Method of and apparatus for mediating common channel signaling messages between networks using a pseudo-switch
View Patent ↗A communication network includes an SS7 Security Gatekeeper that authenticates and validates network control messages within, transiting, entering and leaving an overlying control fabric such as an SS7 network. The SS7 Security Gatekeeper incorporates several levels of checks to ensure that messages are properly authenticated, valid, and consistent with call progress and system status. In addition to message format, message content is checked to ensure that the originating node has the proper authority to send the message and to invoke the related functions. Predefined sets of templates may be used to check the messages, each set of templates being associated with respective originating point codes and/or calling party addresses. The templates may also be associated with various system states such that messages corresponding to a particular template cause a state transition along a particular edge to a next state node at which another set of templates are defined. Thus, system and call state is maintained. The monitor also includes signaling point authentication using digital signatures and timestamps. Timestamps are also used to initiate appropriate timeouts and so that old or improperly sequenced message may be ignored, corrected or otherwise processed appropriately. The SS7 Security Gatekeeper may be located at the edge of a network to be protected so that all messaging to and from the protected network most egress by way of the Gatekeeper. Alternatively, the SS7 Security Gatekeeper may be internal to the protected network and configured as a “pseudo switch” so that ISUP messaging is routed through the Gatekeeper while actual traffic is trunked directly between the associated SSPs, bypassing the Gatekeeper.
1. A method of processing a call received at a protected network from a remote network, the method comprising the steps of:
receiving, at an interconnecting switch, a call to a subscriber on the protected network;
selecting a trunk connecting the interconnecting switch with a remote switch;
transmitting a first Initial Address Message (IAM) from the interconnecting switch to a gatekeeper platform;
decoding the first IAM at the gatekeeper platform;
validating the first IAM at the gatekeeper platform;
updating a call state of the trunk;
generating a second IAM containing call information included in said first IAM;
transmitting said second IAM from the gatekeeper platform to the remote switch;
validating the call at the remote switch based on the second IAM;
returning a first Address Complete Message (ACM) from the remote switch to the gatekeeper platform;
validating the first ACM;
returning a second ACM from the gatekeeper platform to the interconnecting switch; and
continuing to process subsequent ISUP messages associated with the call.
2. The method of claim 1 wherein said first IAM and said first ACM each include a destination point code designating an address of the gatekeeper platform.
3. The method of claim 1 wherein step of validating the call at the remote switch includes checking a trunk number of the trunk and dialed number information contained in said second IAM to ensure that the call is valid.
4. The method of claim 1 wherein said step of validating the first IAM at the gatekeeper platform includes checking a state of the protected network.
5. The method of claim 1 wherein said step of validating the first IAM includes steps of:
selecting call processing criteria; and
comparing information associated with said first IAM with said call processing criteria,
wherein said step of generating a second IAM is responsive to said comparing step.
6. The method of claim 5 wherein said step of selecting call processing criteria includes selection of a template.
7. The method of claim 1 wherein said step of validating the first IAM includes a step of authenticating a call origination switch identity.
8. A switched telecommunications network comprising:
an interconnecting switch;
a remote switch;
a trunk group connecting and communicating telephone calls between said switches;
a gatekeeper platform; and
a signaling network connecting said switches and said gatekeeper platform,
said interconnecting switch
(i) receiving a call to a subscriber on the network,
(ii) selecting a trunk from said trunk group, and
(iii) transmitting a first IAM to said gatekeeper platform on said signaling network,
said gatekeeper platform
(i) decoding and validating the first IAM,
(ii) updating a call state of the trunk, and
(iii) generating and transmitting to said remote switch on said signaling network a second IAM containing call information included in said first IAM,
said remote switch
(i) validating the call based on the second IAM, and
(ii) returning a first ACM from the remote switch to the gatekeeper platform.
9. The switched telecommunications network of claim 8 wherein said gatekeeper platform is responsive to said first ACM to generate and return a second ACM to the interconnecting switch, and wherein said switches and gatekeeper continue to validate and exchange ISUP message in support of call setup, call tear down, and other ISUP functions.