JP7509309B2 - Fraud prevention system, fraud prevention method, ENUM/DNS server, and program - Google Patents

Description

The present invention relates to a fraud prevention system, a fraud prevention method, an ENUM/DNS server, and a program for preventing telephone fraud.

In recent years, the number of victims of bank transfer fraud (specialized fraud) has been increasing, and in particular, "It's me" fraud, which involves calling someone by phone, accounts for nearly half of all specialized fraud methods. "It's me" fraud is a type of fraud where a perpetrator calls someone pretending to be a relative (such as a son or grandson) and tries to defraud them of money on the pretext that they "suddenly need money." The number of victims of specialized fraud, including "it's me" fraud (fictitious billing fraud, loan guarantee fraud, refund fraud, etc.), remains high, exceeding 16,000 cases in fiscal year 2019.

In light of the large number of telephone fraud cases, such as "It's me" scams, there is technology in place that plays announcements to warn the recipient of the call before they answer the phone, or that restricts calls (see, for example, non-patent document 1).

For example, as shown in Figure 10, an incoming call rejection list 101 is registered in advance in the destination device 50 located on the receiving side. The destination device 50 then compares the call information (originating number) of the signal received from the call processing server 20a with the incoming call rejection list 101, and restricts the matching calls or issues a warning using the guidance device 30a. The destination device 50 here is, for example, an IP (Internet Protocol) telephone (destination terminal 5) installed in each home or a PBX (Private Branch eXchange) (not shown), etc.

In addition, technology has been developed that records the contents of phone calls, transfers the audio files to a specialized fraud prevention server, and uses AI (Artificial Intelligence) analysis to determine whether the call is related to specialized fraud and sound an alarm to warn people (see non-patent document 2).

"Spam call filter", Tobila Systems Co., Ltd., [online], [searched on February 1, 2021], Internet <URL: https://tobilaphone.com/biz/gw/function/> "Provision of special fraud prevention services", Nippon Telegraph and Telephone Corporation, [online], NTT Holding Company News Release, November 27, 2020, [Retrieved February 1, 2021], Internet <URL: https://www.ntt.co.jp/news2020/2011/201127a.html>

However, there are problems associated with preventing telephone fraud using conventional techniques, such as the following:
When using a guidance device to call attention to a particular fraud prevention measure, as in the technology described in Non-Patent Document 1, the user of the telephone service having the destination device 50 must prepare a guidance device for special fraud prevention measures. In addition, the call rejection list 101 can be updated by the user himself or the service provider, but since it is not the latest information held by government agencies, the information may become outdated and the effectiveness of special fraud prevention measures may decrease.

In addition, the technology described in Non-Patent Document 2 requires that the contents of the call be recorded and then analyzed by AI. This means that it is necessary to talk to the malicious person committing the special fraud at least once, which is a burden for the user, and there is a problem in terms of immediacy because the call is assumed to be completed. Furthermore, there is a possibility that the first call may lead to the user being victimized.

The present invention was made in consideration of these points, and its objective is to prevent telephone fraud by performing effective fraud prevention processing before a call begins on the network side, which is closer to the calling device (originating terminal) than on the receiving side.

The fraud prevention system according to the present invention is a fraud prevention system comprising a call processing server which connects a call originating device and a destination device, and an ENUM/DNS server which is connected to the call processing server and performs processing to resolve destination information of the destination device, and which comprises an alert level determination request section which, when the call processing server receives a connection request from the originating device, transmits an alert level determination request to the ENUM/DNS server, the alert level determination request including the originating number of the originating device and the destination number of the destination device, and a fraud prevention processing section which receives from the ENUM/DNS server the alert level determination result for the connection request and executes a predetermined fraud prevention processing according to the alert level, and the ENUM/DNS server receives fraud number information in which fraud numbers indicating numbers that are subject to fraud countermeasures are registered, and The device is characterized by comprising a number information updating unit that obtains protected number information, in which protected numbers indicating the numbers of users to be protected from fraud are registered, from an external database at predetermined time intervals, and updates the fraud number information and protected number information stored in a memory unit; and an alert level determination unit that uses the calling number and destination number attached to the alert level determination request to determine whether the calling number is registered in the fraud number information or the protected number information, and whether the destination number is registered in the fraud number information or the protected number information, thereby determining the connection pattern of the connection request, and determining, depending on the determined connection pattern, the alert level at which a higher level of fraud prevention processing is evaluated as being necessary, the more likely it is that fraud will occur.

According to the present invention, when preventing telephone fraud, effective fraud prevention processing can be performed before a call begins on the network side, which is closer to the calling device (originating terminal) than on the receiving side.

1 is a diagram showing the overall configuration of a fraud victim prevention system according to this embodiment. 2 is a functional block diagram showing an example of the configuration of an ENUM/DNS server according to the embodiment; FIG. A figure showing an example of the data structure of fraud number information in this embodiment. 4 is a diagram showing an example of the data configuration of protection target number information according to the embodiment; FIG. FIG. 13 is a diagram showing an example of alert levels associated with connection patterns of call origins and call destinations. FIG. 2 is a functional block diagram showing a configuration example of a call processing server according to the present embodiment. 11 is a diagram illustrating an example of alert level countermeasure information according to the embodiment. FIG. A sequence diagram showing the processing flow of the fraud victim prevention system in this embodiment. 1 is a hardware configuration diagram showing an example of a computer that realizes the functions of an ENUM/DNS server and a call processing server according to the present embodiment. FIG. 1 is a diagram for explaining a conventional system for preventing fraud on the receiving side.

Next, we will explain the form for implementing the present invention (hereinafter referred to as the "present embodiment"). First, we will explain the outline of the present invention.

