Verizon Services Corporation

Bell Atlantic Network Services, Inc.

Verizon Patent and Licensing Inc.

Harry Allen Hetz

Arthur Doskow

Kathleen Frances Jarosinski

George Robert Hasenauer

Erik George Gebhardt

Joseph Vecchioli

Robert D Farris

James L Flowers

Nick T Davis

Bradley J Frison

David George Morris

Ellen R Cericola

Systems for monitoring, storage, and analysis of information in signaling messages, communicated from originating networks to a destination network through one or more intermediate networks are described. Correlation and comparison between signaling messages of interest sent from an origination network to signaling messages received by the destination network allows for the detection of inconsistent information, e.g., information fields in a communicated message that have been altered, either intentionally or unintentionally, by an intermediate carrier. The introduction of an additional communications path over which notification messages are forwarded from signaling monitoring equipment in the origination network to signaling monitoring equipment in the destination network allows for a significant reduction in the memory storage requirements at the destination network and in the amount of processing required to match, compare, and evaluate signaling messages. In addition, the reduction in stored messages and processing time allows the monitoring system to operate in near-real time allowing for fraud detection while a call is still in progress.

Methods and apparatus for reducing data capture and storage requirements for call and transaction related message monitoring and fraud detection

A method may include receiving untrusted digital media; converting the untrusted digital media into an analog signal; converting the analog signal into trusted digital media; and storing the trusted digital media.

Removing malicious code in media

A communication network includes an SS7 Security Gatekeeper that authenticates and validates network control messages within, transiting, entering and leaving an overlying control fabric such as an SS7 network. The SS7 Security Gatekeeper incorporates several levels of checks to ensure that messages are properly authenticated, valid, and consistent with call progress and system status. In addition to message format, message content is checked to ensure that the originating node has the proper authority to send the message and to invoke the related functions. Predefined sets of templates may be used to check the messages, each set of templates being associated with respective originating point codes and/or calling party addresses. The templates may also be associated with various system states such that messages corresponding to a particular template cause a state transition along a particular edge to a next state node at which another set of templates are defined. Thus, system and call state is maintained. The monitor also includes signaling point authentication using digital signatures and timestamps. Timestamps are also used to initiate appropriate timeouts and so that old or improperly sequenced message may be ignored, corrected or otherwise processed appropriately. The SS7 Security Gatekeeper may be located at the edge of a network to be protected so that all messaging to and from the protected network most egress by way of the Gatekeeper. Alternatively, the SS7 Security Gatekeeper may be internal to the protected network and configured as a 'pseudo switch' so that ISUP messaging is routed through the Gatekeeper while actual traffic is trunked directly between the associated SSPs, bypassing the Gatekeeper.

Method of and apparatus for authenticating control messages in a signaling network

An (e.g., primary rate interface) offload device used relieve switches designed and engineered to carry short duration voice telephone calls, from servicing other types of calls (such as modem-based Internet calls), such as calls to a remote access server. Security is enhanced by isolating signaling and data communications. Such isolation may be provided by the use of separate networks, or a network with appropriate firewalls.

Offloading data traffic from facilities designed to handle voice call traffic

Method of and apparatus for mediating common channel signaling messages between networks using a pseudo-switch

A communication network includes a SSSecurity Gatekeeper that authenticates and validates network control messages within, transiting, entering and leaving an overlying control fabric such as an SSnetwork. The SSSecurity Gatekeeper incorporates several levels of checks to ensure that messages are properly authenticated, valid, and consistent with call progress and system status. In addition to message format, message content is checked to ensure that the originating node has the proper authority to send the message and to invoke the related functions. predefined sets of templates may be used to check the messages, each set of templates being associated with respective originating point codes and/or calling party addresses. The templates may also be associated with various system states such that messages corresponding to a particular template cause a state transition along a particular edge to a next state node at which another set of templates are defined. Thus, system and call state is maintained. The monitor also includes signaling point authentication using digital signatures and timestamps. Timestamps are also used to initiate appropriate timeouts and so that old or improperly sequenced message may be ignored, corrected or otherwise processed appropriately. The SSSecurity Gatekeeper may be located at the edge of a network to be protected so that all messaging to and from the protected network most egress by way of the Gatekeeper. Alternatively, the SSSecurity Gatekeeper may be internal to the protected network and configured as a 'pseudo switch' so that ISUP messaging is routed through the Gatekeeper while actual traffic is trunked directly between the associated SSPs, bypassing the Gatekeeper.

Method and apparatus for in context mediating common channel signaling messages between networks

A communication network includes a Security Gatekeeper that authenticates and validates network control messages within, transiting, entering and leaving an overlying control fabric such as an SS7 network. The Security Gatekeeper incorporates several levels of checks to ensure that messages are properly authenticated, valid, and consistent with call progress and system status. In addition to message format, message content is checked to ensure that the originating node has the proper authority to send the message and to invoke the related functions and that the message, itself, is appropriately coded. Predefined sets of templates may be used to check the messages, each set of templates being associated with respective originating point codes and/or calling party addresses. The templates may also be associated with various system states such that messages corresponding to a particular template cause a state transition along a particular edge to a next state node for which another set of templates is defined. Thus, system, call and/or transaction state are maintained. The monitor also includes signaling point authentication using digital signatures and timestamps. Timestamps are also used to initiate appropriate timeouts and so that old or improperly sequenced message may be ignored, corrected or otherwise processed appropriately. The Security Gatekeeper may be located at the edge of a network to be protected so that all messaging to and from the protected network must enter and egress by way of the Gatekeeper. Alternatively, the Security Gatekeeper may be internal to the protected network. In this configuration, ISUP traffic can be monitored by configuring the Security Gatekeeper as a 'pseudo switch' so that ISUP messaging is routed through the Gatekeeper on its way between interconnected SSPs, while actual bearer traffic is trunked directly between the associated SSPs, bypassing the Gatekeeper.

Method of and apparatus for mediating common channel signaling message between networks using control message templates

In an Advanced Intelligent Network, a central mediation point stores call processing records for controlling call routing and other call processing functions. To provide short code access to information service providers, each information service provider will operate an independent database which stores additional call processing records. When an established subscriber dials the short code, e.g. an N11 code, the mediation point identifies the information provider that the subscriber has previously selected from the subscriber's call processing record stored in the mediation point. The mediation point communicates with that service provider's database to obtain call processing information. The mediation point validates the call processing information for compatibility with network operations. The mediation point forwards validated call processing information to a node of the network to process the call in accord with the information from the provider's database. If the caller has not pre-selected one of the provider's or the caller dials one alternate short code, the network will prompt the caller for a selection, and then obtain the necessary call processing information from the database of the selected provider.

Mediated AIN control of short code access to information service providers

Mediated AIN control of short code access to information service

Equal access to the trigger functionality of the Advanced Intelligent Network (AIN) is accessible to a plurality of service providers offering independent communication services. In response to a trigger event during processing of a call, a switching office sends a query to a mediation point. In the preferred embodiment, the switching office is a telephone office, and the mediation point is an Integrated Service Control Point (ISCP) of a local exchange carrier AIN telephone network. The ISCP may access its own internal data to determine how to process the call, if the call meets certain criteria. Under other criteria, the ISCP acting as a mediator communicates with an alternate carrier's remote database via the common channel interoffice signaling (CCIS) network to obtain one or more instructions as to how to process the particular call. The ISCP validates the instructions from the remote database to insure compatibility with the switches or other equipment of the local network. If valid, the ISCP transmits the instruction to the switching office, which uses information in the instruction to process the call.

Growing community of inventors

Silver Spring, MD, United States of America

Harry Allen Hetz