Method and system for lawful interception of packet switched network services

• US 7,447,909 B2
• Filed: 06/05/2003
• Issued: 11/04/2008
• Est. Priority Date: 06/05/2003
• Status: Expired due to Fees

• Current Assignee: RPX Clearinghouse LLC (RPX Corporation)
• Original Assignee: Nortel Networks Limited (Nortel Networks Corporation)
• Inventors: Reith, Lothar
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US10/455,557
• Publication Number:
  US 20040255126A1
• Time in Patent Office: 1,979 Days
• Field of Search: 713/153, 713/183, 726/3, 726 13- 14, 726/22, 726/26, 709/225
• US Class Current: 713/183
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281

Abstract

A method for lawful interception of packet switched network services, comprising the steps of:

• • when a user accesses the network and is identified by a target-ID at a primary interception point of the network, sending the target-ID to an interception management center,
  • checking at the interception management center whether the user is a lawful interception target and sending an encrypted interception instruction set to a secondary interception point,
  • decrypting said interception instruction set at the secondary interception point and performing an interception process in accordance with the interception instruction set, said interception process including the transmission of encrypted interception and dummy data to a mediation device, wherein said dummy data are added for obscuring true interception traffic between the secondary interception point and the mediation device.

Claims

1. A method for lawful interception of packet switched network services, comprising the steps of:

when a user accesses the network and is identified by a target-ID at a primary interception point of the network, sending the target-ID to an interception management center,

checking at the interception management center whether the user is a lawful interception target and sending an encrypted interception instruction set to a secondary interception point,

decrypting said interception instruction set at the secondary interception point and performing an interception process in accordance with the interception instruction set, said interception process including the transmission of encrypted interception and dummy data to a mediation device, wherein said dummy data are added for obscuring true interception traffic between the secondary interception point and the mediation device, and wherein an amount of the dummy data is determined based on actual traffic load,

wherein the interception instruction set includes a conditional interception instruction, instructing a PSSP (Packet Switching Service Point) to send intercept related information or to monitor the traffic associated with the target-ID and start the interception of the complete traffic or a portion of the traffic only when a certain trigger condition occurs, said trigger condition being one of;

usage of certain network or content resources or usage of a certain catchword, virus signature or bit-pattern specified in the interception instruction set.

2. The method of claim 1, wherein said secondary interception point is identical to said primary interception point.

3. The method of claim 1, wherein the dummy data are generated at random.

4. The method of claim 1, wherein the dummy data are based on actual traffic to or from the user, but the actual traffic is scrambled such that, even after decryption, the contents thereof may not be reconstructed at the mediation device.

5. The method of claim 1, comprising a step of sending a continuous stream of camouflage packets from the secondary interception point to the mediation device, said camouflage packets including intercepted data in accordance with demand and being filled up with dummy data to their full length.

6. A system for lawful interception of packet-switched network services in a network, comprising:

at least one interception point formed by a node in the network,

an interception management center, and

a mediation device serving as an interface between the network and a law enforcement agency for which interception services are provisioned,

wherein said at least one interception point is adapted to send a target-ID of a user accessing the network to said interception management center,

the interception management center is adapted to send to the at least one interception point an encrypted interception instruction set to be decrypted at the interception point and enabling the interception point to perform an interception process in the course of which intercepted data are encrypted and sent to said mediation device, and

the at least one interception point is further adapted to generate dummy data and to encrypt and send either the intercepted data or the dummy data or a combination of these, such that the occurrence of intercepted data is obscured,

wherein said interception management center contains means for communicating with said node according to a RADIUS protocol, and means for acting as a RADIUS proxy server.

7. The system of claim 6, wherein the at least one interception point is formed by the node of the network that is situated at a subscriber edge of the network, where end users connect to the network.

8. The system of claim 6, wherein the interception point is a switch adapted to connect end users to an IP or Ethernet network.

9. The system of claim 7, wherein the interception point is a switch adapted to connect end users to an IP or Ethernet network.

10. The system of claim 6, comprising a plurality of interception points connected to the same interception management center.

11. A system for lawful interception of packet-switched network services in a network, comprising:

at least one interception point formed by a node in the network,

an interception management center, and

a mediation device serving as an interface between the network and a law enforcement agency for which interception services are provisioned,

wherein said at least one interception point is adapted to send a target-ID of a user accessing the network to said interception management center,

the interception management center is adapted to send to the at least one interception point an encrypted interception instruction set to be decrypted at the interception point and enabling the interception point to perform an interception process in the course of which intercepted data are encrypted and sent to said mediation device, and

the at least one interception point is further adapted to generate dummy data and to encrypt and send either the intercepted data or the dummy data or a combination of these, such that the occurrence of intercepted data is obscured,

wherein said interception management center is combined with a RADIUS server.

12. A node to perform lawful interception of data in a network, comprising:

an intercept function comprising hardware and software to;

send an interception instruction request including a target-ID to a mediation point;

receive an encrypted lawful interception instruction set responsive to the interception instruction request from the mediation point, the encrypted lawful interception instruction set specifying instructions regarding interception of data; and

according to the instructions of the encrypted lawful intercept instruction set, intercept data communicated in the network,

wherein the encrypted lawful interception instruction set is received from an interception management center of the mediation point, and wherein the intercept function is configured to send the intercepted data to a mediation device in the mediation point, the mediation device serving as an interface between the network and a law enforcement agency.

13. The node of claim 12, wherein the intercept function is configured to send the target-ID to a RADIUS server to trigger an authentication procedure.

14. The node of claim 12, wherein the intercept function is configured to add dummy data to the intercepted data to obscure the interception data between the intercept module and the mediation point, and wherein an amount of the dummy data is dynamically determined based on actual load traffic.

15. The node of claim 12, wherein sending of the interception instruction request by the intercept module is triggered by a log-on event by a user.