＜Overview＞
The fraud prevention system of this embodiment (see Figure 1 described below) is characterized in that it has functions for preventing telephone fraud (such as a function to restrict calls and a function to play guidance using a guidance device) on the network side rather than on the receiving side.
More specifically, in addition to information on the blacklist of numbers to be protected from fraud (hereinafter referred to as "fraud number information"), the ENUM (E.164 Number Mapping)/DNS (Domain Name System) server has information on the list of numbers of users to be protected from fraud (hereinafter referred to as "protected number information"). Conventionally, the call processing server and the ENUM/DNS server perform a process of resolving destination information and connect calls between the calling terminal and the called terminal, and this ENUM/DNS system is utilized. In the fraud prevention system according to this embodiment, the ENUM/DNS server that receives an inquiry from the call processing server determines the alert level by referring to the fraud number information and the protected number information based on both the calling number and the called number. The call processing server acquires information on the alert level determined by the ENUM/DNS server, and executes call restriction (call disconnection) and delivery of guidance by a guidance device as a fraud prevention process (predetermined fraud prevention process) that is set in advance according to the alert level.

In addition, the ENUM/DNS server obtains and updates the fraudulent number information and protected number information at predetermined time intervals (e.g., in real time or at regular intervals) using the ENUM/DNS protocol from an external database (the "number database 700" described below) of an administrative agency or the like in which the latest fraudulent number information and protected number information is stored.
As a result, the fraud prevention system of this embodiment can perform more effective fraud prevention processing than conventional technology before a call starts on the network side, which is closer to the calling device (originating terminal) rather than on the receiving side.
For more information on ENUM/DNS servers, see Non-Patent Document 3 ("TTC Standard JJ-90.31 Carrier ENUM Interconnection Common Interface" Version 4.0, August 29, 2018, Telecommunications Technology Committee, General Incorporated Association).
The fraud prevention system of the present invention, which utilizes this ENUM/DNS server, will now be described.

<Present embodiment>
FIG. 1 is a diagram showing the overall configuration of a fraud prevention system 1000 according to this embodiment.
The fraud prevention system 1000 of this embodiment is composed of a call processing server 20 that accommodates the calling device (calling terminal 4) and an ENUM/DNS server 10 connected to the call processing server 20, as shown in Figure 1.

In the fraud prevention system 1000 according to this embodiment, the ENUM/DNS server 10 includes fraud number information 110 and protected number information 120. The call processing server 20 transmits the caller number and the called number of a call for which a connection request has been received to the ENUM/DNS server 10 by utilizing an interface between the ENUM/DNS server 10 and the call processing server 20 that is already included in the call processing server 20 as a conventional technology.
The ENUM/DNS server 10 determines the alert level by determining whether the caller's number is registered in the fraud number information 110 and whether the called number is registered in the protected number information 120. In other words, the alert level is determined by determining whether the caller's number is that of a malicious person committing a special fraud or the called number is that of a person to be protected.
Furthermore, the ENUM/DNS server 10 determines the alert level by determining whether the calling number is registered in the protected number information 120 and whether the called number is registered in the fraud number information 110. In other words, the alert level is determined by determining whether the calling number is a number of a person to be protected or the called number is a number of a malicious person committing a special fraud.

In this way, in the fraud prevention system 1000, the ENUM/DNS server 10 determines the pattern of the combination of the calling number and the called number (the "connection pattern" described below) and determines the alert level for both calls from a fraud number to a protected number and calls from a protected number to a fraud number. Based on this alert level, the call processing server 20 executes fraud prevention processing (call restriction (call disconnection) and delivery of guidance) before the call starts.
The ENUM/DNS server 10 and the call processing server 20 that constitute this fraud prevention system 1000 will be described in detail below.

<ENUM/DNS Server>
FIG. 2 is a functional block diagram showing an example of the configuration of the ENUM/DNS server 10 according to this embodiment.
The ENUM/DNS server 10 has a conventional function of returning destination information (routing information) of the destination number in response to an inquiry from the call processing server 20. Furthermore, the ENUM/DNS server 10 obtains information on the caller number and the destination number from the call processing server 20. The ENUM/DNS server 10 then determines whether the caller number is registered in the fraud number information 110 or the protected number information 120, and whether the destination number is registered in the fraud number information 110 or the protected number information 120, and determines the alert level. The ENUM/DNS server 10 returns information on the determined alert level to the call processing server 20.
The ENUM/DNS server 10 comprises an input/output unit 11 , a control unit 12 , and a storage unit 13 .

The input/output unit 11 inputs and outputs information between other devices, etc. For example, the input/output unit 11 transmits and receives information between the call processing server 20 and the number database 700 (Figure 1). This input/output unit 11 is composed of a communication interface that transmits and receives information via a communication line, and an input/output interface that inputs and outputs information between an input device such as a keyboard (not shown) and an output device such as a monitor.

The storage unit 13 is configured with a hard disk, a flash memory, a RAM (Random Access Memory), or the like.
This memory unit 13 stores fraud number information 110, protected number information 120, and a connection destination information table 130.
The fraud number information 110 is information on numbers that are subject to fraud countermeasures (fraud numbers) registered as a so-called blacklist.
The protected number information 120 is information registered as a list of numbers of users who are to be protected from fraud.
The connection destination information table 130 stores connection destination information (routing information) in association with each destination number (telephone number of the destination terminal 5).
The storage unit 13 further temporarily stores programs for executing the various functional units of the control unit 12 and information necessary for the processing of the control unit 12.

The control unit 12 is responsible for all processing performed by the ENUM/DNS server 10, and is composed of a number information update unit 121, an alert level determination unit 122, and a connection destination information search unit 123.

