METHOD AND APPARATUS FOR LAWFUL INTERCEPTION OF WEB BASED MESSAGING COMMUNICATION

• US 20080148397A1
• Filed: 10/26/2006
• Published: 06/19/2008
• Est. Priority Date: 10/26/2006
• Status: Active Grant

• Current Assignee: Cyberbit Ltd.
• Original Assignee: Nice Systems Limited (Nice Ltd)
• Inventors: LITVIN, Daphna, WEINBERG, Adam
• Granted Patent: US 7,631,046 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications

Abstract

A method and apparatus for web based mail lawful interception. The method and apparatus enable the detection and automatic analysis of web based mail interactions out of all intercepted web pages. The method and apparatus use and possibly generate scripts for identifying a web page as comprising a web mail message, and scripts for analyzing the web mail messages.

Claims

1. A method for the interception and analysis of an at least one web based messaging communication, the method comprising the steps of:

receiving an at least one detection scheme for detecting whether an at least one HTTP content item represents a web based messaging communication; and

receiving an at least one analysis scheme for analyzing an at least one web based messaging communication.

2. The method of claim 1 wherein the at least one HTTP content item is a web page.

3. The method of claim 1 wherein the at least one HTTP content item is an uploaded parameter.

4. The method of claim 1 wherein the at least one web based messaging communication is a saved draft.

5. The method of claim 1 wherein the at least one web based messaging communication is a retrieved draft.

6. The method of claim 1 wherein the at least one web based messaging communication is sent.

7. The method of claim 1 wherein the at least one web based messaging communication is received.

8. The method of claim 1 further comprising a step of generating the at least one detection scheme.

9. The method of claim 1 further comprising a step of generating the at least one analysis scheme.

10. The method of claim 1 wherein the at least one detection scheme is a detection script.

11. The method of claim 1 wherein the at least one detection scheme is a detection configuration file.

12. The method of claim 1 wherein the at least one analysis scheme is an analysis script.

13. The method of claim 1 wherein the at least one analysis scheme is an analysis configuration file.

14. The method of claim 1 wherein the at least one detection scheme comprises an at least one rule for identifying an address as associated with the at least one web based messaging communication.

15. The method of claim 14 wherein the address is a Uniform Resource Locator.

16. The method of claim 14 wherein the address is a host name.

17. The method claim 14 wherein the address is an IP address.

18. The method of claim 1 wherein the at least one analysis scheme contains an association of an at least one part of an at least one HTTP message representing a web based messaging communication with an at least one string.

19. The method of claim 18 wherein the at least one part of the at least one HTTP message relates to one or more of the group consisting of:

a “

TO”

field, a “

FROM”

field, a “

SUBJECT”

field, a “

CC”

field, a “

BCC”

field, a “

NICKNAME”

field, a “

USERID”

field, a “

ATTACHMENT”

field, or a “

BUDDIES”

field.

20. The method of claim 1 further comprising the step of intercepting an at least one part of an at least one web based messaging communication.

21. The method of claim 1 further comprising the step of detecting according to the at least one detection scheme whether an at least one web page represents a web based messaging communication.

22. The method of claim 1 further comprising the step of detecting according to the at least one detection scheme whether an at least one uploaded parameter represents a web based messaging communication.

23. The method of claim 1 further comprising the step of parsing an at least one part of an at least one web based messaging communication according to the at least one analysis scheme.

24. The method of claim 1 further comprising a step of extracting an association of a unique user ID with a nick name.

25. The method of claim 24 wherein the unique user ID is an e-mail address.

26. The method of claim 1 further comprising a step of emulating a server for presenting the at least one web based messaging communication.

27. The method of claim 1 further comprising a step of intercepting an at least one detail selected from the group consisting of:

user name, login name, and password.

28. The method of claim 1 further comprising a step of denoting an at least one parameter as an indication for aggregation of at least two components of the at least one web based messaging communication.

29. An apparatus for interception and analysis of an at least one web based messaging communication, the apparatus comprising:

an at least one address list repository;

an at least one web based messaging communication detection scheme repository for storing an at least one web based messaging communication detection scheme; and

a web based messaging communication detection engine.

30. The apparatus of claim 29 wherein the at least one web based messaging communication is a saved draft.

31. The apparatus of claim 29 wherein the at least one web based messaging communication is a retrieved draft.

32. The apparatus of claim 29 wherein the at least one web based messaging communication is sent.

33. The apparatus of claim 29 wherein the at least one web based messaging communication is received.

34. The apparatus of claim 29 wherein the at least one address list repository stores an at least one Uniform Resource Locator.

35. The apparatus of claim 29 wherein the at least one address list repository stores an at least one host name

36. The apparatus of claim 29 wherein the at least one address list repository stores an at least one IP address.

37. The apparatus of claim 29 wherein the at least one web based messaging communication detection scheme is a script.

38. The apparatus of claim 29 wherein the at least one web based messaging communication detection scheme is a configuration file.

39. The apparatus of claim 29 further comprising:

an at least one web based messaging communication analysis repository; and

an at least one web based messaging communication analysis engine.

40. The apparatus of claim 39 wherein the at least one web based messaging communication analysis repository comprises an at least one web based messaging communication analysis scheme.

41. The apparatus of claim 39 wherein the at least one web based messaging communication analysis repository comprises an at least one web based messaging communication analysis pattern.

42. The apparatus of claim 39 wherein the at least one web based messaging communication analysis scheme is a script.

43. The apparatus of claim 39 wherein the at least one web based messaging communication analysis scheme is a configuration file.

44. The apparatus of claim 29 further comprising a component for generating an at least one web based messaging communication detection scheme.

45. The apparatus of claim 39 further comprising a component for generating an at least one web based messaging communication analysis scheme.

46. The apparatus of claim 29 wherein the web based messaging communication is web mail.

47. The apparatus of claim 29 wherein the web based messaging communication is instant messaging.

48. The apparatus of claim 29 wherein the web based messaging communication is news group messaging.

49. A computer readable storage medium containing a set of instructions for a general purpose computer, the set of instructions comprising:

receiving an at least one detection scheme for detecting whether an at least one HTTP content item represents a web based messaging communication; and

receiving an at least one analysis scheme for analyzing an at least one web based messaging communication.