Lawful communication interception—intercepting communication associated information

• US 7,152,103 B1
• Filed: 01/10/2001
• Issued: 12/19/2006
• Est. Priority Date: 01/10/2001
• Status: Expired due to Fees

• Current Assignee: RPX Clearinghouse LLC (RPX Corporation)
• Original Assignee: Nortel Networks Limited (Nortel Networks Corporation)
• Inventors: Homayoun, Fereidoun, Ryan, Ronald D.
• Primary Examiner(s): Dharia, Rupal
• Assistant Examiner(s): Shingles, Kristie D.
• Application Number:
  US09/757,904
• Time in Patent Office: 2,169 Days
• Field of Search: 709/201, 709/202, 709/224, 709/230, 709/236
• US Class Current: 709/224
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281

Abstract

A method and apparatus are provided for extracting and reporting communication associated information of communications between a subject and an associate. This is achieved by populating an application identifier in the Network Layer 3, which the access networks examine in order to route the packets appropriately, and, thereby, allowing the access networks to isolate and extract the communication associated information. The access networks extract the call associated information and report the same to the Law Enforcement Agencies. Delivery to the LEAs of communication associated information may also be optimized.

Claims

1. A method of capturing communication associated information (CAI) of a communication between a subject and an associate, the method comprising the steps of:

intercepting the communication, the communication comprising at least one packet and each packet comprising CAI;

providing an application identifier (AID) in the at least one packet of the communication, the AID identifying the format of the CAI, wherein the AID is located in an optional field of Network Layer 3;

extracting in accordance with the AID the CAI from the at least one packet for reporting;

determining whether the extracted CAI is a new instance of the CAI;

reporting a first message to a Law Enforcement Agency (LEA) in response to a determination that the extracted CAI is the new instance of the CAI;

determining whether a predetermined amount of time has elapsed between packets of the at least one packet of the communication, the packets being identified by the CAI; and

reporting a second message to an LEA in response to a determination that the given amount of time has elapsed, wherein the second message represents a timeout indication.

2. The method of claim 1, wherein the second message comprises at least one of a subject identifier, a time stamp indicating when the message was sent, the IP address of the subject, a packet direction indicator identifying whether the message was sent or received by the subject, the IP address of the associate, a first instance indicator identifying the new instance of the CAI, and a counter indicating the number of packets identified by the CAI seen since a last message.

3. The method of claim 1, wherein the method further comprises the steps of:

determining whether a given number of packets of the at least one packet of the communication has been intercepted, the packets being identified by the CAI; and

reporting a third message in response to a determination that the given number of packets identified by the CAI has been intercepted.

4. The method of claim 3, wherein the third message comprises at least one of a subject identifier, a time stamp indicating when the message was sent, the IP address of the subject, a packet direction indicator identifying whether the message was sent or received by the subject, the IP address of the associate, a first instance indicator identifying the new instance of the CAI, and a counter indicating the number of packets identified by the CAI seen since a last message.

5. The method of claim 1, wherein the method further comprises the step of:

providing an AID-tag in the at least one packet of the communication, the AID-tag indicating the presence of the AID.

6. The method of claim 1, wherein the method further comprises the steps of:

providing an AID-tag in the at least one packet of the communication, wherein the AID-tag indicates the presence of the AID, and wherein the AID-tag is located in the protocol field of the Network Layer 3.

7. The method of claim 1, wherein the first message comprises at least one of a subject identifier, a time stamp indicating when the message was sent, the IP address of the subject, a packet direction indicator identifying whether the message was sent or received by the subject, the IP address of the associate, a first instance indicator identifying the new instance of the CAI, and a counter indicating the number of packets identified by the CAI seen since a last message.

8. A method of consolidating at least one packet of a communication between a subject and an associate, the method comprising the steps of:

receiving at least one packet of the communication, each packet comprising communication associated information (CAI);

providing an application identifier (AID) in the at least one packet of the communication, the AID identifying the format of the CAI, wherein the AID is located in an optional field of Network Layer 3;

extracting in accordance with the AID the CAI from the at least one packet for reporting;

determining whether a packet is a new instance of the CAI

reporting the CAI in response to a determination that the packet is a new instance of the CAI to an LEA;

determining whether a predetermined amount of time has elapsed between packets of the at least one packet;

reporting a timeout indication to an LEA in response to a determination that the predetermined amount of time has elapsed; and

reporting the CAI periodically to an LEA in response to a determination that the packet is a subsequent packet.

