Patent Application
20060167871
1. Field of the Invention
The invention relates generally to access control in a communication system and, more particularly, to a method and system for blocking access to specific wide area network addresses in a communication system.
2. State of the Art
Conventional telephony services are generally provided over circuit-switch networks commonly known as Public Switched Telephone Networks (PSTN). For calls originating over the PSTN, a connection is formed between the calling party and the called party that is exclusive to all other users. When the established call is completed, the connection is opened and the corresponding lines are available for the establishment of a subsequent call through a connection and reuse of one or more lines.
Currently, there is a growing migration from communications which are based over the PSTN toward communication which are based over a connectionless network such as the Internet wide area network. Such communication over the Internet is commonly known as Internet telephony and is further commonly known as Voice-over-IP (VoIP). Internet telephony is a service provided over an IP network such as a packet switched network. Internet telephony recognizes efficiencies in transmitting packets carrying data for communication between a called and a calling party over a network without reserving or dedicating specific connections between the parties for the duration of the call. Such an approach digitizes audio signals and packetizes them into packets for transmission across the IP-based network. On the receiving end, the packets are depacketized and the data is transformed into audio for playback for the receiving party.
Since the data is carried digitally across the IP network, other information such as video data may be incorporated into Internet telephony without substantial modifications. Due to the ease of integrating audio and video data into Internet telephony, video phones are becoming more ubiquitous. Additionally, services, an example of which are interpretive sign language services for the hearing impaired, are also made available through the utilization of video phones by making the transmission of video imaged sign language expressions transmittable over an Internet telephony system.
Accordingly, significant capital investments into the development and manufacturing of improved video telephony devices has become more commonplace. As investment in equipment development and services increases, equipment manufacturers and service providers have an economical interest in encouraging selection of their equipment and services by a consumer. It is not uncommon in commercial applications for service providers to make available to customers equipment at a competitive or even subsidized rate for utilizing their services. Therefore, there is motivation for Internet telephony equipment providers to safeguard their equipment from being utilized by services that are not associated with an equipment provider. While such a motivation is specific, more general motivations exist for preventing or blocking access by an Internet device such as a videophone to undesirable, rogue or competitive services or locations on the network.
A method and system for blocking network resources is provided. In one embodiment of the present invention, a method for blocking access to specific network resources is provided. The method receives a request for a connection to a specific network resource as identified by a specific identifier. The specific identifier is compared against entries in a stored blacklist while the blacklist includes blocked network resource identifiers. When the specific identifier matches one of the entries within the blacklist, the connection to the specific network resource is denied and when the specific identifier does not match one of the entries within the blacklist, the connection to the specific network resources is allowed.
In another embodiment of the present invention, a network device is provided. The network device includes a first portion of storage configured to retain a list of entries in a stored blacklist with the blacklist including blocked network resource identifiers. The network device further includes a control process configured to receive and compare a request for a connection to a specific network resource as identified by a specific identifier. The comparison is made with the list of entries in the stored blacklist which include the blocked network resource identifiers. The control process is further configured to deny the connection to the specific network resource when the specific identifier matches one of the entries within the blacklist. The control process is further configured to allow the connection to the specific network resource when the specific identifier does not match one of the entries within the blacklist.
In a further embodiment of the present invention, a system for selectively blocking access to specific network services is provided. The system includes a network device which further includes storage configured to store entries in a stored blacklist which includes blocked network resource identifiers. The network device further includes a control process configured to receive and compare a request for a connection to a specific network resource as identified by a specific identifier. The comparison is made against the list of entries in the stored blacklist including blocked network resource identifiers. The control process is further configured to deny the connection to the specific network resource when the specific identifier matches one of the entries within the blacklist and to allow the connection to the specific network resource when the specific identifier does not match one of the entries within the blacklist. The system further includes an associated service preferably selected by the network device which is identified by a stored service number located within the network device which identifies the associated service. The system additionally includes a network for selectively addressably coupling the network device with the associated service.
In the drawings, which illustrate what is currently considered to be the best mode for carrying out the invention:
Generally, IP devices may access essentially all IP addressable network elements. However, for various reasons, there are certain applications where access to specific resources identified by an IP address would be preferably denied. By way of example, and not limitation, one exemplary IP device may be a video phone which may be deployed to a user at a full, subsidized or reduced fee in conjunction with offered services. In such an example, it would be inherently disadvantageous to allow a user to circumvent utilization of an associated service coupled to a deployed IP device when such an agreement or understanding to the contrary exists. Additionally, it may also be advantageous for the protection of users of IP devices to be protected from unethical or immoral resources identified by one or more specific IP addresses. Therefore, the various embodiments of the present invention utilize a list of current IP addresses and/or domain names uniquely identifying a particular network resource causing the IP device to be incapable of connecting or interacting with the identified or blacklisted resource or device.
By way of example, and not limitation, various embodiments of the present invention are disclosed in conjunction with a specific network resource identified herein as a video service, more specifically, the exemplary video service may be configured as a translation video service for assisting in communication with the hearing impaired. While such a specific service is illustrative, it is by no means to be interpreted as limiting of the scope of the present invention. Furthermore, the use of the terms “service” and “network resource” are not to be considered as limiting of specific services but rather also includes any network addressable device, resource, web page, or other entity uniquely selectable by an IP address or domain name or other network addressing mechanism.
