System and method for logging communications

• US 10,305,856 B2
• Filed: 08/22/2017
• Issued: 05/28/2019
• Est. Priority Date: 10/24/2007
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Zampiello, Geoffrey
• Primary Examiner(s): Abad, Jackie Zuniga
• Application Number:
  US15/682,997
• Publication Number:
  US 20170374022A1
• Time in Patent Office: 644 Days
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/54 Presence management, e.g. monitoring or registration for receipt of user log-on information, or the connection status of the users

Abstract

A method for logging communication includes determining when a target user is active and identifying an access device and private Internet Protocol (IP) address associated with the target user when the target user is active. The method further includes causing the access device to provide traffic information associated with the target user to a logging device.

Claims

1. A system, comprising:

a memory that stores instructions;

a processor that executes the instructions to perform operations, the operations comprising;

determining when a target user is active by comparing active session information to a list, wherein the active session information is received in response to a device of the target user being authenticated, wherein the active session information comprises a quantity of packets transferred during a session associated with the active session information and a volume of data transferred during the session;

identifying an access point associated with the target user after determining when the target user is active;

replacing, after identifying the access point, a network address translation port of the access point associated with the target user with a port of the device of the target user; and

logging, after determining that the target user is active, traffic information associated with the target user.

2. The system of claim 1, wherein the operations further comprise identifying a private internet protocol address associated with the target user.

3. The system of claim 1, wherein the operations further comprise instructing the access point to provide network resources to the device.

4. The system of claim 3, wherein the operations further comprise instructing the access point to mirror network traffic associated with the target user.

5. The system of claim 1, wherein the operations further comprise including a network address translation table entry in the traffic information when the network address translation table entry matches a network traffic type associated with a private internet protocol address of the target user.

6. The system of claim 1, wherein the operations further comprise receiving the active session information each time the device of the target user is authenticated.

7. The system of claim 1, wherein the operations further comprise reconstructing a communication of the target user.

8. The system of claim 7, wherein the operations further comprise encrypting the communication of the target user.

9. The system of claim 1, wherein the operations further comprise providing a communication of the target user to a mediation device.

10. The system of claim 1, wherein the operations further comprise replacing a source address of the device with a public address of the access point.

11. The system of claim 1, wherein the operations further comprise replacing a source port of the device with the network address translation port of the access point.

12. The system of claim 1, wherein the operations further comprise providing a network resource to the device.

13. The system of claim 1, wherein the operations further comprise securing the active session information by utilizing a virtual private network.

14. A method, comprising:

determining, by utilizing instructions from a memory that are executed by a processor, when a target user is active by comparing active session information to a list, wherein the active session information is received in response to a device of the target user being authenticated, wherein the active session information comprises a quantity of packets transferred during a session associated with the active session information and a volume of data transferred during the session;

identifying an access point associated with the target user after determining when the target user is active;

replacing, after identifying the access point, a network address translation port of the access point associated with the target user with a port of the device of the target user; and

storing, if the target user is active, traffic information associated with the target user.

15. The method of claim 14, further comprising instructing the access point to provide network resources to the device.

16. The method of claim 15, further comprising instructing the access point to mirror network traffic associated with the target user.

17. The method of claim 14, further comprising encrypting a communication of the target user.

18. The method of claim 14, further comprising identifying a private internet protocol address associated with the target user.

19. The method of claim 14, further comprising receiving the active session information periodically.

20. A non-transitory computer-readable medium comprising instructions, which, when loaded and executed by a processor, cause the processor to perform operations, the operations comprising:

determining, by utilizing instructions from a memory that are executed by a processor, when a target user is active by comparing active session information to a list, wherein the active session information is received in response to a device of the target user being authenticated, wherein the active session information comprises a quantity of packets transferred during a session associated with the active session information and a volume of data transferred during the session;

identifying an access point associated with the target user after determining when the target user is active;

replacing, after identifying the access point, a network address translation port of the access point associated with the target user with a port of the device of the target user; and

logging, if the target user is active, traffic information associated with the device.