Interception method and system

• US 7,302,702 B2
• Filed: 07/10/2001
• Issued: 11/27/2007
• Est. Priority Date: 01/14/1999
• Status: Expired due to Term

• Current Assignee: Nokia Networks Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Hippelainen, Lassi
• Primary Examiner(s): Vu; Kim
• Assistant Examiner(s): GYORFI, THOMAS A
• Application Number:
  US09/901,814
• Publication Number:
  US 20020078384A1
• Time in Patent Office: 2,331 Days
• Field of Search: 713/201, 713/200, 713/160, 380247-280, 455/405, 455/410, 726 1- 36
• US Class Current: 726/13
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04M 2207/18 wireless networks
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04W 84/04 Large scale networks; Deep hierarchical networks

Abstract

An interception method and system for performing a lawful interception in a packet network such as the GPRS or UMTS network is described. A first network element having an intercepting function for intercepting data packets is provided, said interception function being controlled by an interception control means implemented in a second network element, wherein an intercepted data packet is transmitted from the first network element via the packet network to an interception gateway element providing an interface to a intercepting authority. The intercepted data packet is transmitted via a secure tunnel provided by an encryption processing. The interception control means and the interception gateway element may both be integrated in the second network element. The interception system has a clear advantage in scalability, no single point of failure, and an adaptation to different authority interfaces can be implemented only in the interception gateway. The network elements can be similar to a high extent for all different authority requirements.

Claims

1. An interception method for performing a lawful interception in a packet network, comprising:

providing a first network element having an interception function for intercepting data packets;

controlling said interception function by an interception control means implemented in a second network element; and

transmitting an intercepted data packet from said first network element via said packet network to an interception gateway element providing an interface to at least one intercepting authority, wherein said first network element generates fake packets to be transmitted with said intercepted data packets and the fake packets are transmitted from said first network element to said interception gateway element,

wherein said fake packets are transmitted at random or triggered at any passing packet, such that the total load of intercepted and fake packets transmitted to said interception gateway element is constant.

2. A method according to claim 1, wherein said interception gateway element is integrated in said second network element.

3. A method according to claim 1, wherein a header of a data packet is read by said second network element and data packets to be intercepted are duplicated.

4. A method according to claim 1, wherein said intercepted data packet is transmitted to said interception gateway element using a secure tunnel.

5. A method according to claim 4, wherein said secure tunnel is implemented by an encryption processing.

6. A method according to claim 1, wherein said intercepted data packet is transmitted via interworking units and encrypted between said interworking units, when said first network element and said interception gateway element are arranged in separate network segments.

7. A method according to claim 1, wherein said first network element is provided in each network segment of said packet network.

8. A method according to claim 1, wherein received intercepted data packets are collected in said interception gateway element and supplied to an interface of said at least one intercepting authority.

9. A method according to claim 8, wherein said interface comprises a first interface for administrative tasks, a second interface for network signaling, and a third interface for intercepted user data.

10. A method according to claim 1, wherein said intercepting function comprises a packet sniffing and filtering function.

11. A method according to claim 10, wherein said intercepting function is implemented in a Gn interface.

12. A method according to claim 1, wherein said interception function comprises reading data packets, analyzing the header of the data packets as to whether the data packet should be intercepted or not, and transmitting the data packet to said interception gateway element, and a management function for interception and transmission criteria.

13. A method according to claim 1, wherein an alarm is transmitted to said interception gateway element and all interception information of a respective network element is deleted, when a breakage of a casing of the respective network element has been detected.

14. A method according to claim 1, wherein said intercepted data packet is padded to a maximum length.

15. A method according to claim 1, wherein a time information is added to said intercepted data packet.

16. An interception system comprising:

a first network element having an interception function to intercept data packets and comprising a transmitting unit configured to transmit an intercepted data packet to said packet network;

an interception control unit implemented in a second network element and configured to control the interception function; and

an interception gateway element having a receiving unit configured to receive said intercepted data packet and an interface unit configured to provide an interface to at least one intercepting authority,

wherein said first network element further comprises a generating unit configured to generate fake packets to be transmitted with said intercepted data packets, and

wherein said transmitting unit is further configured to transmit said fake packets at random or triggered at any passing packet, such that the total load of intercepted and fake packets transmitted to said interception gateway element is constant,

wherein the interception system is configured to perform a lawful interception in a packet network.

