Straight from the Bellyard:  Coin Services Update


                             By: Brian Oblivion


                   -=Restricted  -=Data  -=Transmissions

                 "Truth is cheap... but information costs."



        Public Telephones, we all know them, and how vulnerable they are
        to fradulent abuse.  Well, so does Bellcore and New England
        Telephone and they have come up with a few methods of how to combat
        fraudulent users.

        Coin deposited by a typical patron of the public telephone are
        communicated to the Stored Program Control System (SPCS) or Operator
        Services System (OSS) by bursts of certian dual-tone signals.  These
        signals consist of the two frequencies 1.7 KHz and 2.2 KHz simul-
        taneously, which are detected in end-office and tandem-office environ-
        ments to provide accurate coin deposit detection.

        There are two types of interference that are encountered by outside
        origin.  These are talkdown and talkoff.  Talkdown is the failure to
        recognize a valid dual-tone signal because of interference from
        superimposed speech or other noise that may be from either the
        originating coin line or the terminating end.  Takeoff is the false
        acceptance of speech, music, or background noises as valid coin
        deposits.  This obviously includes redbox tones, whistles, tape
        reproductions, etc.

        In order to combat this erroneous acceptance of false credit the
        following methods have been defined and are to be employed.

        Frequency Limits:

                The detector must accept dual-tone signals if the frequencies
                of both tones are within +/- 5% of their respective nominal
                values of 1.7 KHz and 2.2 KHz.  The detector must also reject
                dual-tone signals if the frequency of either or both tones is
                offset more than +/- 3.5% from its nominal value.

        Frequency offsets of +/- 1.5 percent are the extremes expected from
        properly designed and maintained coin telephones.  The +/- 3.5 percent
        constraint is imposed to minimize the width of the stop-band notch
        filters in anti-fraud notch filters.


        Signal Power and Twist:

                The detector must accept dual-tone signals if the individual
                power levels of both tones are within 0 to -25 dBm0 and within
                5 dB of each other.  (Twist is the dB difference between
                power levels of the two tones of a dual-tone signal)

                The detector must reject dual-tone signals if the individual
                poser level of either or both tones is below -30 dBm0.

        The range 0 to -25 dBm0 is the maximum expected from properly designed
        and maintained coin telephones and loops.  The -30 dBm0 limit is
        imposed to minimize the depth of the stop-band needed in anti-fraud
        notch filters.


        Pulse Timing

        Nickels, dimes, and quaters are represented by one, two, and five
        dual-tone TONE-ON pulses.  The dollar signal is represented by a
        single long pulse.  Each pulse is followed by a TONE-OFF interval.
        The following chart shows the timing specifics for all coin generated
        tones.

 +----------------------------------------------------------------------------+
 |                                     |Within-Coin |End-of-coin Tone OFF (ms)|
 |---------------------+-------------+-------------+-------+------+-----------|
 |                     | TONE-ON (ms)| TONE-OFF(ms)|  Must | Must |Allowed to |
 |                     | Must Accept | Must Accept | Accept|Reject|Acc. or Rej|
 |---------------------+-------------+-------------+-------+------+-----------|
 | Nickel  | 1 Pulse   |   35 - 160  |    ----     | >175  | <160 | 160 - 170 |
 |---------+-----------+-------------+-------------+-------+------+-----------|
 | Dime    | 1st Pulse |   35 - 160  |   25 - 110  |       |      |           |
 |---------+-----------+-------------+-------------+-------+------+-----------|
 | Dime    | 2nd Pulse |   35 - 160  |    ----     | > 75  | < 60 |  60 - 75  |
 |---------+-----------+-------------+-------------+-------+------+-----------|
 | Quater  | 1st Pulse |   20 - 100  |   20 - 110  |       |      |           |
 |---------+-----------+-------------+-------------+-------+------+-----------|
 | Quater  | 2nd Pulse |   20 - 60   |   20 - 60   |       |      |           |
 |---------+-----------+-------------+-------------+-------+------+-----------|
 | Quater  | 3rd Pulse |   20 - 60   |   20 - 60   |       |      |           |
 |---------+-----------+-------------+-------------+-------+------+-----------|
 | Quater  | 4th Pulse |   20 - 60   |   20 - 60   |       |      |           |
 |---------+-----------+-------------+-------------+-------+------+-----------|
 | Quater  | 5th Pulse |   20 - 100  |    ----     | > 75  | < 60 |  60 - 75  |
 |---------+-----------+-------------+-------------+-------+------+-----------|
 | Dollar  | 1 Pulse   |  600 - 700  |    ----     | > 75  | < 60 |  60 - 75  |
 |---------+-----------+-------------+-------------+-------+------+-----------|
 | Note:  The detector is allowed to accept or reject tone-on and within-coin |
 |        tone-off durations outsie their repective must-accept ranges.       |
 +----------------------------------------------------------------------------+

    Methods of controlling talkdown and talkoff.