To interface a user 14 with a user 11, a network 17 accommodates the coupling of an IP device 12 with a different IP device 13. In the specific service application as described herein, a hearing impaired user may be interfaced with a generally voice-based communication system through associated services 20 (e.g., interpretive services) allowing the hearing impaired user to communicate with an interpreter, namely through engaging in the act of sign language. The sign language images are then translated by the associated service 20 and when translated into voice information, are then forwarded over a voice-based communication connection to a hearing-capable user 16. One means for relaying the communicative expressions of a user 14 (e.g. a hearing impaired user) within communication system 10 incorporates an IP device 12 configured as a video phone for capturing the communicative expressions exhibited by user 14 (e.g. a hearing-impaired user) and for displaying as received, interpreted voice information originating from the user 16 (e.g. a hearing-capable user).
In the present exemplary illustration, expressions, such as sign language and/or body language, may be interpreted or translated by associated services 20. Additionally, user 16 interacts in the conventional manner with the associated service 20 through the use of a voice-based dialogue conveyed over a conventional voice phone 22. The various devices, such as IP device 12 and conventional voice phone 22 are coupled to the associated service 20 using one or more networks 17, 18. To facilitate the enhanced bandwidth needs of IP device 12, network 17 may be implemented as a high bandwidth network such as a wide area network, an example of which is the Internet. The conduit for coupling an IP device with the network 17 may further include an Internet Service Provider (ISP), the details of which are not shown herein but are known by those of ordinary skill in the art. Network 18 may be implemented according to the standards and bandwidth requirements of a conventional voice phone 22.
In accordance with one or more embodiments of the present invention, the IP device 12 may be configured to prevent access by user 14 to unauthorized or blacklisted services. In the communication system 10, a blacklist database 502 is coupled to the IP device 12 through network 17. Upon the occurrence of an event or other required condition, IP device 12 through network 17 accesses the blacklist database 502 to retrieve a blacklist 500 containing identifiers (e.g. IP addresses and/or domain names) of services or IP devices that are otherwise blocked from being accessed by the IP device 12. As illustrated, the blacklist may include an IP address, domain name, or other identifier which uniquely addresses a specific network resource such as a blacklisted service 21. On the retrieval of the blacklist 500 and evaluation of the stored blacklist 500′ within the IP device 12, access to, for example, the blacklisted service 21 would be denied. In one example, the blacklisted service 21 may be a competitive service to the associated service 20 and the incorporation of the blacklist 500′ and the evaluation thereof by IP device 12 prior to the initiation of a service request or attempted connection with a blacklisted IP device would be prohibited. It should be noted that the blacklist 500′ may contain an identifier to a blacklisted service, or blacklisted IP device, an example of which may be IP device 13 which is determined to be a device to which IP device 12 is not authorized to interact with.
A control process 30 may initiate the retrieval or update of a blacklist 500 by retrieving a blacklist IP address 504 and initiating the retrieval of the blacklist 500 located within the blacklist database 502 through network 17. Upon retrieval, IP device 12 stores a copy of the blacklist 500 as blacklist 500′ for comparison when initiating communication sessions as directed by a user. The specific flow processes related to the comparison of an input IP address or domain name with those stored within the blacklist 500′ will be further discussed below with reference to
In the exemplary associated service described herein, the control process 30 retrieves a stored service number 34 which may be associated with a specific IP address 202 or domain name 201. In another configuration, the IP address 202 or domain name 201 may identify a specific associated service which is looked-up using a protocol such as DNS or LDAP contacts a DNS or an LDAP server 200 and passes thereto a domain name or stored service number 34 and requests therefrom a corresponding IP address which is returned to IP device 12. IP device 12 thereafter initiates a call, upon the successful comparison against blacklist 500′, to associated service 20 over network 17 using, for example, the corresponding IP address 202 or the IP address returned from the LDAP server 200. Thereafter, control process 30 initiates a communication session over network 17 between IP device 12 and associated services 20.
By further example, and not limitation, the communication session between IP device 12 and associated service 20 may be more specifically initially connected to a hold server 44 within an associated service 20. Hold server 44 communicates with a VRS server 45 and when hold server 44 receives an inbound call in the form of a call request for the establishment of a communication session between IP device 12 and associated service 20, hold server 44 notifies VRS server 45 of the intention to establish a communication session between IP device 12 and a conventional phone 22. During the establishment of the communication session between IP device 12 and associated service 20, IP device 12 passes a call request including calling information to hold server 44. The call request is subsequently passed to VRS server 45 including the calling information which includes a video phone number 204, a MAC address 206, a name 208 and the captured call party number 32. The VRS server 45 includes and maintains a cue for one or more calls originating from the IP device 12 seeking to establish or maintain a communication session utilizing, for example, interpretive services as provided within the VRS client 36.
The IP device compares 616 the IP address against the blacklist 500′ if either call initiation did not utilize a domain name in the call request as determined in query 608 or if the IP device was resolved 614 from a domain name to an IP address. Therefore, either the call initiated IP address or the domain name resolved IP address is compared 616 to determine 620 if the IP address is located within the blacklist 500′. If the IP address is located within the blacklist 500′, then the IP device denies 618 completion of the call. However, if the IP address is not located within the blacklist 500′, then the IP device allows 622 completion of the call.
Although the foregoing description contains many specifics, these are not to be construed as limiting the scope of the present invention, but merely as providing certain exemplary embodiments. Similarly, other embodiments of the invention may be devised which do not depart from the spirit or scope of the present invention. The scope of the invention is, therefore, indicated and limited only by the appended claims and their legal equivalents, rather than by the foregoing description. All additions, deletions, and modifications to the invention, as disclosed herein, which fall within the meaning and scope of the claims are encompassed by the present invention.