The number information update unit 121 obtains fraud number information 110 and protected number information 120 at predetermined time intervals from a number database 700 (Figure 1) located outside the fraud victim prevention system 1000, and stores them in the memory unit 13.
The number database 700 is assumed to be an external database held by an agency that can collect the latest information on special fraud victims nationwide, for example, an administrative agency (such as the National Police Agency, the Consumer Affairs Agency, or the Ministry of Internal Affairs and Communications). The fraud number information 110 stored in the number database 700 is updated based on the latest special fraud victims. It is also assumed that the protected number information 120 is registered by users who are victims of special fraud by applying to an administrative agency, etc. In this way, information on protected numbers can be collected without relying on service providers or telecommunications carriers.

As shown in FIG. 1, the fraud number information 110 registers numbers used in special frauds (fraud numbers), such as "03-1111-1111,""0422-44-4444," and "06-3333-3333."
As shown in FIG. 1, the protected number information 120 registers the numbers of users (those to be protected) who have been registered to prevent damage from special fraud, such as "03-5555-5555,""0422-77-7777," and "06-6666-6666."

In addition, the fraud number information 110 may include the fraud number and the type of fraud, as shown in Fig. 3. In administrative agencies and the like, numbers used in specific frauds that have actually occurred are registered, and at that time the type of fraud can also be registered.
In addition, in Figure 3, for example, the fraud type "It's me fraud" is registered in correspondence with the fraud number "03-1111-1111", but if the fraud number is used for multiple types of fraud, multiple types of fraud may be registered.

In addition, the protected number information 120 may register the protected number and the type of fraud, as shown in FIG. 4. When a user applies to register a protected number, registration of the type of fraud that has occurred in the past is accepted and this information is recorded. In that case, the information on the type of fraud may be left blank. For example, if a user has not yet become a victim of a special fraud, but has registered in order to prevent becoming a victim of a special fraud in the future, the field will be left blank.

The number information update unit 121 obtains the fraudulent number information 110 and the protected number information 120 from the number database 700 (Figure 1) using the ENUM/DNS protocol. The ENUM standard shown in Non-Patent Document 3 is designed to store and synchronize data in real time using a real-time DB. The ENUM/DNS server 10 of this embodiment also adopts an information update method using the ENUM/DNS protocol, which is the most suitable example for updating the fraudulent number information 110 and the protected number information 120 from the number database 700 in real time. However, the number information update unit 121 may obtain the fraudulent number information 110 and the protected number information 120 from the number database 700 at a predetermined time interval, such as a fixed period.

Returning to FIG. 2, the alert level determination unit 122 receives an alert level determination request with the caller number and the destination number from the call processing server 20. The alert level determination unit 122 then first determines whether the caller number is registered in the fraud number information 110 or the protected number information 120. The alert level determination unit 122 also determines whether the destination number is registered in the fraud number information 110 or the protected number information 120.

The alert level determining section 122 then determines the alert level as shown in FIG. 5, depending on the connection pattern based on the determination results of the caller number and the called party number.
In this example, there are five alert levels, with the higher the number, the higher the alert level. The alert levels are used to assess whether a higher level of fraud prevention measures is required, as the likelihood of fraud occurring increases.

Connection pattern <a>
If the calling number is not registered in the fraud number information 110 and the called number is not registered in the protected number information 120, the alert level is set to "1".

Connection pattern <b>
Connection pattern <b> is a case where the caller number is not registered in the fraud number information 110 and the called number is registered in the protected number information 120, that is, a "call from a person other than a malicious person committing a special fraud to a person to be protected." This connection pattern <b> is set to an alert level of "2."

Connection pattern <c>
The connection pattern <c> is a case where the caller's number is registered in the fraud number information 110 and the called number is not registered in the protected number information 120, that is, a "call from a malicious person committing a special fraud to a person other than a protected person." This connection pattern <c> is set to an alert level of "3."

Connection pattern <d>
The connection pattern <d> is a case where the caller's number is registered in the fraud number information 110 and the called number is also registered in the protected number information 120, that is, a "call from a malicious person committing special fraud to a protected person." This connection pattern <d> is set to an alert level of "4."

Furthermore, in the case of connection pattern <d>, when a fraud type as shown in Figures 3 and 4 is registered in the fraud number information 110 and the protected number information 120, the alert level determination unit 122 may refer to the fraud type and perform a detailed alert level determination, for example, as in the following connection patterns <d-1>, <d-2>, and <d-3>. Here, the case is targeted where the fraud type of the fraud number of the calling terminal is different from the fraud type of the protected number of the receiving terminal.

Connection pattern <d-1>
In the case of a call from a malicious individual committing "it's me" scam to a protected individual who has been a victim of a fraudulent billing scam, the alert level will be set to "4-1."
Connection pattern <d-2>
In the case of a call from a malicious individual committing "it's me" fraud to a protected individual who has been the victim of a refund fraud, the alert level will be set to "4-1."
Connection pattern <d-3>
In the case of a call from a malicious person committing refund fraud to a protected person who has been a victim of "it's me" fraud, the alert level will be set to "4-2."

Note that alert level "4-1" (calls made by malicious individuals committing "it's me" fraud) and alert level "4-2" (calls made by malicious individuals committing refund fraud) are both alert levels of "4", but are given a branch number that identifies the type of fraud made by the malicious individual. Branch numbers are similarly given to calls made by malicious individuals of other types of fraud.

· Connection pattern <d-4>
In the case of a call from a malicious person committing "it's my son" fraud to a person who is being protected as a victim of "it's my son" fraud, the alert level will be set to "5".
Although not shown in the figure, calls from malicious individuals committing fictitious billing scams to those who are being protected as victims of fictitious billing, calls from malicious individuals committing refund scams to those who are being protected as victims of refund scams, etc. are also assigned an alert level of "5."
This is because when the fraud type of the fraud number of the calling terminal and the fraud type of the protected number of the called terminal are the same, this combination is highly likely to result in a special fraud victim, so the highest alert level is set. This alert level "5" means that the call is disconnected as a fraud prevention process, as shown in Figure 7 below.

