System and method for user-privacy-aware communication monitoring and analysis

• US 10,079,933 B2
• Filed: 05/10/2016
• Issued: 09/18/2018
• Est. Priority Date: 10/21/2012
• Status: Active Grant

• Current Assignee: Cognyte Technologies Israel Ltd. (Cognyte Software Ltd.)
• Original Assignee: Verint Systems Limited (Verint Systems Incorporated)
• Inventors: Hazzani, Gideon, Ariav, Yoav
• Primary Examiner(s): Hoffman, Brandon S
• Assistant Examiner(s): Salehi, Helai
• Application Number:
  US15/150,736
• Publication Number:
  US 20160330315A1
• Time in Patent Office: 861 Days
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content
• CPC Class Codes: H04M 2201/41 using speaker recognition
• CPC Class Codes: H04M 2242/12 Language recognition, selection or translation arrangements
• CPC Class Codes: H04M 2242/30 Determination of the location of a subscriber
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 4/025 using location based information parameters

Abstract

Methods and systems for monitoring, analyzing and acting upon voice calls in communication networks. An identification system receives monitored voice calls that are conducted in a communication network. Some of the monitored voice calls may be conducted by target individuals who are predefined as suspects. In order to maintain user privacy, the system selects and retains only voice calls that are suspected of being conducted by predefined targets. The techniques disclosed herein are particularly advantageous in scenarios where the network identifiers of the terminal used by the target are not known, or where the target uses public communication devices. In accordance with the disclosure, context-based identifiers such as speaker recognition or keyword matching are used.

Claims

1. A method, comprising:

maintaining a voice signature database including a received digital voice signature of a predefined target individual;

receiving monitored voice calls conducted in a communication network;

comparing speech content of the monitored voice calls to the received digital voice signature of the predefined target individual maintained in the voice signature database;

selecting, based on the comparison, a partial subset of the monitored voice calls that are suspected of having been conducted by the predefined target individual, the selected partial subset of the voice calls include speech content that matches the received digital voice signature of the predefined target individual;

after selecting the partial subset, encrypting the selected partial subset with an encryption key that is associated with the target individual;

storing only the encrypted partial subset of the voice calls from the received monitored voice calls in a call database;

upon showing that the voice calls in the partial subset were conducted by the target individual with a confidence level greater than a threshold, receiving a decryption key that is associated with the target individual; and

decrypting the encrypted partial subset of the voice calls retrieved from the call database using the decryption key, and providing the decrypted voice calls for analysis.

2. The method according to claim 1, wherein showing that the voice calls in the partial subset were conducted by the target individual comprises correlating the voice calls in the partial subset with the target individual using one or more additional parameters related to the calls in addition to the voice signature.

3. The method according to claim 1, wherein encrypting and decrypting the voice calls comprise applying an asymmetric encryption scheme.

4. The method according to claim 1, wherein the voice calls are conducted by communication terminals, and comprising identifying, using the decrypted voice calls, a communication terminal operated by the target individual.

5. The method according to claim 1, wherein receiving the decryption key comprises receiving a warrant for accessing the encrypted voice calls.

6. The method according to claim 1, wherein the encryption and decryption keys are managed by a first entity, and wherein receiving and retaining the voice calls are performed by a second entity.

7. The method according to claim 1, wherein the predefined target individual is a suspect individual being tracked by intelligence or law enforcement agencies.

8. The method according to claim 2, wherein the additional parameters comprise at least one parameter type selected from a group of types consisting of a location of a communication terminal conducting the calls, a language of the calls, a speaker gender, and one or more keywords found in the calls.

9. The method according to claim 3, wherein the encryption key and the decryption key respectively comprise a public key and a private key of a public-key cryptography scheme.

10. The method according to claim 6, and comprising initially receiving the encryption key but not the decryption key in the second entity from the first entity, and, only after the second entity shows that the confidence level is greater than the threshold, receiving the decryption key in the second entity from the first entity.

11. Apparatus, comprising:

a voice signature database configured to store a received digital voice signature of a predefined target individual;

an interface, which is configured to receive monitored voice calls conducted in a communication network; and

a processor, which is configured to select a partial subset of the monitored voice calls that are suspected of having been conducted by the predefined target individual, to encrypt the selected partial subset with an encryption key that is associated with the target individual and to retain only the encrypted partial subset of the voice calls, to receive a decryption key that is associated with the target individual upon showing that the voice calls in the partial subset were conducted by the target individual with a confidence level greater than a threshold, to decrypt the encrypted partial subset of the voice calls using the decryption key, and to provide the decrypted voice calls for analysis;

wherein the processor is configured to select the partial subset by choosing the voice calls whose speech content matches the received digital voice signature of the target individual.

12. The apparatus according to claim 11, wherein the processor is configured to correlate the voice calls in the partial subset with the target individual using one or more additional parameters related to the calls in addition to the voice signature.

13. The apparatus according to claim 11, wherein the processor is configured to encrypt and decrypt the voice calls by applying an asymmetric encryption scheme.

14. The apparatus according to claim 11, wherein the voice calls are conducted by communication terminals, and wherein the processor is configured identify, using the decrypted voice calls, a communication terminal operated by the target individual.

15. The apparatus according to claim 11, wherein, upon receiving the decryption key, the processor is configured to receive a warrant for accessing the encrypted voice calls.

16. The apparatus according to claim 11, wherein the encryption and decryption keys are managed by a first entity, and wherein the apparatus is operated by a second entity.

17. The apparatus according to claim 11, wherein the predefined target individual is a suspect individual.

18. The apparatus according to claim 12, wherein the additional parameters comprise at least one parameter type selected from a group of types consisting of a location of a communication terminal conducting the calls, a language of the calls, a speaker gender, and one or more keywords found in the calls.

19. The apparatus according to claim 13, wherein the encryption key and the decryption key respectively comprise a public key and a private key of a public-key cryptography scheme.

20. The apparatus according to claim 16, wherein the processor is configured to initially receive the encryption key but not the decryption key from the first entity, and, only after showing that the confidence level is greater than the threshold, to receive the decryption key from the first entity.