers. 
     Yet another advantage of the present invention is that it provides for the rerouting of internet telephony calls so that already incurred access charges are not wasted when a data network is unable to handle the call. 
     Still further advantages and benefits of the present invention will become apparent to those of ordinary skill in the art upon reading and understanding the following detailed description of the preferred embodiments. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     The invention may take form in various components and arrangements of components, and in various steps and arrangements of steps. The drawings are only for purposes of illustrating preferred embodiments and are not to be construed as limiting the invention. 
     FIG. 1 is an overall diagrammatic illustration showing a telecommunications network in which the present invention operates; 
     FIG. 2 is a block diagram showing a telephone company central office with a telecommunications switch and local access concentrator in accordance with aspects of the present invention; and, 
     FIG. 3 is a flow diagram illustrating the flow of a data call and operation of a data network employing a call rejection interface in accordance with aspects of the present invention. 
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     With reference to FIG. 1, a client  10 , such as a computer terminal or other data transmitting device, employs a modem  12  to initiate a data, internet telephony, or like call to a data network  14 . For example, the data network  14  is an internet service provider (ISP) that provides access to the internet  16 , or alternately it is another data network, perhaps operating a LAN or a WAN. The call is routed through a public switched telephone network (PSTN)  18  to a local access concentrator (LAC)  20  at a point-of-presence (POP)  22  for the data network  14 . At the POP  22 , the LAC  20  accepts the call and establishes a connection with the client  10 . Then, if one does not already exist, a tunnel  24  is set up. Otherwise, an existing tunnel is employed. Generally, a tunnel  24  will exist if at least one other client  10  is already accessing the data network  14 . 
     The tunnel  24  is supported at one end by the LAC  20  and at an opposing end by a network server (NS)  26  for the data network  14 . Preferably, the tunnel  24  employs a tunneling protocol such as, e.g., layer 2 tunneling protocol (L2TP), layer 2 forwarding (L2F), point-to-point tunneling protocol (PPTP), or the like. Regardless, the tunnel  24  is a virtual pipe between the LAC  20  and NS  26 . 
     Continuing on then, the LAC  20  establishes a session on the tunnel  24  for the client  10  and a point-to-point protocol (PPP) link is established between the client  10  and the NS  26 . Generally, asynchronous PPP access is achieved when employing the modem  12  and an analog telephone system such as a PSTN. Alternately, the client  10 , without a modem  12 , may initiate a data, internet telephony, or like call to the data network  14  and be routed via an integrated services digital network (ISDN) to the LAC  20  for synchronous PPP access. Either way, commonly, a plurality of clients  10  are accessing the data network  14  at any given time and the tunnel  24  concurrently carries multiple sessions. 
     The tunnel  24  also preferably includes a control channel which is secure from any tunnel sessions thereon. It is secure in the sense that a client  10  is not privy to or aware of communications sent over the control channel between the LAC  20  and NS  26 , i.e., the communications sent over the control channel are privileged. Typically, the control channel is assigned to tunnel session zero, and in the case where a new tunnel  24  is to be set up, it is done so via the control channel. 
     With reference to FIG.  2  and continuing reference to FIG. 1, in a preferred embodiment, the POP  22  is a telephone company (teleco) central office (CO)  28 . The CO  28  includes a telecommunication switch  30 , as is known in the art (e.g., the 5ESS® switch manufactured by Lucent Technologies), which is connected to the PSTN  18  (optionally, an ISDN or a combination of both) and routes calls to the LAC  20 . To handle analog signals or calls routed over the PSTN  18 , a pool  32  of voice band modems (VBMs) designated  1  through N are incorporated in the LAC  20 . The VBMs serve as a termination point for the analog calls. Digital signals or calls routed over an ISDN can bypass the pool  32  of VBMs via connection  32   a.    
     A multiplexer (MUX)  34  is also incorporated into the LAC  20 . Ultimately, all the calls, analog and digital, routed to the LAC  20  enter the MUX  34 . The MUX  34  multiplexes the individual calls into the tunnel  24  as separate identifiable sessions corresponding to each individual call. Preferably, the sessions are identified by a call ID imbedded in a payload header with each call ID corresponding to a separate call received by the LAC  20 . 
     Via the tunnel  24 , a call rejection interface (CRI)  36  running on the NS  26  returns to the POP  22  a call rejection message in those instances where an identified session is not to be granted access to the data network  14 . Preferably, the call rejection message is carried or returned over the tunnel&#39;s control channel. 
     An instance where the call rejection message is returned includes, e.g., wherein after running an authentication protocol (i.e., challenge handshake authentication protocol (CHAP), password authentication protocol (PAP), or the like) the call is suspected of being from a hacker or other unauthorized entity. In this case, returning the call rejection message over the control channel is particularly advantageous in so much as the hacker will not be privy to it being sent and in turn will not be able to employ any counter measures in furtherance of his intrusion nor be able to make a haste undetected retreat. 