In addition, the following alert levels will be set for calls originating from protected persons:
Connection pattern <e>
This is the case when the caller number is registered in the protected number information 120 and the called number is not registered in the fraud number information 110, that is, when the call is from a protected person to a person other than a malicious person committing a special fraud. This connection pattern <e> is set to an alert level of "1".

In addition, if the calling number is not registered in the protected number information 120 and the called number is not registered in the fraud number information 110, in other words, in the case of a "call from a person other than a protected person to a person other than a malicious person committing special fraud," the alert level will also be set to "1." In addition, the alert level for "calls from a protected person to a protected person" is set to "1" because the possibility of falling victim to special fraud is low. The alert level for "calls from a malicious person committing special fraud to another malicious person committing special fraud" can be set at will, but since the possibility of ordinary users falling victim to special fraud is low, the alert level may be set to "1."

Connection pattern <f>
The connection pattern <f> is a case where the caller's number is registered in the protected number information 120 and the called number is also registered in the fraud number information 110, that is, a "call from a protected person to a malicious person committing special fraud." This connection pattern <f> is set to an alert level of "5."
In addition, even if a type of fraud is registered in the fraud number information 110 and the protected number information 120, if the call is from a protected person to a malicious person committing special fraud, the alert level will be set to "5" since there is a high possibility of new victimization, regardless of the fraud type linked to the fraud number or the type of fraud victimization the protected person has suffered.

In this way, the alert level determination unit 122 determines the alert level according to the connection pattern based on the determination results of the call origination number and the call destination number. The alert level determination unit 122 then returns information on the determined alert level to the call processing server 20.

Returning to Figure 2, when the destination information search unit 123 receives an inquiry from the call processing server 20 regarding the destination information (routing information) of the destination number (the telephone number of the called terminal 5 (Figure 1)), it refers to the destination information table 130, extracts the destination information (routing information) corresponding to the destination number, and returns it to the call processing server 20.

In this way, the ENUM/DNS server 10 can obtain the latest fraudulent number information 110 and protected number information 120, and then determine the alert level based on the connection pattern of the calling number and the destination number.

<Call processing server>
FIG. 6 is a functional block diagram showing an example of the configuration of the call processing server 20 according to the present embodiment.
This call processing server 20 receives connection requests (calls) from each source device (call terminal 4) accommodated by itself. The call processing server 20 then receives the result of the alert level determination by sending an alert level determination request with the source number and destination number of the source device to the ENUM/DNS server 10. As a special fraud countermeasure according to the received alert level, the call processing server 20 restricts calls (disconnects calls) and delivers guidance by the guidance device 30 before the start of a call.
The call processing server 20 includes an input/output unit 21 , a control unit 22 , and a storage unit 23 .

The input/output unit 21 inputs and outputs information between other devices, etc. For example, the input/output unit 21 transmits and receives information between each terminal (originating device (originating terminal 4), terminating terminal 5, etc.) and the ENUM/DNS server 10, etc. This input/output unit 21 is composed of a communication interface that transmits and receives information via a communication line, and an input/output interface that inputs and outputs information between an input device such as a keyboard (not shown) and an output device such as a monitor.

The storage unit 23 is composed of a hard disk, a flash memory, a RAM, and the like.
This memory unit 23 stores alert level countermeasure information 200 (details of which will be described later) that indicates countermeasures against fraud damage corresponding to each alert level.
The storage unit 23 also temporarily stores programs for executing the various functions of the control unit 22 and information necessary for the processing of the control unit 22.

The control unit 22 is responsible for all processing performed by the call processing server 20, and is composed of an alert level determination request unit 221, a fraud prevention processing unit 222, a connection destination information request unit 223, and a call connection processing unit 224.

The alert level determination request unit 221 receives a connection request (call) from a source device (originating terminal 4) that it accommodates. The alert level determination request unit 221 then generates an alert level determination request that includes the source number and destination number of the source device (originating terminal 4) and transmits it to the ENUM/DNS server 10.

The fraud prevention processing unit 222 obtains alert level information from the ENUM/DNS server 10. The fraud prevention processing unit 222 then executes fraud prevention processing defined in the alert level countermeasure information 200 stored in the memory unit 23.

FIG. 7 is a diagram illustrating an example of alert level countermeasure information 200 according to this embodiment.
The fraud prevention processing unit 222 executes fraud prevention processing such as call restriction (disconnection of calls) and delivery of guidance by the guidance device 30 in association with each alert level.

・ Alert level "1"
Alert level "1" refers to cases where the calling number is not registered in the fraud number information 110 and the called number is not registered in the protected number information 120, or where the calling number is registered in the protected number information 120 but the called number is not registered in the fraud number information 110. In this case, the fraud prevention processing unit 222 does not perform fraud prevention countermeasure processing.
Therefore, the fraud prevention processing unit 222 outputs a message to that effect to the connection destination information request unit 223, and continues processing for normal call connection.

・ Alert level "2"
The alert level "2" applies to calls to the protected person from those other than malicious actors committing special fraud. In this case, the fraud prevention processing unit 222 delivers guidance such as "Be careful of the person you are calling" to the called terminal via the guidance device 30.

・ Alert level "3"
The alert level "3" targets "calls from malicious people committing special fraud to persons other than those to be protected." In this case, the fraud prevention processing unit 222 may deliver guidance such as "This may be a call from a special fraud group" to the destination terminal via the guidance device 30. However, since the user of the destination terminal is not registered as a person to be protected under special fraud countermeasures, it is also possible to set the system not to perform fraud prevention countermeasure processing such as delivery of guidance.