17. A system according to claim 16, wherein said second network element corresponds to said interception gateway element.

18. A system according to claim 16, wherein said first network element further comprises an encrypting unit configured to encrypt said intercepted data packet.

19. A system according to claim 16, wherein said first network element comprises a reading unit configured to read a header of a received data packet and for duplicating a data packet to be intercepted.

20. A system according to claim 19, wherein said reading unit means is configured to pad said copied data packet to a maximum length.

21. A system according to claim 16, wherein said first network element is a gateway element of said packet network.

22. A system according to claim 21, wherein an interception information defining a data packet to be intercepted is included in a context information supplied to said first network element and used for routing data packets.

23. A system according to claim 22, wherein said interception control unit further comprises a storing unit configured to store an interception list, and wherein said interception control unit is configured to add said interception information to said context information supplied to said first network element.

24. A system according to claim 16, wherein said first network element is a border gateway, an serving GPRS support node or a gateway GPRS support node.

25. A system according to claim 16, wherein said first network element is configured in each segment of said packet network.

26. A system according to claim 16, wherein said first network element comprises a control unit configured to control interception and encryption processing in accordance with an interception setting instruction received from said interception control means.

27. A system according to claim 16, wherein said first network element comprises a detecting unit configured to detect a malfunction and/or breakage thereof, and signaling unit configured to signal an alarm to said interception gateway element in response to an output of said detecting unit.

28. An interception system comprising:

a first network element having an interception function for intercepting data packets and comprising a transmitting unit configured to transmit an intercepted data packet to said packet network;

an interception control unit implemented in a second network element and further configured to control the interception function; and

an interception gateway element having a receiving unit configured to receive said intercepted data packet and an interface unit configured to provide an interface to at least one intercepting authority, wherein said interception gateway element comprises a memory unit configured to store received intercepted data packets before supplying them to said interface unit,

wherein said interception gateway element comprises a decryption unit configured to remove an encryption of the received intercepted data packets, an extraction unit configured to extract intercepted data packets from fake data packets, and an adding unit configured to add a time information to said received intercepted data packets before storing them in said memory unit, and

wherein said transmitting unit is further configured to transmit said fake packets at random or triggered at any passing packet, such that the total load of intercepted and fake packets transmitted to said interception gateway element is constant,

wherein the interception system is configured to perform a lawful interception in the packet network.

29. A network element for a packet network, comprising:

an interception unit configured to intercept a data packet received from said packet network, and

a transmitting unit configured to transmit said intercepted data packet via said packet network to an interception gateway element,

wherein said interception unit is controlled by an interception control unit configured in another network element, and said network element further comprises a generating unit configured to generate fake packets to be transmitted with said intercepted data packets and the fake packets are transmitted from said network element to said interception gateway element, and

wherein said fake packets are transmitted at random or triggered at any passing packet, such that the total load of intercepted and fake packets transmitted to said interception gateway element is constant.

30. An interception gateway element for an interception system of a packet network, comprising:

a receiving unit configured to receive an intercepted data packet via said packet network from a network element having an interception function;

an interface unit configured to provide an interface to an intercepting authority;

a memory unit configured to store received intercepted data packets before supplying them to said interface unit wherein said interception gateway element comprises a decryption unit configured to remove an encryption of the received intercepted data packets, an extraction unit configured to extract intercepted data packets from fake data packets and an adding unit configured to add a time information to said received intercepted data packets before storing them in said memory,

wherein said receiving unit is further configured to receive said fake packets transmitted at random or triggered at any passing packet, such that the total load of intercepted and fake packets received by said interception gateway element is constant.

31. An interception gateway element according to claim 30, further comprising an interception control unit configured to control said interception function of said network element.