Authenticating voice calls from mobile devices
Aspects relate to authorizing mobile devices for PBX-based voice services. A mobile device calls a PBX over a voice channel, and phone number identifier information is obtained and matched to identifier information for devices that known (authorizeable) to use the PBX. If there is one incoming call that matches to a given device, and an authentication token provided over a data channel matches an authentication token associated with that device, then the device is authorized for voice services. Where there are multiple matching calls, those devices are instructed to provide authentication tokens over their voice channels. The devices can detect absence of a data channel and provide authentication tokens over the voice channels; the devices also can wait to receive a call connected response and in the absence of such provide their authentication tokens over the voice channel. Tokens can be requested and downloaded for storage at the devices.
1. A method of providing voice services, comprising:
accepting an incoming voice call, to establish a voice channel for the incoming voice call, and to provide a service over the established voice channel;
obtaining call-identifying information from the voice channel for the accepted voice call;
matching at least a portion of the call-identifying information to stored identification information for an authorizable device;
responsive to receiving an indication, determined to be from the authorizable device, that it initiated the incoming voice call, providing the voice service over the voice channel;
accepting a plurality of incoming voice calls;
attempting to obtain call-identifying information for each accepted voice call;
if any of the accepted voice calls had (1) call-identifying information that matched to the stored identification information for the authorizable device, (2) failed to match any stored identification information, or (3) for which no call-identifying information was obtained, then
maintaining each of those incoming calls in a parked state,
requesting, over data channels of devices initiating those calls, that each device send an authentication token over its voice channel,
for each authentication token received, determining whether such authentication token matches an authentication token previously provided to the authorizable device, and
providing the service over the voice channel from which the matching authentication token was received.
2. The method of claim 1 , wherein the receiving of the indication comprises receiving an authentication token over the voice channel, and further comprising determining that the authentication token is valid prior to providing the voice service.
3. The method of claim 2 , wherein the authentication token is received over the voice channel, in absence of a currently-operable data channel.
4. The method of claim 2 , wherein the authentication token is received over the voice channel, responsive to failing to uniquely identify a single incoming voice call for which call-identifying information matches stored identification information for the authorizable device.
5. The method of claim 1 , wherein the receiving of the indication comprises securely receiving a message over a data channel to the authorizable device.
6. The method of claim 1 , further comprising denying the voice service if there multiple voice channels presented the matching authentication token.
7. The method of claim 6 , wherein if there the call-identifying information failed to match stored identification information, and another voice call was accepted, for which call-identifying information was obtained, and was matched to stored identifying information, requesting that each matched device provide an authentication token over their voice channels.
8. A method for implementation on a mobile communication device, comprising:
placing an outgoing voice call over a voice channel to a remote entity;
after detecting that the voice call was answered, providing a message over a data channel established with that remote entity, the message indicating to the remote entity that the mobile communication device placed the voice call over the voice channel;
accepting a plurality of incoming voice calls;
attempting to obtain call-identifying information for each accepted voice call;
if any of the accepted voice calls had (1) call-identifying information that matched to the stored identification information for the authorizable device, (2) failed to match any stored identification information, or (3) for which no call-identifying information was obtained, then
maintaining each of those incoming calls in a parked state,
requesting, over data channels of devices initiating those calls, that each device send an authentication token over its voice channel,
for each authentication token received, determining whether such authentication token matches an authentication token previously provided to the authorizable device, and
providing the service over the voice channel from which the matching authentication token was received.
9. A mobile communications device, comprising:
a data network interface;
a voice network interface;
a processing module coupled with the voice network interface and with the data network interface, operable to
initiate a voice call, over the voice network interface, and
send a call connected message, over the data network interface, after the call has been answered;
accept a plurality of incoming voice calls;
attempt to obtain call-identifying information for each accepted voice call;
if any of the accepted voice calls had (1) call-identifying information that matched to the stored identification information for the authorizable device, (2) failed to match any stored identification information, or (3) for which no call-identifying information was obtained, then
maintain each of those incoming calls in a parked state,
request, over data channels of devices initiating those calls, that each device send an authentication token over its voice channel,
for each authentication token received, determine whether such authentication token matches an authentication token previously provided to the authorizable device, and
provide the service over the voice channel from which the matching authentication token was received.
10. The mobile communications device of claim 9 , wherein the processing module is further operable to receive, over the data network interface, a command to initiate the voice call and responsively to initiate the voice call.
11. The mobile communications device of claim 9 , wherein the command is accompanied by an authentication token, and the processing module is further operable to present the authentication token as a series of audible tones, over the voice network interface, responsive to determining that a call complete message has not been received within a time period.
12. The mobile communications device of claim 9 , wherein the processing module is further operable to cause an authentication token to be presented as a series of audible tones, over the voice network interface, responsive to receiving a command, over the data network interface.
13. The mobile communications device of claim 9 , wherein the processing module is further operable to receive, from a user interface, an indication to initiate the voice call.
14. The mobile communications device of claim 9 , wherein the processing module is further operable to request the authentication token, over the data network interface, from a server for initiating the voice call.
15. The mobile communications device of claim 9 , wherein the processing module is further operable to wait to receive a response indicating voice call acceptance, after provision of the call connected message with the authentication token, and if the response indicating voice call acceptance is not received within a period of time, then the processing module is further operable to provide the authentication token as audible tones on the voice call.
16. A system for selectively granting access to voice services by mobile devices, comprising:
a data network interface;
a voice call receiver coupled with a voice grade network; and
one or more processing modules for;
accepting a plurality of incoming voice calls;
attempting to obtain call-identifying information for each accepted voice call;
if any of the accepted voice calls had (1) call-identifying information that matched to the stored identification information for the authorizable device, (2) failed to match any stored identification information, or (3) for which no call-identifying information was obtained, then
maintaining each of those incoming calls in a parked state,
requesting, over data channels of devices initiating those calls, that each device send an authentication token over its voice channel,
for each authentication token received, determining whether such authentication token matches an authentication token previously provided to the authorizable device, and
providing the service over the voice channel from which the matching authentication token was received.
17. The system of claim 16 , wherein the one or more processing modules are further configured to send a connection complete message upon authorization of access.
18. A method of authorizing mobile devices to receive voice services, comprising:
communicating with mobile devices over data channels that also authenticate each mobile device to a provider of voice services;
accepting incoming voice calls at a server of the voice services provider,
concurrently with the communication over the secure data channels, wherein the incoming voice calls may originate from any of the mobile devices or from other devices;
collecting calling-party identifiers from the incoming voice calls;
if any of the accepted incoming voice calls had (1) calling-party identifiers that matched to stored identification information for the respective authorized device or (2) failed to match any stored identification information, then
maintaining each of those incoming calls in a parked state,
requesting, over data channels of devices initiating those calls, that each calling device send an authentication token over its voice channel,
for each authentication token received, determining whether such authentication token matches an authentication token previously provided to the calling device, and
providing the service over the voice channel from which the matching authentication token was received.
19. The method of claim 18 , further comprising denying the voice service if there were multiple voice channels presented the matching authentication token.