・ Alert level "4"
Alert level "4" targets "calls from malicious persons committing specialized fraud to persons to be protected." In this case, the fraud prevention processing unit 222 distributes guidance such as "This call may be from a specialized fraud group" to the destination terminal via the guidance device 30. Furthermore, the fraud prevention processing unit 222 distributes guidance such as "This call is being recorded" to the malicious person committing specialized fraud at the calling terminal via the guidance device 30.

・ Alert level: "4-1"
The alert level "4-1" targets "calls from malicious individuals committing "it's my son" fraud to victims of special fraud other than "it's my son" fraud who are to be protected. In this case, the fraud prevention processing unit 222 delivers guidance such as "This may be a call from an "it's my son" fraud group to the destination terminal via the guidance device 30. Furthermore, the fraud prevention processing unit 222 delivers guidance such as "This call is being recorded" to the malicious individual committing special fraud at the calling terminal via the guidance device 30.

・ Alert level "4-2"
The alert level "4-2" targets "calls from malicious parties committing refund fraud to victims of special fraud other than refund fraud who are to be protected." In this case, the fraud prevention processing unit 222 delivers guidance such as "This may be a call from a refund fraud group" to the destination terminal via the guidance device 30. Furthermore, the fraud prevention processing unit 222 delivers guidance such as "This call is being recorded" to the malicious parties committing special fraud at the calling terminal via the guidance device 30.
In addition, in the case where the type of fraud of the fraud number of the calling terminal is different from the type of fraud of the protected number of the called terminal, the fraud prevention processing section 222 delivers guidance to both the protected person of the called terminal and the malicious person of the special fraud of the calling terminal.

・ Alert level "5"
Alert level "5" applies to cases where the fraud type of the fraud number of the calling terminal is the same as the fraud type of the protected number of the called terminal, such as a call from a malicious person committing "it's my son" fraud to a person who is a victim of "it's my son" fraud. In this case, the fraud prevention processing unit 222 discards (disconnects) the connection request (call) and rejects the incoming call, since there is a high possibility that the caller will be a victim of a special type of fraud.
Another case of alert level "5" is a call from a protected person to a malicious person committing a specialized fraud. In this case, too, the fraud prevention processing unit 222 discards (disconnects) the connection request (call) and does not allow the call to be made, since there is a high possibility that the protected person will be a victim of a specialized fraud.

The fraud prevention measures associated with this alert level may change the fraud prevention countermeasure processing for each protected number at the request of each protected person. For example, in the case of a "call from a malicious special fraud perpetrator to a protected person" at alert level "4," rather than delivering guidance to both the protected person at the destination terminal and the malicious special fraud perpetrator at the caller terminal, the connection request (call) may be discarded (disconnected) and the call cannot be made. The content of the special fraud measures associated with the alert level may also be changed by settings of the telecommunications carrier, etc.

Returning to Figure 6, when the fraud prevention processing unit 222's fraud prevention processing is other than discarding (disconnecting the call) the connection request (call), the connection destination information request unit 223 generates a connection destination information inquiry message with the destination number and sends it to the ENUM/DNS server 10.

When the call connection processing unit 224 receives destination information (routing information) corresponding to the destination number from the ENUM/DNS server 10, it makes a call connection to the destination indicated in the destination information.

By doing this, the call processing server 20 can restrict (discard) calls and deliver guidance via the guidance device 30 before a call starts as fraud prevention measures according to the alert level received from the ENUM/DNS server 10.

<Fraud prevention system processing>
Next, the processing executed by the fraud prevention system 1000 will be described.
FIG. 8 is a sequence diagram showing the processing flow of the fraud victim prevention system 1000 according to this embodiment.

The number information update unit 121 of the ENUM/DNS server 10 obtains the latest fraudulent number information 110 and protected number information 120 from the number database 700 held by an administrative agency or the like, and stores them in the memory unit 13 (step S1).
The fraudulent number information 110 and the protected number information 120 may be updated, for example, by storing and synchronizing the information in real time using an information update method using the ENUM/DNS protocol.

Next, the call processing server 20 receives a connection request (call) from the calling terminal 4 to the called terminal 5 (step S2). This connection request (call) includes the call origination number of the calling terminal 4 as well as the called number of the called terminal 5.

Next, the alert level determination request unit 221 of the call processing server 20 generates an alert level determination request including the originating number of the calling terminal 4 and the destination number of the called terminal 5, and sends it to the ENUM/DNS server 10 (step S3).

The ENUM/DNS server 10 (alert level determination unit 122) receives an alert level determination request with the caller number and the destination number. The alert level determination unit 122 then determines whether the caller number is registered in the fraud number information 110 or the protected number information 120. The alert level determination unit 122 also determines whether the destination number is registered in the fraud number information 110 or the protected number information 120. As a result, the alert level determination unit 122 determines a connection pattern (see FIG. 5) based on the caller number and the destination number, and determines an alert level according to the connection pattern (step S4).
Then, the alert level determining unit 122 returns information on the determined alert level to the call processing server 20 (step S5).

Next, when the fraud prevention processing unit 222 of the call processing server 20 obtains the alert level information from the ENUM/DNS server 10, it executes special fraud countermeasures specified in the alert level countermeasures information 200 (see Figure 7) stored in the memory unit 23 (step S6).

