METHOD, DEVICE AND SYSTEM FOR NETWORK INTERCEPTION

• US 20090323536A1
• Filed: 06/04/2009
• Published: 12/31/2009
• Est. Priority Date: 06/30/2008
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Chengdu Huawei Symantec Technologies Company Limited (Huawei Investment & Holding Co., Ltd.)
• Inventors: Liu, Guoqing, Liu, Tingyong, Zhang, Wenda
• Granted Patent: US 8,416,695 B2
• Time in Patent Office: Days
• US Class Current: 370/241
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54

Abstract

A method, a device, and a system for network interception are provided. The method for network interception includes the following steps. A matching rule obtained by parsing an interception policy. Received data are selected by adopting a deep packet inspection (DPI) according to the matching rule so as to obtain an interception result, in which the received data are obtained by adopting data preprocessing to filter packet data according to a service customizing rule obtained by parsing the interception policy. The system for network interception includes a service probe server (SPS) and a service analyze server (SAS). Thus, various packet data services transmitted over an Internet protocol (IP) network can be intercepted.

Claims

1. A method for network interception, comprising:

obtaining a matching rule by parsing an interception policy; and

selecting received data by adopting a deep packet inspection (DPI) according to the matching rule to obtain an interception result, wherein the received data are obtained by adopting data preprocessing to filter packet data according to a service customizing rule obtained by parsing the interception policy.

2. The method according to claim 1, wherein the selecting the received data by adopting the DPI to obtain the interception result comprises:

analyzing the received data by adopting the DPI;

selecting an analysis result according to the matching rule so as to obtain intercept related information (IRI) of service data to be intercepted; and

obtaining content of communication (CC) corresponding to the IRI of the service data to be intercepted by associating with a unique feature identifier, and taking the IRI of the service data to be intercepted and the corresponding CC as the interception result.

3. The method according to claim 1, further comprising:

performing a service recovery on the interception result.

4. The method according to claim 1, wherein the matching rule corresponds to specific information of a service to be intercepted, the specific information of the service to be intercepted comprises a user name, an account, an Email address, and a phone number.

5. The method according to claim 1, wherein the service customizing rule corresponds to basic information of the service to be intercepted, the basic information of the service to be intercepted comprises a media access control (MAC) address, an IP address, a transmission control protocol (TCP)/user datagram protocol (UDP) port, and service type.

6. A service analyze server (SAS), comprising:

an interception policy processing unit, adapted to parse an interception policy so as to obtain a service customizing rule and a matching rule; and

a data selecting unit, adapted to select data sent by a service probe server (SPS) by adopting a deep packet inspection (DPI) according to the matching rule obtained by the interception policy processing unit so as to obtain an interception result, wherein the data sent by the SPS are obtained by the SPS by adopting data preprocessing to filter packet data according to the service customizing rule obtained by parsing the interception policy.

7. The SAS according to claim 6, wherein the data selecting unit comprises:

an analyzing subunit, adapted to analyze the data sent by the SPS by adopting the DPI;

a selecting subunit, adapted to select an analysis result of the analyzing subunit according to the matching rule obtained by the interception policy processing unit so as to obtain intercept related information (IRI) of service data to be intercepted; and

an interception result generating subunit, adapted to generate the interception result according to the IRI of the service data to be intercepted obtained by the selecting subunit.

8. A system for network interception, comprising a service probe server (SPS) and a service analyze server (SAS), wherein

the SPS is adapted to obtain packet data of an Internet protocol (IP) network and filter the obtained packet data by adopting a data preprocessing technique according to a service customizing rule obtained by the SAS;

and

the SAS is adapted to parse an interception policy to obtain the service customizing rule and a matching rule, and select the data filtered by the SPS by adopting a deep packet inspection (DPI) according to the matching rule so as to obtain an interception result.

9. The system for network interception according to claim 8, wherein the interception result comprises intercept related information (IRI) of service data to be intercepted by selecting the data filtered by the SPS according to the matching rule and content of communication (CC) corresponding to the IRI.

10. The system for network interception according to claim 9, further comprising:

a database, adapted to store the IRI; and

a files server (DFS), adapted to store the CC corresponding to the IRI.

11. The system for network interception according to claim 9, further comprising:

a web server (WBS), adapted to perform a service recovery on the interception result.

12. The system for network interception according to claim 11, further comprising:

a web client (WBC), adapted to provide a user interface to the system for network interception for interception personnel to log in the WBS through the WBC so as to perform the service recovery on the interception result.

13. The system for network interception according to claim 8, further comprising:

a web server (WBS), adapted to perform a service recovery on the interception result.

14. The system for network interception according to claim 13, further comprising:

a web client (WBC), adapted to provide a user interface to the system for network interception for interception personnel to log in the WBS through the WBC so as to perform the service recovery on the interception result.