Method and systems for intelligent signaling router-based surveillance

• US 6,987,849 B2
• Filed: 04/09/2002
• Issued: 01/17/2006
• Est. Priority Date: 04/09/2002
• Status: Active Grant

• Current Assignee: Tekelec Global, Inc. (Oracle Corporation)
• Original Assignee: Tekelec
• Inventors: Ravishankar, Venkataramaiah
• Primary Examiner(s): Matar, Ahmad F.
• Assistant Examiner(s): Nguyen, Quynh H.
• Application Number:
  US10/119,274
• Publication Number:
  US 20030190032A1
• Time in Patent Office: 1,379 Days
• Field of Search: 379/32.05, 379/35, 379/126, 379/133, 379/112.01
• US Class Current: 379/221.1
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 7/006 Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42
• CPC Class Codes: H04M 7/06 using auxiliary connections for control or supervision , e.g. where the auxiliary connection is a signalling system number 7 link

Abstract

Methods and systems for intelligent signaling-router-based surveillance are disclosed. A surveillance and signaling router receives call signaling messages, identifies call signaling messages associated with users under surveillance and determines a surveillance type for the call signaling messages. If the surveillance type is content-related, the surveillance and signaling router forwards the message to a call server. The call server replaces parameters in the message and in subsequent messages so that the call is transparently set up through a media proxy server. The media proxy server copies the media stream to a delivery function. If the surveillance type is non-content-related, the surveillance and signaling router sends a copy of the message or information extracted from the message to an external device.

Claims

1. A method for intelligent signaling-router-based surveillance, the method comprising:

at a signaling router capable of routing call-related signaling messages between users in a communications network;

(a) receiving a call-related signaling message, the call-related signaling message being selected from a group consisting of signaling messages relating to the setup, progress, or tear-down of a call;

(b) determining whether the message is associated with a user or device under surveillance by extracting at least one parameter from the call-related signaling and performing a lookup in a database local to the signaling router;

(c) in response to determining that the message is associated with a user or device under surveillance, determining whether content-related or non-content-related surveillance is required;

(d) in response to determining that content-related surveillance is required, forwarding the signaling message to a call server; and

(e) in response to determining that non-content-related surveillance is required, copying data from the signaling message and forwarding the data to a delivery function.

2. The method of claim 1 wherein performing steps (a)–

(e) at a signaling router includes performing steps (a)–

(e) at a signaling router capable of routing call signaling messages of a plurality of different call signaling protocols.

3. The method of claim 1 wherein receiving a call-related signaling message includes receiving a SIP signaling message.

4. The method of claim 1 wherein receiving a call-related signaling message includes receiving an H.323 signaling message.

5. The method of claim 1 wherein receiving a call-related signaling message includes receiving an SS7 signaling message.

6. The method of claim 1 wherein receiving a call-related signaling message includes receiving a signaling message from a first user of a first signaling protocol for establishing a call with a second user of a second signaling protocol different from the first signaling protocol.

7. The method of claim 1 wherein determining whether the message is associated with a user or device under surveillance includes searching the database using a user or device identifier extracted from the signaling message.

8. The method of claim 7 wherein the user or device identifier comprises a SIP URL.

9. The method of claim 7 wherein the user or device identifier comprises an IP address.

10. The method of claim 7 wherein the user or device identifier comprises a calling or called party address.

11. The method of claim 1 wherein copying data from the signaling message includes copying user identification information from the signaling message.

12. The method of claim 1 wherein copying data from the signaling message includes copying user location information from the signaling message.

13. The method of claim 1 comprising, at the call server, signaling the called and calling users for establishing media communications through a media proxy server.

14. The method of claim 13 wherein signaling the called and calling users includes altering signaling parameter information in the call-related signaling message and forwarding the altered signaling message to its intended destination.

15. The method of claim 14 wherein altering signaling parameter information includes altering media port information in the call-related signaling message.

16. The method of claim 13 comprising, at the media proxy server, forwarding content between the called and calling users and copying the content to a delivery function.

17. The method of claim 16 wherein the content includes voice data.

18. The method of claim 16 wherein the content includes video data.

19. The method of claim 16 wherein the content includes text messages.

20. The method of claim 1 comprising:

(a) receiving a non-call-related signaling message;

(b) determining whether the non-call-related signaling message is associated with a user or device under surveillance; and

(c) in response to determining that the non-call-related signaling message is associated with a user or subscriber under surveillance, copying information from the non-call-related signaling messages and forwarding the information to the delivery function.