In the example of the five alert levels shown in Figure 7, at alert levels "2" and "3", the fraud prevention processing unit 222 causes the guidance device 30 to execute a process of delivering guidance to the receiving terminal 5, encouraging the user to be careful about becoming a victim of fraud. At alert level "4", the fraud prevention processing unit 222 causes the guidance device 30 to execute a process of delivering guidance to the receiving terminal 5, and also causes the guidance device 30 to execute a process of delivering guidance to the calling terminal 4. The actual timing at which the guidance device 30 delivers guidance to the receiving terminal 5 and the calling terminal 4 is after the connection destination information request unit 223 receives connection destination information (routing information) corresponding to the called number and before the call is connected.
At alert level "5", the fraud prevention processing unit 222 performs call restriction processing (disconnecting the call) to cut off communication between the malicious victim of a special fraud and the person to be protected, and terminates the processing.
In addition, in the example of the alert level countermeasure information 200 shown in Figure 7, which indicates the alert level in five stages, the fraud prevention processing unit 222 does not take measures against special fraud when the alert level is "1".

Next, the destination information request unit 223 of the call processing server 20 generates a destination information inquiry message with the destination number and sends it to the ENUM/DNS server 10 (step S7: destination information inquiry), except when the alert level is "5" and call restriction processing (call disconnection) is performed.

When the destination information search unit 123 of the ENUM/DNS server 10 receives an inquiry for destination information, it refers to the destination information table 130, extracts the destination information (routing information) corresponding to the destination number, and returns it to the call processing server 20 (step S8: destination information response).

Next, when the call processing server 20 (call connection processing unit 224) receives destination information (routing information) corresponding to the destination number from the ENUM/DNS server 10, it establishes a call connection to the destination indicated in the destination information (step S9) and establishes a communication connection between the calling terminal 4 and the called terminal 5.

In this way, the fraud prevention system 1000 allows the ENUM/DNS server 10 to determine the combination pattern (connection pattern) of the call origin number and the call destination number, and to determine the alert level for both calls from a fraud number to a protected number and calls from a protected number to a fraud number. Based on this alert level, the call processing server 20 executes fraud prevention processing (call restriction (call disconnection) and delivery of guidance) before the call starts.
Therefore, according to this fraud prevention system 1000, when preventing fraud using the telephone, effective fraud prevention processing can be performed before the call starts on the network side, which is closer to the calling device (originating terminal), rather than on the receiving side.

<Hardware Configuration>
The ENUM/DNS server 10 and the call processing server 20 according to this embodiment are realized by a computer 900 having a configuration as shown in FIG.
9 is a hardware configuration diagram showing an example of a computer 900 that realizes the functions of the ENUM/DNS server 10 and the call processing server 20 according to this embodiment. The computer 900 has a CPU (Central Processing Unit) 901, a ROM (Read Only Memory) 902, a RAM 903, a HDD (Hard Disk Drive) 904, an input/output I/F (Interface) 905, a communication I/F 906, and a media I/F 907.

The CPU 901 operates based on a program stored in the ROM 902 or the HDD 904, and is controlled by the control units 12 and 22 (FIGS. 2 and 6). The ROM 902 stores a boot program executed by the CPU 901 when the computer 900 is started, programs related to the hardware of the computer 900, and the like.

The CPU 901 controls an input device 910 such as a mouse or keyboard, and an output device 911 such as a display or printer, via an input/output I/F 905. The CPU 901 acquires data from the input device 910 via the input/output I/F 905, and outputs generated data to the output device 911. Note that a GPU (Graphics Processing Unit) or the like may be used as a processor together with the CPU 901.

The HDD 904 stores programs executed by the CPU 901 and data used by the programs. The communication I/F 906 receives data from other devices via a communication network (e.g., NW (Network) 920) and outputs the data to the CPU 901, and also transmits data generated by the CPU 901 to other devices via the communication network.

The media I/F 907 reads a program or data stored in the recording medium 912 and outputs it to the CPU 901 via the RAM 903. The CPU 901 loads a program related to the target processing from the recording medium 912 onto the RAM 903 via the media I/F 907, and executes the loaded program. The recording medium 912 is an optical recording medium such as a DVD (Digital Versatile Disc) or a PD (Phase change rewritable Disc), a magneto-optical recording medium such as an MO (Magneto Optical disc), a magnetic recording medium, a semiconductor memory, etc.

For example, when computer 900 functions as ENUM/DNS server 10 and call processing server 20 of the present invention, CPU 901 of computer 900 executes a program loaded onto RAM 903 to realize the functions of ENUM/DNS server 10 and call processing server 20. Data in RAM 903 is also stored in HDD 904. CPU 901 reads and executes a program related to the target processing from recording medium 912. Additionally, CPU 901 may read a program related to the target processing from another device via a communication network (NW 920).

＜Effects＞
The effects of the fraud prevention system according to the present invention will now be described.
The fraud prevention system according to the present invention is a fraud prevention system 1000 comprising a call processing server 20 which connects a call originating device (originating terminal 4) and a destination device (terminating terminal 5), and an ENUM/DNS server 10 which is connected to the call processing server 20 and performs processing to resolve destination information of the destination device. When the call processing server 20 receives a connection request from the originating device, the call processing server 20 comprises an alert level determination request unit 221 which transmits an alert level determination request to the ENUM/DNS server 10, the alert level determination request including the originating number of the originating device and the destination number of the destination device, and a fraud prevention processing unit 222 which receives the alert level determination result regarding the connection request from the ENUM/DNS server 10 and executes a predetermined fraud prevention processing according to the alert level. The ENUM/DNS server 10 receives fraud number information 110 in which fraud numbers indicating numbers subject to fraud countermeasures are registered, and The system is characterized by comprising a number information updating unit 121 which obtains protected number information 120, in which protected numbers indicating the numbers of users to be protected from fraud, from an external database (number database 700) at predetermined time intervals and updates the fraud number information and protected number information stored in the memory unit 13, and an alert level determination unit 122 which uses the calling number and destination number attached to the alert level determination request to determine whether the calling number is registered in the fraud number information 110 or the protected number information 120, and whether the destination number is registered in the fraud number information 110 or the protected number information 120, thereby determining the connection pattern of the connection request, and determining an alert level at which a higher level of fraud prevention processing is evaluated as being necessary depending on the determined connection pattern, the higher the possibility of fraud occurring.