     Additionally, where the call is an internet telephony call that the data network  14  is unable to appropriately handle due to, perhaps, congestion or routing problems, then a call rejection message is also returned. 
     A control processor  38  located at the POP  22  (e.g., the CO  28 ) receives and interprets returned call rejection messages. A call rejection message preferably identifies the denied session and the reason for denial. The control processor  38 , in response thereto, then controls the telecommunications switch  30  so that a predetermined or otherwise selected course of action is taken based on the identified tunnel session and the reason for denying access. 
     As is known in the art, telecommunication switches  30  are commonly equipped with: (1) a fraud detection and nuisance reporting application package (AP)  40  used for detecting, surveilling, and/or reporting wire fraud, telephone harassment, or the like; and (2) a crank back AP  42  used for “cranking back” or returning a call to an originating or intermediate node for the purpose of rerouting the call therefrom. These tools are called upon by the control processor  38  to achieve the desired action in response to the received call rejection message. 
     In the case of a suspected hacker or intrusion by an unauthorized entity, the fraud detection and nuisance reporting features  40  of the telecommunications switch  30  are employed to impede, discourage, and/or surveil the unauthorized entity. Ultimately, the hacker may be prosecuted under the wire fraud or harassment laws. Examples of available actions include: identification of the unauthorized entity via automatic number identification (ANI); marking the unauthorized entity&#39;s telephone line; monitoring the unauthorized entity&#39;s telephone line; disconnecting the unauthorized entity&#39;s telephone service; blocking calls from the unauthorized entity; and automatically reporting the activities of the unauthorized entity to governmental and regulatory authorities (e.g., the police, the Federal Communications Commission (FCC), or the like). Of course, the operators of the data network  14  are also optionally notified. Additionally, in a preferred embodiment, the control processor  38  builds a database  44  which stores information, e.g., phone numbers identified via ANI, on lines used by suspected hackers. This information is then made available to other operators of data networks so that they may also block calls from the associated phone number or take other precautionary actions as they see fit. 
     Moreover, after a suspected hacker has attempted to access the data network  14  and a call rejection message has been returned to the LAC  20 , the data network  14  has the option of terminating or holding the tunnel session. In a preferred embodiment, the session is held to facilitate and/or allow time for a call trace. The session is held by optionally executing a delay loop or otherwise preventing the session from timing out. 
     In the case of the data network  14  being unable to handle an internet telephony call, the crank back feature is used to return the call to a previous node so that the call can be rerouted to its ultimate destination. In this manner, the call is not simply dropped. Rather, an alternate routing is attempted which is particularly advantageous in the case where an access charge has already been incurred. 
     With reference to FIG.  3  and continuing reference to FIGS. 1 and 2, a flow diagram shows the progression of a data call placed to the data network  14  running the CRI  36  on its NS  26 . At step  100 , the client  10  initiates the data call. Next, at step  102 , the data call is routed over the PSTN  18  (or alternately an ISDN) to the data network&#39;s POP  22 , e.g., the teleco CO  28 , where it terminates at the LAC  20 . 
     At decision step  104 , it is determined if the tunnel  24  between the LAC  20  and the NS  26  of the data network  14  already exists. If the tunnel  24  does exist, at step  106 , the data call is multiplexed into the tunnel  24  as a tunnel session with its own separate and unique call identifier attached. On the other hand, if the tunnel  24  does not exist, at step  108 , the tunnel  24  is first created, and then at step  106 , the data call is multiplexed into the tunnel  24  as a tunnel session with its own separate and unique call identifier attached. 
     At the next decision step  110 , it is determined if the data call is to be accepted. If the data call is to be accepted, at step  112 , access to the data network  14  is granted. On the other hand, if the data call is not to be accepted, at step  114 , the CRI  36  returns a call rejection message over the tunnel  24 , preferably via the tunnel&#39;s control channel. 
     Next, at step  116 , the call rejection message is received and interpreted by the control processor  38  at the CO  28 . Ultimately at step  118 , in response to the call rejection message, the control processor  38  controls the telecommunications switch  30  accordingly, as detailed above. In this manner, the data network  14  is able to utilize the variety of tools accompanying the telecommunications switch  30  to more appropriately deal with rejected calls based upon the reason for their rejection and/or other information incorporated in the call rejection message. 
     The invention has been described with reference to the preferred embodiments. Obviously, modifications and alterations will occur to others upon reading and understanding the preceding detailed description. It is intended that the invention be construed as including all such modifications and alterations insofar as they come within the scope of the appended claims or the equivalents thereof.