Method and system for wiretapping of packet-based communications

• US 7,055,174 B1
• Filed: 02/26/2001
• Issued: 05/30/2006
• Est. Priority Date: 02/26/2001
• Status: Expired due to Term

• Current Assignee: Sprint Spectrum LP (Deutsche Telekom AG)
• Original Assignee: Sprint Spectrum LP (Deutsche Telekom AG)
• Inventors: Cope, Warren B., Gailliaert, Ferry J.
• Primary Examiner(s): Moise, Emmanuel L.
• Assistant Examiner(s): Pyzocha, Michael
• Application Number:
  US09/793,176
• Time in Patent Office: 1,919 Days
• Field of Search: 379/35, 379/85, 709/223, 709/224, 726/22
• US Class Current: 726/22
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 65/1076 Screening of IP real time communications, e.g. spam over Internet telephony [SPIT]
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 7/0075 Details of addressing, directories or routing tables

Abstract

A method and system for wiretapping a packet-based communication, such as a voice communication for instance. When a node in the normal path of packet-transmission between a source and destination receives packets of the communication, the node can conventionally route the packets to the intended destination. At the same time, a session manager can notify a wiretap server that the session is being established or is underway, and the wiretap server can then direct the node to bi-cast the packets of the communication to the wiretap server node. At the wiretap server, the packetized communication can be depacketized, and a TDM signal representing the communication can be sent via a conventional circuit-switch to a law enforcement agency or other authorized entity.

Claims

1. A method of wiretapping a communication represented by a number of packets being communicated in a packet-switched network between a source address and a destination address, via at least one node, the method comprising, in combination:

during initiation of the communication, an entity involved with the initiation making a determination to place a participant in the communication under surveillance;

in response to the determination, the entity sending a wiretap-message to a controller, the wiretap-message indicating a network access point of the node;

in response to the wiretap-message, the controller sending a receive-message to a hub and sending a transmit-message to the node, the receive-message instructing the hub to reserve at least one port at which to receive the packets of the communication, and the transmit-message instructing the node to transmit the packets to the at least one port of the hub, wherein, the node then bi-casts the packets to (i) the at least one port of the hub and (ii) the destination address;

the hub receiving the packets and responsively converting the packets into a digital bit stream representative of the communication;

the controller sending a call-setup message to a circuit-switch, the call-setup message instructing the circuit-switch to establish a circuit-switched call path between the hub and an observer via the circuit-switch, wherein the circuit-switch responsively establishes the circuit-switched call path; and

the hub sending the digital bit stream via the circuit-switched call path to the circuit-switch, and the circuit-switch responsively forwarding the communication via the circuit-switched call path to the observer.

2. The method of claim 1, wherein the entity involved with initiation of the communication comprises a session manager.

3. The method of claim 1, wherein the observer comprises an authorized entity.

4. The method of claim 3, wherein the observer comprises a law enforcement agency.

5. The method of claim 3, wherein the observer comprises a call center authorized to record the communication.

6. The method of claim 1, wherein the transmit-message further indicates the at least one port of the hub, the node thereby learning from the transmit-message where to send the packets.

7. The method of claim 1, further comprising the circuit-switch (i) decoding at least one DTMF digit from within the communication and (ii) sending to the controller at least one signal indicative of the at least one DTMF digit,

whereby the controller may output information indicative of the at least one DTMF digit, for receipt of the information by the observer.

8. The method of claim 1, wherein the communication comprises a voice communication.

9. The method of claim 1, wherein the communication comprises a facsimile communication.

10. A system for wiretapping a communication represented by a number of packets being transmitted in a packet-switched network between a source address and a destination address, via at least a first network node, the system comprising, in combination:

an entity involved with initiation of the communication;

a wiretap-controller communicatively linked with the first network node;

a second network node arranged to receive a packet sequence representative of an underlying signal and to responsively convert the packet sequence into a bit stream representative of the underlying signal;

a circuit-switch communicatively linked with the wiretap-controller and with the second network node;

wherein, during initiation of the communication, the entity involved with the initiation makes a determination to place a participant in the communication under surveillance, and in response to the determination, sends a wiretap-message to the wiretap-controller, the wiretap-message indicating a network access point of the first network node;

wherein, in response to receiving the wiretap-message, the wiretap-controller sends a first signaling message to the first network node, and the first network node responds to the first signaling message by transmitting the packets to the second network node, the first network node also transmitting the packets to the destination address;

wherein, also in response to receiving the wiretap-message, the wiretap-controller sends a second signaling message to the circuit-switch, and the circuit-switch responds to the second signaling message by setting up a circuit-switched call path between the second network node and an observer station;

wherein the second network node receives the packets, converts the packets into a bit stream representing the communication, and sends the bit stream via the circuit-switched call path to the circuit-switch; and

wherein the circuit-switch receives the bit stream and responsively sends the communication to the observer station via the circuit-switched call path.

11. The system of claim 10, wherein the circuit-switch decodes at least one DTMF digit from within the communication and outputs a signal indicative of the at least one DTMF digit, whereby the signal may be communicated to the observer station.