In this way, according to the fraud prevention system 1000, the ENUM/DNS server 10 determines a connection pattern using fraud number information 110 and protected number information 120 obtained from an external database (number database 700), decides on an alert level based on the determined connection pattern, and executes fraud prevention processing for each alert level in the call processing server 20.
Therefore, fraud prevention processing can be executed on the network side, which is closer to the calling device (originating terminal 4), rather than on the called side. Furthermore, in the fraud prevention system 1000, fraud prevention processing is executed before the call starts, so there is no burden on the user, and since the call does not have to be completed, there are no problems with immediacy. Furthermore, by determining the connection pattern, the ENUM/DNS server 10 can execute fraud prevention processing for calls from protected persons to malicious persons committing special fraud. Therefore, more effective fraud prevention processing is possible compared to conventional technology.

In addition, in the fraud prevention system 1000, the alert level determination unit 122 of the ENUM/DNS server 10 is characterized in that when the calling number is registered in the protected number information 120 and the called number is registered in the fraud number information 110, the alert level of the connection request is determined to be an alert level that will disconnect the call as a fraud prevention process.

By doing this, calls from protected persons to malicious persons committing specialized fraud, which are at high risk of becoming victims of specialized fraud, can be restricted (disconnected) before the conversation begins, preventing damage to protected persons.

In addition, in the fraud victim prevention system 1000, the fraud number information 110 registers a fraud type indicating the type of special fraud in association with the fraud number, and the protected number information 120 registers a fraud type in association with the protected number, and the alert level determination unit 122 of the ENUM/DNS server 10 is characterized in that when the calling number is registered in the fraud number information 110 and the destination number is registered in the protected number information 120, and the fraud type assigned to the fraud number matches the fraud type assigned to the protected number, the alert level determination unit 122 of the ENUM/DNS server 10 determines the alert level of the connection request to an alert level that will disconnect the call as a fraud victim prevention process.

In this way, in the fraud number information 110, the fraud type related to the special fraud is registered in association with the fraud number, and in the protected number information 120, the fraud type of the special fraud of which the protected person has fallen victim is registered. This allows the alert level determination unit 122 of the ENUM/DNS server 10 to disconnect the connection request when the fraud type of the fraud number, which is the calling number, matches the fraud type of the protected number, which is the destination number. Therefore, for example, calls of combinations of the same type of special fraud (e.g., "it's my son" fraud) and which are likely to result in victimization, such as "a call from a malicious person committing "it's my son" fraud to a victim of "it's my son" fraud, can be restricted (disconnected), thereby preventing victimization in advance.

In addition, in the fraud victim prevention system 1000, the number information update unit 121 of the ENUM/DNS server 10 is characterized in that it obtains fraud number information 110 and protected number information 120 in real time between the external database (number database 700) using the ENUM/DNS protocol, and updates the fraud number information 110 and protected number information 120 stored in the memory unit 13.

In this way, the ENUM/DNS server 10 can obtain fraudulent number information 110 and protected number information 120 in real time between the external database (number database 700) using the ENUM/DNS protocol. This makes it possible to more effectively prevent fraud damage using the latest information.

In addition, in the fraud prevention system 1000, the call processing server 20 is equipped with a guidance device 30, and the fraud prevention processing unit 222 of the call processing server 20 is characterized in that, as a specified fraud prevention process, it executes at least one of the following: delivering guidance for preventing fraud from the guidance device 30 to the destination device, delivering guidance for preventing fraud from the guidance device 30 to the originating device, and disconnecting a connection request call.

This allows the call processing server 20 to distribute guidance from the guidance device 30 installed on the network side to the destination device (called terminal 5) and the originating device (originating terminal 4), and to disconnect the connection request call. The call processing server 20 prevents damage by distributing guidance to the destination device, for example, to warn about special fraud. The call processing server 20 also distributes guidance to the originating device, for example, to record the call, encouraging malicious perpetrators of special fraud to voluntarily disconnect the call, reducing the circulation of malicious calls on the network and preventing damage.

The ENUM/DNS server according to the present invention is an ENUM/DNS server 10 connected to a call processing server 20, and the ENUM/DNS server 10 is connected to an external database that stores fraud number information 110 in which fraud numbers indicating numbers that are the subject of fraud countermeasures are registered, and protected number information 120 in which protected numbers indicating the numbers of users to be protected from fraud are registered, and obtains the fraud number information 110 and the protected number information 120 from the external database at predetermined time intervals, and updates the fraud number information 110 and the protected number information 120 stored in the memory unit 13. The system is characterized by comprising an information update unit 121, and an alert level determination unit 122 which receives an alert level determination request accompanied by an originating number and a destination number from the call processing server 20 which has accepted the connection request, and determines whether the originating number is registered in the fraud number information 110 or the protected number information 120 and whether the destination number is registered in the fraud number information 110 or the protected number information 120 to determine the connection pattern of the connection request, and determines, depending on the determined connection pattern, an alert level that evaluates that a higher level of fraud prevention processing is required, the higher the possibility of fraud occurring.

In this way, the ENUM/DNS server 10 determines the connection pattern using the fraud number information 110 and the protected number information 120 obtained from the external database (number database 700), and determines the alert level according to the determined connection pattern. Therefore, by transmitting this alert level information to the call processing server 20, the call processing server 20 can execute fraud prevention processing according to the alert level.
Therefore, fraud prevention processing can be executed on the network side, which is closer to the calling device (originating terminal 4), rather than on the called side. Also, since ENUM/DNS server 10 causes call processing server 20 to execute fraud prevention processing before the call starts, there is no burden on the user, and since the call does not have to be completed, there are no problems with immediacy. Also, by determining the connection pattern, ENUM/DNS server 10 can execute fraud prevention processing for calls from protected persons to malicious persons committing special fraud. Therefore, more effective fraud prevention processing is possible compared to conventional technology.

