Data Retention and Lawful Intercept for IP Services

• US 20110029667A1
• Filed: 02/21/2008
• Published: 02/03/2011
• Est. Priority Date: 02/21/2008
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Imbimbo, Amedeo, Attanasio, Francesco
• Granted Patent: US 9,204,293 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 7/006 Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/80 Arrangements enabling lawful interception [LI]

Abstract

The method provides a Law Enforcement Agency LEA with retention or interception data related to a target user. At a data retention source node or at an interception control element of a telecommunications network, traffic packets involving the target user are inspected and a plurality of usage data records based on the inspected traffic packets are generated. Each record comprises information relating to a certain service class and to a respective communications stack layer. For each communications session involving a plurality of different communications stack layers, at the data retention source node or, respectively, the interception control element, the plurality of usage data records are provided with a same correlation identity number for correlating the data at the different communications stack layers. Then, the usage data records comprising the correlation identity number to the LEA are sent, for instance to the LI system or the data Retention System, respectively.

Claims

1. A method for providing a Law Enforcement Agency LEA with retention or interception data related to a target user, comprising the steps of, at a data retention source node or at an interception control element of a telecommunications network:

inspecting traffic packets involving the target user;

generating a plurality of usage data records based on the inspected traffic packets, each record comprising information relating to a certain service class and to a respective communications stack layer;

for each communications session involving a plurality of different communications stack layers, providing said plurality of usage data records with a same correlation identity number for correlating the data at said different communications stack layers;

sending said usage data records comprising the correlation identity number to the LEA.

2. The method of claim 1, wherein the correlation identity number identifies the lowest communications stack layer of said communications stack layers.

3. The method of claim 2, wherein the correlation identity number is a unique Communications Identity Number CIN assigned to the communications session in the lowest communications stack layer.

4. The method of claim 3, wherein each usage data record comprises a further CIN identifying a respective session in a respective communications stack layer.

5. The method of claim 4, wherein said telecommunications network comprises a Data Retention system connected to said LEA and to said data retention source node and comprising a Mediation Function, a Delivery Function and a storage, and wherein said sending step comprising:

transferring from the data retention source node to the Mediation and Delivery Functions

at least one usage data record comprising application layer information for IP services, the unique CIN and the CIN used to correlate the data for the application layer,

at least one usage data record comprising transport layer information for IP services, the unique CIN and the CIN used to correlate the data for the transport layer,

at least one usage data record comprising network layer information for IP services, the unique CIN and the CIN used to correlate the data for the network layer,

at least one usage data record comprising data link layer information for IP services, the unique CIN and the CIN used to correlate the data for the data link layer;

said usage data records being mediated by said Mediation Function after having been received from the data retention source node and being transferred from the Mediation and Delivery Functions to the storage.

6. The method of claim 5, further comprising the step of sending, by the LEA to the Data Retention system, a request for IP services retained data related to the target user, retrieving the said mediated usage data records from said storage and correlating said usage data records by means of said unique CIN.

7. The method of claim 4, wherein said telecommunications network comprises a Lawful Interception system connected to said LEA and to said interception node and comprising a Mediation Function and a Delivery Function, wherein said usage data records are Intercept Related Information IRI and wherein said sending step comprising:

transferring from the interception node to the Mediation and Delivery Functions

at least one IRI comprising application layer information, the unique CIN and the CIN used to correlate the data for the application layer,

at least one IRI comprising transport layer information, the unique CIN and the CIN used to correlate the data for the transport layer,

at least one IRI comprising network layer information, the unique CIN and the CIN used to correlate the data for the network layer,

at least one IRI comprising Layer 2 information for IP services, the unique CIN and the UN used to correlate the data for the Layer 2 layer;

each one of said IRIs being mediated by said Mediation Function after having been received from the interception node and being transferred from the Mediation and Delivery Function to the LEA.

8. The method of one or more of the preceding claims, wherein said data retention source node or said interception control element is a Service Aware Support Node SASN.

9. A data retention source node comprising packet inspection means, characterized in that said node comprises means for communicating with a Data Retention system, and in that said packet inspection means are configured to generate a plurality of usage data records based on inspected traffic packets, each record comprising information relating to a certain service class and to a respective communications stack layer;

said packet inspection means being further configured to, for each communications session involving a plurality of different communications stack layers, provide said plurality of usage data records with a same correlation identity number for correlating the data at said different communications stack layers;

said data retention source node comprising means for sending said usage data records comprising the correlation identity number to the Data Retention system.

