Techniques for protecting telephone users from caller ID spoofing attacks

1. Field of the Invention

The present invention relates generally to telephone communications, and more particularly but not exclusively to methods and apparatus for protecting telephone users from caller ID spoofing.

2. Description of the Background Art

Caller ID (identification) allows a telephone user to identify a caller before answering a telephone call. A caller ID corresponds to the caller's telephone number and is displayed on the called party's telephone or caller ID apparatus. This allows the called party to make an informed decision as to whether or not to answer the call. Telephone users have relied on caller ID to screen unwanted callers, such as telemarketers, fraudsters, and the like. The advent of caller ID spoofing techniques makes caller ID unreliable. In particular, voice over Internet protocol (VOIP) has allowed “spoofing”, i.e., faking, of caller ID relatively easy. With caller ID spoofing, the displayed caller ID seen by the called party is not the real telephone number of the caller. Caller ID spoofing is dangerous because callers can abuse it to impersonate banks, friends and family, credit card companies, and other trusted callers by faking the caller ID to display the trusted caller's telephone number. Worse, there are publicly available caller ID spoofing services, such as those provided by Spoofcard, PhoneGangster, Spooftel, and Telespoof.

A caller ID verifier may be employed to protect telephone users against caller ID spoofing. The caller ID verifier may be implemented in a telephony apparatus, such as a smart phone, stand alone caller ID device, or telephone network infrastructure, for example. Telephone numbers of related callers may be grouped into caller groups. The caller ID verifier may be configured to play one of several audio messages depending on the caller group of the telephone number corresponding to the caller ID of the telephone call. An audio message may include a question. The caller ID verifier may forward the telephone call to the telephone user when the caller answers the question correctly. Otherwise, the caller ID verifier may terminate the telephone call and give the telephone user the option to return the telephone call using the caller ID.

These and other features of the present invention will be readily apparent to persons of ordinary skill in the art upon reading the entirety of this disclosure, which includes the accompanying drawings and claims.

FIG. 1 schematically shows general implementation of a caller ID verifier in accordance with an embodiment of the present invention.

FIG. 2 shows a flow diagram of a method of protecting telephone users from caller ID spoofing in accordance with an embodiment of the present invention.

FIG. 3 schematically shows a smart phone with a caller ID verifier in accordance with an embodiment of the present invention.

FIG. 4 schematically shows telephone network infrastructure with a caller ID verifier in accordance with an embodiment of the present invention.

FIG. 5 schematically shows a stand alone caller ID device with a caller ID verifier in accordance with an embodiment of the present invention.

The use of the same reference label in different drawings indicates the same or like components.

In the present disclosure, numerous specific details are provided, such as examples of apparatus, components, and methods, to provide a thorough understanding of embodiments of the invention. Persons of ordinary skill in the art will recognize, however, that the invention can be practiced without one or more of the specific details. In other instances, well-known details are not shown or described to avoid obscuring aspects of the invention.

FIG. 1 schematically shows how a caller ID verifier 103 may be deployed to protect a telephone user, also referred to herein as the “called party”, from caller ID spoofing in accordance with an embodiment of the present invention. In the example of FIG. 1 , a caller 101 makes a telephone call to the telephone user having a telephone 104 . The telephone call is made over a telephone network 102 , which may comprise a computer network that includes the Internet coupled to the Public Switched Telephone Network (PSTN).

The caller ID verifier 103 may comprise software, hardware, or combination of software and hardware components for protecting the user from caller ID spoofing. For example, the caller ID verifier 103 may comprise electrical circuitry, such as programmable controllers with processor and memory. As another example, the caller ID verifier 103 may comprise computer-readable program code running in memory and executed by a processor. As will be more apparent below, the caller ID verifier 103 may be implemented in or as a telephony apparatus, such as a telephone, a stand alone device between a telephone and a subscriber line circuit, or integrated into infrastructure of the telephone network 102 .

In one embodiment, the caller ID verifier 103 is configured to receive the caller ID of an incoming telephone call and issue a challenge to the caller to verify the caller ID. The challenge may be in the form of a question included in an audio message. The audio message played to the caller may be based on the caller group the caller ID belongs to, if any. Another audio message may be played to the caller if the caller ID does not belong to any caller group. The caller ID verifier 103 may deem the caller ID spoofed or real depending on the answer given by the caller in response to the question. If the caller ID verifier 103 deems the caller ID to be real, the caller ID verifier 103 may allow the telephone call to be forwarded to the telephone 104 . Otherwise, the caller ID verifier 103 may perform a predetermined action, such as playing some other audio message then terminating the telephone call.

In one embodiment, the caller ID verifier 103 allows the user to create several caller groups. Each caller group may comprise telephone numbers of related callers belonging to the user's contact list. For example, the user may create four caller groups as follows:

a) Family Members

b) Colleagues

c) Schoolmates

d) Others

In the above example, the Family Members caller group may comprise telephone numbers of family members, the Colleagues caller group may comprise telephone numbers of co-workers, the Schoolmates caller group may comprise telephone numbers of schoolmates, the Others caller group may comprise telephone numbers of other callers. Each caller in the user's contact list may be assigned to a unique caller group, which in the above example is one of Family Members, Colleagues, Schoolmates, and Others caller groups.

Each caller group may be assigned a unique audio message to be played to a caller that purportedly belongs to that caller group. The audio message for a caller group may include a question that callers from the caller group likely know the answer to. The question preferably has a numeric answer to allow the caller to answer the question using a telephone keypad. Using the above caller group examples, the audio messages may be as follows:

a) For the Family Members caller group: “What year was I born?”

b) For the Colleagues caller group: “Which building do I work in?”

c) For the Schoolmates caller group: “What year did I graduate?”