The present invention is not limited to the embodiments described above, and many modifications are possible within the technical concept of the present invention by a person having ordinary skill in the art.

4 Calling terminal 5 Calling terminal 10 ENUM/DNS server 11, 21 Input/output unit 12, 22 Control unit 13, 23 Memory unit 20 Call processing server 30 Guidance device 110 Fraud number information 120 Protected number information 121 Number information update unit 122 Alert level determination unit 123 Connection destination information search unit 130 Connection destination information table 200 Alert level countermeasure information 221 Alert level determination request unit 222 Fraud prevention processing unit 223 Connection destination information request unit 224 Call connection processing unit 700 Number database (external database)
1000 Fraud Prevention System

Claims (8)

A fraud prevention system comprising a call processing server that connects a call source device and a destination device, and an ENUM/DNS server that is connected to the call processing server and performs a process of resolving destination information of the destination device,
The call processing server includes:
an alert level determination request unit that, upon receiving a connection request from the source device, transmits an alert level determination request including a source number of the source device and a destination number of the destination device to the ENUM/DNS server;
a fraud prevention processing unit that receives a result of a warning level determination regarding the connection request from the ENUM/DNS server and executes a predetermined fraud prevention process according to the warning level,
The ENUM/DNS server
a number information update unit that acquires, at predetermined time intervals from an external database, fraud number information in which fraud numbers indicating numbers that are the subject of fraud countermeasures are registered, and protected number information in which protected numbers indicating numbers of users that are the subject of protection from fraud are registered, and updates the fraud number information and the protected number information stored in the storage unit;
an alert level determination unit which uses the caller number and the called number attached to the alert level determination request to determine whether the caller number is registered in the fraud number information or the protected number information and whether the called number is registered in the fraud number information or the protected number information, thereby determining a connection pattern of the connection request, and determines an alert level at which a higher level of the fraud prevention processing is required according to the determined connection pattern, the higher the possibility of fraud occurring;
A fraud prevention system comprising: The fraud prevention system described in claim 1, characterized in that the alert level determination unit of the ENUM/DNS server determines the alert level of the connection request to an alert level that will disconnect the call as the fraud prevention processing when the calling number is registered in the protected number information and the destination number is registered in the fraud number information. The fraud number information includes a fraud type indicating a type of special fraud in association with the fraud number, and the protected number information includes a fraud type in association with the protected number,
The fraud prevention system described in claim 1, characterized in that when the calling number is registered in the fraud number information and the destination number is registered in the protected number information, and the fraud type assigned to the fraud number matches the fraud type assigned to the protected number, the alert level determination unit of the ENUM/DNS server determines the alert level of the connection request to an alert level that will disconnect the call as the fraud prevention processing. The fraud prevention system described in any one of claims 1 to 3, characterized in that the number information update unit of the ENUM/DNS server obtains the fraud number information and the protected number information in real time between the external database using the ENUM/DNS protocol, and updates the fraud number information and the protected number information stored in the memory unit. The call processing server includes a guidance device,
The fraud prevention system described in any one of claims 1 to 4, characterized in that the fraud prevention processing unit of the call processing server executes at least one of the following as the specified fraud prevention processing: delivering guidance for preventing fraud from the guidance device to the destination device, delivering guidance for preventing fraud from the guidance device to the originating device, and disconnecting the connection request. A fraud prevention method for a fraud prevention system including a call processing server that connects a call source device and a destination device, and an ENUM/DNS server that is connected to the call processing server and performs a process of resolving destination information of the destination device, comprising:
The call processing server includes:
a step of transmitting an alert level determination request including a source number of the source device and a destination number of the destination device to the ENUM/DNS server when a connection request is received from the source device;
receiving from the ENUM/DNS server a result of a determination of an alert level regarding the connection request, and performing a predetermined fraud prevention process according to the alert level;
The ENUM/DNS server
A step of acquiring fraud number information in which fraud numbers indicating numbers that are subject to fraud countermeasures are registered, and protected number information in which protected numbers indicating numbers of users that are subject to protection from fraud are registered from an external database at predetermined time intervals, and updating the fraud number information and the protected number information stored in a memory unit;
A fraud prevention method comprising the steps of: determining a connection pattern of the connection request by using the calling number and the destination number attached to the alert level determination request to determine whether the calling number is registered in the fraud number information or the protected number information, and whether the destination number is registered in the fraud number information or the protected number information, and determining, depending on the determined connection pattern, an alert level that evaluates that a higher level of fraud prevention processing is required, the higher the possibility of fraud occurring. an ENUM/DNS server connected to the call processing server,
The ENUM/DNS server
The device is connected to an external database that stores fraud number information in which fraud numbers indicating numbers that are subject to fraud countermeasures are registered, and protected number information in which protected numbers indicating numbers of users that are subject to protection from fraud are registered,
a number information update unit that acquires the fraud number information and the protection target number information from the external database at a predetermined time interval and updates the fraud number information and the protection target number information stored in the storage unit;
an alert level determination unit that receives an alert level determination request, which includes a caller number and a destination number, from the call processing server that has accepted the connection request, and determines whether the caller number is registered in the fraud number information or the protected number information and whether the destination number is registered in the fraud number information or the protected number information, thereby determining the connection pattern of the connection request, and determines an alert level that evaluates that a higher level of fraud prevention processing is required depending on the determined connection pattern, the higher the possibility of fraud occurring;
An ENUM/DNS server comprising: A program for causing a computer to function as an ENUM/DNS server as described in claim 7.

Images