        Talkdown, is more of a transmission error problem that is generated
        by interference from superimposed speech or ambient noise.  This
        noise comes from the originating coin line or from the terminating
        end.  Talkdown results in the failure of the detector to recognize
        a valid dual-tone signal.

        One of the main sources of talkdown is the improper muting of the voice
        path during tone generation.  This antenuated speech or ambient noise
        power is superimposed on the coin signals which corrupts the signal.

        Muting is accomplished by shorting out the speech path with a cap-
        acitor.  Minimum muting attenuation is 15 dB at 300 Hz, 25 dB at
        1000 Hz, and 35 dB at 3000 Hz.  The attenuated speech or ambient
        noise power is superimposed on the coin signals which could cause
        talkdown.

        Some talkdowm is also generated from the called party, operator
        speech, or automated announcements.  These signals can only reach
        the detector by reflection through the transhybrid path at a 3-to-4
        wire junction, which is usually located in the originating end
        office.


     Talkoff

        Talkoff is the false acceptance of speech, music or background
        noises as valid coin deposit signals by a detector.  This is
        what registers a valid deposit when no actual money is deposited.

        In order to combat, a few countermeasures are to be employed.

      o The call must be terminated or routed to an operator if the
        total amount due for an initial deposit or a subsequent deposit
        has been received within an overall session timeout period.

      o The overall session timeout must be an adjustable parameter with
        a default value of 45 to 50 seconds.

      Intentional talkoff can be induced by playing loud music into the
      coin telephone by doing this one hopes to get the detectors to produce
      too many talkoff clusters.  A talkoff cluster is a group of talkoffs
      occurring within any 5-minute interval.  Single quater or dollar
      talkoffs are also included in this definition of a cluster.  In order
      to combat this the following measures are being taken.

      o Total talkoffs must not exceed 12 dollars in 70 hours of continous
        speech or music at a volume leve of 0 vu referred to 0 TLP or,
        instead, at an active speech level of +1 dBm0.

      o The detector must not produce more than 12 talkoff clusters that
        exceed 20, or 40, or 95 cents in 70 hours of continuous speech or
        music at a volume level of 0vu referred to 0 TLP or, instead, at
        an active speech level of +1 dBm0.

      o Total talkoffs must not exceed 2 dollars in 200 hours of continuous
        speech or music at -17 vu referred to 0 TLP or, instead, at an active
        speech level of -16 dBm0.


        Coin-Operated Telephone Fraud

        Fraud is possible by acoustically coupling accurate coin deposit
        signals into the mouthpiece of the originating coin telephone, or
        from the called party end.  Fraudulent signals comming from the
        coin telephone end can only be stopped within the coin telephone
        with a notch filter to filter out any external fraudulent signals.

        In order to combat Fraudulent usage the following will be enacted.

      o End- or tandem-office switching systems will be equipped with
        detectors that monitor signals from the originating coin line.

        The following methods combat far-end fraud:

      o Sensing the direction of received coin signals and only reg-
        istering those comming from the coin line.

      o Increasing the transhybrid path loss (using echo cancelers to
        knock down the fraudulent signals signal strength to that under
        the detector's recognition threshold.)

      o Inserting a 2200-Hz notch filter in the voice transmission path
        from the far end only when the detector is expecting coin deposits.
        The filters 3 dB bandwidth must be less than 600 Hz centered on
        2200 Hz. and the out-of-band attenuation below 1500 Hz and above
        3000 Hz must be less than 1 dB.


        The BOC's are now taking action against 'Redboxing' as well as
        agains some of their own equipment defects.  It was only a matter
        of time, of course.  I have no idea how long this conversion will
        take nor if it has yet started.  There has been some indication
        as some start of a anti-fraud campaign in my local area.  I have
        gotten word from some people that coin operated telephones have
        not been accepting tones.  I am unaware if these machines were
        BOC operated or if they were COCOTS.  I believe them to be BOC
        coin operated telephones.  Use it while it lasts. ;)


        Brian Oblivion
        @ Black Crawling Systems
        @ atdt.org


        The following has been a presentation of...

                        Restricted Data Transmissions

                                -=R -=D -=T

                  "Truth is cheap... but information costs"