In one embodiment, callers in the Others caller group are those the user specifically do not want to receive calls from. For example, for the Others caller group, the audio message may be “I am busy right now and will return your call later. If I need an extension number to reach you, please enter it now.”

In one embodiment, the caller ID verifier 103 deems a caller that does not belong to any of the caller groups as belonging to the Others caller group. The Others caller group is deemed as a default caller group in that embodiment. If an incoming telephone call has a caller ID that does not belong to any of the caller groups, that telephone call is treated as coming from a caller in the default caller group.

In one embodiment, the caller ID verifier 103 is configured to block telephone calls that do not have a caller ID. If a telephone call without caller ID is received, the caller ID verifier 103 may play an audio message informing the caller that the user does not accept calls from telephones without caller ID.

FIG. 2 shows a flow diagram of a method 200 of protecting telephone users from caller ID spoofing in accordance with an embodiment of the present invention. The method 200 may be performed by the caller ID verifier 103 in the example of FIG. 1 .

The method 200 begins when the caller ID verifier 103 receives an incoming telephone call from the caller 101 (step 201 ). The caller ID verifier 103 receives the caller ID of the incoming telephone call and checks it against telephone numbers in the caller groups (step 202 ). If the caller ID matches a telephone number belonging to a caller group other than the default caller group (which is the Others caller group in this example) the caller ID verifier 103 plays the audio message for that caller group (step 203 to step 204 ). The caller ID verifier 103 waits for the caller to answer the question in the audio message, and may be configured to time out and hang up to terminate the telephone call when the caller fails to enter an answer within a predetermined amount of time.

The caller ID verifier 103 checks the caller's answer to the question in the audio message (step 205 ). If the answer is correct, the caller ID verifier 103 deems the caller ID of the caller to be real (i.e., not spoofed) and forwards the call to the user by ringing the telephone 104 (step 205 to 206 ). Otherwise, when the answer is incorrect, the caller ID verifier 103 plays the default audio message to the caller 101 (step 205 to step 207 ). The caller ID verifier 103 also plays the default audio message when the caller ID matches a telephone number in the default caller group or when the caller ID does not belong to any of the caller groups recognized by the caller ID verifier 103 (step 203 to step 207 ). The default audio message may solicit an extension number of the caller, if applicable. The caller ID verifier 103 may thereafter hang up to terminate the telephone call when the answer is incorrect or the caller ID belongs to the Others caller group.

The caller ID verifier 103 may call the telephone 104 to play an audio message informing the user that a telephone call with an unverifieable caller ID was received (step 208 ). The audio message may ask the user whether or not to return the call. For example, the audio message may ask the user to use the keypad of the telephone 104 to enter “1#” to return the call or “2#” to ignore the call. The telephone 104 may include an indicator (e.g., icon, flashing light, particular dial tone sound, message on an LCD display or user interface, particular ring tone, etc.) to indicate when a call with an unverifiable caller ID was received. The method 200 ends when the user does not want to return the call (step 209 to end). If the user wants to return the call, the caller ID verifier 103 may return the call using the caller ID of the telephone call, and the extension number if applicable (step 209 to step 210 ). Because the return call is using the caller ID, the caller would reach the actual telephone represented by the caller ID. This advantageously protects the user from callers using spoofed caller ID.

The caller ID verifier 103 may be implemented a variety of ways without detracting from the merits of the present invention. For example, the caller ID verifier 103 may be implemented in a wireless smart telephone (“smart phone”) 300 as shown in FIG. 3 . In the example of FIG. 3 , the caller ID verifier 103 is implemented as computer-readable program code running in a memory 302 and executed by a processor 301 of the smart phone 300 . The smart phone 300 serves the combined functions of the caller ID verifier 103 and the telephone 104 of FIG. 1 , and performs the steps of the method 200 . As can be appreciated, the smart phone 300 may instead be a wired landline telephone, such as the new generation of telephones with processor and memory.

Instead of integrating the caller ID verifier 103 with the telephone 104 , the caller ID verifier 103 may be integrated in the infrastructure of the telephone network 102 . This is shown in FIG. 4 , where the caller ID verifier 103 is schematically shown as being in the infrastructure of the PSTN 412 . In the example of FIG. 4 , the method 200 is performed by infrastructure of the PSTN 412 . For example, the caller ID verifier 103 may be integrated with switching apparatus or other equipment of the PSTN 412 . The PSTN 412 may be coupled to the computer network 411 to receive a telephone call from the caller 101 . This is a typical scenario due to proliferation of caller ID spoofing services on the Internet. The computer network 411 and the PSTN 412 represents the telephone network 102 of FIG. 1 .

The caller ID verifier 103 may also be implemented in a stand alone caller ID device 500 . The caller ID device 500 may be placed between the telephone 104 and a subscriber line circuit 504 of the telephone network 102 . The caller ID device 500 may comprise a stand alone answering machine, caller ID displayer, or other stand alone telephony apparatus. In the example of FIG. 5 , the caller ID device 500 is plugged into a wall telephone jack 501 . The telephone 104 is plugged into the caller ID device 500 to couple to the telephone network 102 by way of the subscriber line circuit 504 . Telephone calls to the telephone 104 are received by the caller ID device 500 , which performs the steps of the method 200 to protect the telephone user from caller ID spoofing.

Methods and apparatus for protecting telephone users against caller ID spoofing have been disclosed. While specific embodiments of the present invention have been provided, it is to be understood that these embodiments are for illustration purposes and not limiting. Many additional embodiments will be apparent to persons of ordinary skill in the art reading this disclosure.