10. The data retention source node of claim 9, wherein the correlation identity number identifies the lowest communications stack layer of said communications stack layers.

11. The data retention source node of claim 10, wherein the correlation identity number is a unique Communications Identity Number CIN assigned to the communications session in the lowest communications stack layer.

12. The data retention source node of claim 11, wherein each usage data record comprises a further CIN identifying a respective session in a respective communications stack layer.

13. The data retention source node of one or more of claims 9-12, wherein said data retention source node is a Service Aware Support Node SASN.

14. A telecommunications network having data retention functionalities, characterized in that it comprises a data retention source node according to claim 12, a Law Enforcement Agency LEA and a Data Retention system connected to said LEA and to said data retention source node, said Data Retention system comprising a Mediation Function, a Delivery Function and a storage, wherein said means for sending said usage data records comprises:

means for transferring from the data retention source node to the Mediation and Delivery Functions

at least one usage data record comprising application layer information for IP services, the unique CIN and the CIN used to correlate the data for the application layer,

at least one usage data record comprising transport layer information for IP services, the unique CIN and the CIN used to correlate the data for the transport layer,

at least one usage data record comprising network layer information for IP services, the unique CIN and the CIN used to correlate the data for the network layer,

at least one usage data record comprising data link layer information for IP services, the unique CIN and the CIN used to correlate the data for the data link layer;

said Mediation Function being configured to receive from the data retention source node said usage data records and to mediate said received usage data records, and said Delivery Function being configured to transfer said mediated usage data records to the storage, said Delivery Function being further configured to transfer said mediated usage data records from said storage to said LEA via a Handover Interface HI-B.

15. The telecommunications network of claim 14, wherein the Data Retention system is configured to receive from the LEA via a Handover Interface HI-A a request for IP services retained data related to the target user, to retrieve said mediated usage data records from said storage and to correlate said usage data records by means of said unique CIN.

16. An Intercepting Control Element ICE comprising packet inspection means for providing Intercept Related Information IRI and Content of Communication CC to a Lawful Interception LI system, characterized in that said packet inspection means are configured to generate a plurality of IRIs based on inspected traffic packets, each IRI comprising information relating to a certain service class and to a respective communications stack layer;

said packet inspection means being further configured to, for each communications session involving a plurality of different communications stack layers, provide said plurality of IRIs with a same correlation identity number for correlating the data at said different communications stack layers;

said ICE comprising means for sending said IRIs comprising the correlation identity number to the LI system.

17. The ICE of claim 16, wherein the correlation identity number identifies the lowest communications stack layer of said communications stack layers.

18. The ICE of claim 17, wherein the correlation identity number is a unique Communications Identity Number CIN assigned to the communications session in the lowest communications stack layer.

19. The ICE of claim 18, wherein each IRI comprises a further CIN identifying a respective session in a respective communications stack layer.

20. The ICE of one or more of claims 16-19, wherein said ICE is a Service Aware Support Node SASN.

21. A telecommunications network having lawful interception functionalities, characterized in that it comprises an Intercepting Control Element according to claim 16, a Law Enforcement Agency LEA and a Lawful Interception LI system connected to said LEA and to said ICE, said LI system comprising at least one Mediation Function 2 and a Delivery Function 2, wherein said means for sending said IRIs comprises:

transferring from the ICE to the Mediation and Delivery Functions 2

at least one IRI comprising application layer information, the unique CIN and the CIN used to correlate the data for the application layer,

at least one HU comprising transport layer information, the unique CIN and the CIN used to correlate the data for the transport layer,

at least one IRI comprising network layer information, the unique CIN and the CIN used to correlate the data for the network layer,

at least one IRI comprising Layer 2 information for IP services, the unique CIN and the CIN used to correlate the data for the Layer 2 layer;

said Mediation Function 2 being configured to mediate each one of said IRIs after they have been received from the ICE and to transfer said IRIs to the LEA via a Handover Interface HI2.

22. A computer program loadable into a processor of a data retention source node or of an intercepting control element, wherein the computer program comprises code adapted to

a) inspect traffic packets involving the target user;

b) generate a plurality of usage data records based on the inspected traffic packets, each record comprising information relating to a certain service class and to a respective communications stack layer;

c) for each communications session involving a plurality of different communications stack layers, provide said plurality of usage data records with a same correlation identity number for correlating the data at said different communications stack layers;

d) send said usage data records comprising the correlation identity number to a LEA.