MULTI-TIER INTEGRATED SECURITY SYSTEM AND METHOD TO ENHANCE LAWFUL DATA INTERCEPTION AND RESOURCE ALLOCATION

• US 20120096145A1
• Filed: 02/07/2011
• Published: 04/19/2012
• Est. Priority Date: 10/01/2010
• Status: Abandoned Application

• Current Assignee: SS8 Networks Incorporated
• Original Assignee: SS8 Networks Incorporated
• Inventors: Erbilgin, Bulent, Guerrero, Martin Tomas C., Le, Robert D., Bean, Timothy, Dailis, Leonti S., Dikmen, Cemal Tamer, Huang, Henry D., McTiernan, Kevin, Rosera, Martin W.
• Application Number:
  US13/022,627
• Publication Number:
  US 20120096145A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety
• CPC Class Codes: G06Q 90/00 Systems or methods specially adapted for administrative, commercial, financial, managerial or supervisory purposes, not involving significant data processing
• CPC Class Codes: H04L 63/302 gathering intelligence information for situation awareness or reconnaissance

Abstract

A system, method, and apparatus for intercepting data streams such as packets on a network. In one embodiment, the method includes: receiving at a network surveillance system (NSS), a target to be intercepted on the network; creating a target identification (target ID) for the target, wherein the target ID is unique to the NSS in order to track data streams of the target during subsequent processing, such as extraction of content and metadata, in the NSS; intercepting the data streams of the target on the network; tagging the data streams of the target that are intercepted from the network with a respective target ID; transmitting the data streams of the target to the NSS for subsequent analysis; and distributing the data streams across a scalable quantity of data processing engines in the NSS.

Claims

1. A method of intercepting data streams, the method comprising:

receiving at a network surveillance system (NSS), a target to be intercepted on a network;

creating a target identification (target ID) for the target, wherein the target ID is unique to the NSS in order to track data streams of the target during subsequent processed in the NSS; and

intercepting the data streams of the target on the network.

2. The method of claim 1 wherein one of the data streams is a data packet associated with the target, wherein the network is the Internet, wherein the network surveillance system is a lawful interception (LI) surveillance network, and wherein the subsequent processing includes extraction of content and metadata from the data packet associated with the target.

3. The method of claim 1 wherein the target ID is unique for a combination of information chosen from a group of data comprising:

the target, a target type associated with the target, and relational data associated with the target.

4. The method of claim 1 further comprising:

repeating the receiving, creating, and intercepting processes for a plurality of targets.

5. The method of claim 4 further comprising:

aggregating the targets received at the NSS to determine a superset of data streams to be intercepted.

6. The method of claim 5 further comprising:

provisioning a list of target IDs via a data mediation engine to an access device in order to intercept data streams used by the targets on the network.

7. The method of claim 6 further comprising:

provisioning at least one access device coupled to the network to intercept the data streams used by the targets, wherein the access device is a passive probe or is an active port to a network router.

8. The method of claim 1 further comprising:

tagging the data streams of the target, that are intercepted from the network, with a respective target ID; and

transmitting the data streams of the target to the NSS for subsequent analysis.

9. The method of claim 6 further comprising:

distributing the data streams across a scalable quantity of data processing engines in the NSS.

10. The method of claim 9 further comprising:

evaluating a metadata portion of the data streams using a scalable quantity of data processing units (DPUs).

11. The method of claim 10 further comprising:

storing a content portion of the data streams in a scalable quantity of data storage units (DSUs) coupled to the DPUs.

12. The method of claim 9 further comprising:

receiving data from the scalable quantity of data processing engines at a server; and

transferring the data to an analysis system for interpreting the data.

13. The method of claim 12 further comprising:

evaluating relational data between a plurality of network users of the data streams to identify a relationship and a degree of separation between a plurality of network users.

14. The method of claim 12 further comprising:

displaying on a GUI, the data of the target intercepted on the network.

15. The method of claim 1 further comprising:

storing at least a portion of the data streams intercepted from the network, in a circular storage device for future access.

16. The method of claim 1 further comprising:

evaluating a metadata portion of at least one of the data streams using a metadata processing engine in the NSS.

17. The method of claim 16 further comprising:

evaluating relational data between a metadata portion of a plurality of data streams from a plurality of network users to identify a relationship between at least two of the plurality of data streams.

18. The method of claim 1 further comprising:

identifying an advanced target to intercept based on a relationship between any combination of at least two items from the group consisting of;

a first target, a second target, a first non-target, and a second non-target.

19. The method of claim 16 further comprising:

provisioning an advanced target to be intercepted based upon the relationship discovered by the metadata processing unit.

20. The method of claim 19 further comprising:

receiving the advanced target at an interface manager in the NSS; and

evaluating the advanced target for redundancy against existing targets of the NSS.

21. The method of claim 20 further comprising:

communicating the advanced target to either at least one access device on the network or to a circular storage device; and

intercepting data streams associated with the advanced target.