26. The signaling router of claim 20 including a plurality of communications modules for sending and receiving call signaling messages over a plurality of networks of different types.

21. A signaling router for routing call signaling messages between network nodes comprising:

(a) a communications module including a communications protocol stack for sending and receiving call signaling messages over a packet-based network;

(b) a surveillance module operatively associated with the communications module for identifying call signaling messages associated with users or devices under surveillance, determining a surveillance type for the call signaling messages associated with users under surveillance, and for performing a surveillance action based on the surveillance type; and

(c) a surveillance database operatively associated with the surveillance module for storing data for identifying the call signaling messages associated with users or devices under surveillance, the surveillance types, and the surveillance actions, wherein the surveillance module is adapted to perform a lookup in the surveillance database using parameters extracted from the call signaling messages to identify the call signaling messages associated with users under surveillance, to determine the surveillance type, and to determine the surveillance action.

22. The signaling router of claim 21 wherein the communications module is adapted to send and receive call signaling messages over an IP network.

23. The signaling router of claim 21 wherein the communications module is adapted to send and receive call signaling messages over an SS7 network.

24. The signaling router of claim 22 wherein the communications module includes a SIP signaling application for sending receiving SIP signaling messages over the IP network.

25. The signaling router of claim 22 wherein the communications module includes an H.323 signaling application for sending and receiving H.323 signaling messages over the IP network.

27. The signaling router of claim 21 wherein the surveillance module is adapted to determine whether call signaling messages are associated with calls that require content-based or non-content-based surveillance.

28. The signaling router of claim 27 wherein the surveillance module is adapted to redirect the signaling messages associated with calls requiring content-based surveillance to a call server.

29. The signaling router of claim 27 wherein, for the call signaling messages that require non-content-based surveillance, the surveillance and signaling router is adapted to determine whether trap and trace or pen register surveillance is required.

30. An intelligent signaling-router-based surveillance system, the system comprising:

(a) a signaling router for routing call signaling messages, for identifying call signaling messages associated with users under surveillance, determining a surveillance type for the identified messages, and performing a surveillance action based on the surveillance types, wherein the signaling router is adapted to identify the call signaling messages associated with users under surveillance and determine the surveillance type and the surveillance action by extracting parameters from the call signaling messages and performing lookups in a surveillance database local to the signaling router;

(b) a call server operatively associated with the signaling router for receiving call signaling messages associated with users under content-based surveillance and for establishing the content-based surveillance; and

(c) a media proxy server operatively associated with the call server for sending and receiving content between users under content-based surveillance and for copying the content to a delivery function.

31. The system of claim 30 wherein the signaling router is adapted to route signaling messages of a plurality of different call signaling protocols and to perform surveillance actions for each of the call signaling protocols.

32. The system of claim 30 wherein the signaling router is adapted to distinguish between signaling messages associated with content-related and non-content-related surveillance and to forward the signaling messages associated with content-related surveillance to the call server.

33. The system of claim 30 wherein the signaling router includes a copy function for copying signaling messages associated with non-content-related surveillance to an external device.

34. The system of claim 30 wherein the call server is dedicated to controlling content-related surveillance calls.

35. A method for intelligent signaling-router-based surveillance, the method comprising:

at a signaling router capable of routing registration messages between users in a communications network;

(a) receiving a registration message;

(b) determining whether the message is associated with a user or device under surveillance by performing a lookup in a database local to the signaling router using at least one parameter extracted from the registration message;

(c) in response to determining that the message is associated with a user or device under surveillance, determining whether content-related or non-content-related surveillance is required;

(d) in response to determining that content-related surveillance is required, forwarding the signaling message to a call server; and

(e) in response to determining that non-content-related surveillance is required, copying data from the signaling message and forwarding the data to a delivery function.

36. The method of claim 35 wherein the registration message comprises a session initiation protocol (SIP) registration message.

37. A method for intelligent signaling-router-based surveillance, the method comprising:

at a signaling router capable of routing call forwarding signaling messages between users in a communications network;

(a) receiving a call forwarding signaling message;

(b) determining whether the message is associated with a user or device under surveillance by performing a lookup in a database local to the signaling router using at least one parameter extracted from the call forwarding signaling message;

(c) in response to determining that the message is associated with a user or device under surveillance, determining whether content-related or non-content-related surveillance is required;

(d) in response to determining that content-related surveillance is required, forwarding the signaling message to a call server; and

(e) in response to determining that non-content-related surveillance is required, copying data from the signaling message and forwarding the data to a delivery function.