9. The method of claim 8, wherein the step of determining whether a packet is a new instance of the CAI is performed by comparing the CAI with a previous CAI.

10. The method of claim 8, wherein the step of determining whether a packet is a new instance CAI is performed by allowing a given amount of time to elapse since the receipt of the at least one packet.

11. The method of claim 8, wherein the CAI report comprises at least one of a subject identifier, a time stamp indicating when the message was sent, the IP address of the subject, a packet direction indicator identifying whether the message was sent or received by the subject, an associate identifier, a first instance indicator identifying the new instance of the CAI, and a counter indicating the number of packets identified by the CAI seen since a last report.

12. An apparatus for providing access to communication associated information (CAI) of a communication between a subject and an associate, the apparatus comprising:

means for intercepting the communication, the communication comprising at least one packet and each packet comprising CAI;

means for providing an application identifier (AID) in the at least one packet of the communication, the AID identifying the format of the CAI, wherein the AID is located in an optional field of Network Layer 3;

means for extracting in accordance with the AID the CAI from the at least one packet for reporting;

means for determining whether the extracted CAI is a new instance of the CAI;

means for reporting to an LEA a first message in response to a determination that the extracted CAI is the new instance of the CAI;

means for determining whether a predetermined amount of time has elapsed between packets of the at least one packet of the communication, the packets being identified by the CAI; and

means for reporting to an LEA a second message in response to a determination that the given amount of time has elapsed, wherein the second message represents a timeout indication.

13. The apparatus of claim 12, wherein the apparatus further comprises:

means for determining whether a given number of packets of the at least one packet of the communication has been intercepted, the packets being identified by the CAI; and

means for reporting an intermediate CAI message in response to a determination that the given number of packets of the at least one packet of the communication has been intercepted.

14. The apparatus of claim 12, wherein the apparatus further comprises:

means providing an AID-tag in the at least one packet of the communication, the AID-tag indicating the presence of the AID.

15. The apparatus of claim 12, wherein the apparatus further comprises:

means for providing an AID-tag in the at least one packet of the communication, wherein the AID-tag indicates the presence of the AID, and wherein the AID-tag is located in the protocol field of the Network Layer 3.

16. An apparatus for consolidating at least one packet of a communication between a subject and an associate, the apparatus comprising:

means for receiving at least one packet of the communication, each packet comprising communication associated information (CAI);

providing an application identifier (AID) in the at least one packet of the communication, the AID identifying the format of the CAI, wherein the AID is located in an optional field of Network Layer 3;

extracting in accordance with the AID the CAI from the at least one packet for reporting;

means for determining whether a packet is a new instance of CAI;

means for reporting to an LEA the CAI in response to a determination that the packet is the new instance of CAI;

means for determining whether a predetermined amount of time has elapsed between packets of the at least one packet;

means for reporting a timeout indication to an LEA in response to a determination that the predetermined amount of time has elapsed; and

means for reporting to an LEA the CAI periodically in response to a determination that the packet is a subsequent packet.

17. The apparatus of claim 16, wherein the apparatus further comprises:

means for determining whether a given number of packets of the at least one packet of the communication has been intercepted, the packets being identified by the CAI; and

means for reporting an intermediate CAI message in response to a determination that the given number of packets of the at least one packet of the communication has been intercepted.

18. The apparatus of claim 16, wherein the apparatus further comprises:

means providing an AID-tag in the at least one packet of the communication, the AID-tag indicating the presence of the AID.

19. The apparatus of claim 16, wherein the apparatus further comprises:

means for providing an AID-tag in the at least one packet of the communication, wherein the AID-tag indicates the presence of the AID, and wherein the AID-tag is located in the protocol field of the Network Layer 3.