22. The method of claim 1 wherein the target ID can reference fields chosen from a group of data consisting of:

a network ID, a requesting agency ID, a network provider ID, a target name, a target handle, an intercept time and an intercept date.

23. The method of claim 1 wherein the NSS is a single source to manage targets and intercepted data for a plurality of surveillance users.

24. The method of claim 1 wherein the NSS is a single source to manage intercepted data received from a plurality of access devices operating on a plurality of networks.

25. The method of claim 1 further comprising:

creating a look up table (LUT) to track the target and the data streams of the target.

26. A network surveillance system comprising:

a graphical user interface (GUI) to receive a target to be intercepted on a network;

a data mediation engine coupled to the GUI, the data mediation engine operative to create a target ID for the target in the network, wherein the target ID is unique to the network surveillance system (NSS) in order to track data streams of the target in subsequent processing by the NSS; and

an access device, coupled to the data mediation engine, for intercepting the data streams of the target on the network.

27. The network surveillance system of claim 26 wherein the data stream is a data packet, wherein the network is the Internet, wherein the network surveillance system is a lawful interception (LI) surveillance network, and wherein the subsequent processing includes extraction of content and metadata from the data packet associated with a target.

28. The network surveillance system of claim 26 further comprising:

a scalable quantity of data processing engines for evaluating data streams intercepted from a network, the scalable quantity of data processing engines allowing the NSS to be scaled to accommodate higher data processing requirements.

29. The network surveillance system of claim 28 wherein the scalable quantity of data processing engines further comprises:

a scalable quantity of data processing units (DPUs) for evaluating a metadata portion of the data streams.

30. The network surveillance system of claim 29 wherein the scalable quantity of data processing engines further comprises:

a scalable quantity of data storage units (DSUs) coupled to the DPUs.

31. The network surveillance system of claim 28 further comprising:

a load balancer coupled to the scalable quantity of data processing engines, wherein the load balancer is operative to distribute the data streams to the data processing engines in the network surveillance system for subsequent processing of the data streams.

32. The network surveillance system of claim 27 wherein the load balancer and the data mediation engine track the data streams via the target ID.

33. The network surveillance system of claim 32, wherein a look up table (LUT) is used for matching the data streams of a target with the target ID.

34. The network surveillance system of claim 26 wherein the data mediation engine is further operable to:

receive a list of targets from the GUI; and

provision the list of targets to the access device in order to intercept data streams used by the targets.

35. The network surveillance system of claim 26 wherein the NSS is operable to tag the data streams of the target with a respective target ID.

36. The network surveillance system of claim 26 further comprising:

a server for receiving data from the mediation device and for transferring the information to an analysis system for interpreting the data.

37. The network of claim 26 wherein the access device is a probe coupled to passively intercept, or is an access point to a router to actively intercept, the data streams from the network.

38. The network surveillance system of claim 26, further comprising:

a plurality of access devices coupled to at least one network.

39. The network surveillance system of claim 26 further comprising:

a circular storage device coupled to the access device, wherein the storage device stores at least a portion of the data streams intercepted from the network for future surveillance analysis.

40. The network surveillance system of claim 28 further comprising:

a plurality of graphical user interfaces (GUIs); and

a scalable quantity of load balancers coupled to the scalable quantity of data processing engines.

41. The network surveillance system of claim 26 further comprising:

an analysis system coupled to the data mediation engine, wherein the analysis system is operable to;

evaluate relational data between the data streams intercepted from the network in order to identify a relationship and a degree of separation between the plurality of users; and

output results to the GUI.

42. The network surveillance system of claim 26 further comprising:

a metadata processing engine, coupled to the access device, for evaluating a metadata portion of the data streams.

43. The network surveillance system of claim 42 wherein the metadata processing engine is operable to:

evaluate relational data between a metadata portion of the data streams from a plurality of users to identify a relationship between at least two of the plurality of data streams.

44. The network surveillance system of claim 43 wherein the metadata processing unit is operable to:

request provisioning for an advanced target to be intercepted based upon the relationship discovered by the metadata processing engine.

45. The network surveillance system of claim 44 wherein the data mediation engine is further operable to:

receive a request for provisioning the advanced target;

provisioning the advanced target at the access device in order to intercept data streams used by the advanced target on the network.

46. The network surveillance system of claim 45 wherein the data mediation engine is further operable to:

intercept data streams associated with the advanced target from at least one location chosen from the group including;

the network, and a circular storage device.

47. The network surveillance system of claim 26 wherein the target ID can include fields chosen from a group comprising:

network ID, requesting agency ID, network provider ID, target name, target handle.

48. The network surveillance system of claim 38 wherein the NSS is a single source to manage intercepted data received from the plurality of access devices operating on a plurality of networks.

49. The network surveillance system of claim 26 wherein the NSS is a single source to manage targets and intercepted data for a plurality of surveillance users.