Method and apparatus for surveillance of voice over internet protocol communications

• US 7,570,743 B2
• Filed: 04/30/2004
• Issued: 08/04/2009
• Est. Priority Date: 04/30/2004
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Alcatel-Lucent USA, Inc. (Nokia Corporation)
• Inventors: Benco, David S., Mahajan, Sanjeev, Ruggerio, Raymond Leroy, McRoberts, Thomas Lee, Barclay, Deborah Lewandowski
• Primary Examiner(s): Anwah; Olisa
• Application Number:
  US10/837,088
• Publication Number:
  US 20050243802A1
• Time in Patent Office: 1,922 Days
• Field of Search: 370/352, 370/235, 709/224, 379/35, 379/32.01, 379/32.04, 379/133, 379/134
• US Class Current: 379/35
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 7/006 Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42
• CPC Class Codes: H04M 7/1255 where the switching fabric and the switching logic are decomposed such as in Media Gateway Control
• CPC Class Codes: H04M 7/126 Interworking of session control protocols
• CPC Class Codes: H04M 7/128 Details of addressing, directories or routing tables

Abstract

A method and apparatus for surveillance of voice over Internet protocol (VoIP) communications is provided. A server (112) associated with a network provider receives information to identify communications associated with a party under surveillance (200). The server uses the information to direct communications associated with the party under surveillance to a surveillance server (130) (202). The communications are analyzed to identify any initial VoIP data (204). If initial VoIP data is detected, identifiers for subsequent related VoIP communications are determined from the initial VoIP data (206). The identifiers for subsequent VoIP communications are used to identify subsequent VoIP packets. Those subsequent VoIP packets are then stored and analyzed as needed by an agency conducting surveillance.

Claims

1. A method for surveillance of voice over Internet protocol communications for a party, the method using a first server that provides Internet access to the party, the method comprising the steps of:

the first server receiving an identification of the party for which surveillance is sought;

the first server determining whether a network communication received by the server is from or directed to the party;

a second server receiving the network communication if the network communication is determined to be from or directed to the party;

the second server analyzing whether the network communication that is determined to be from or directed to the party is a voice over Internet protocol communication; and

if the network communication is a voice over Internet protocol communication, then the second server sending the network communication and all subsequent related network communications to a surveillance server.

2. The method of claim 1 wherein the step of analyzing whether the network communication is a voice over Internet protocol communication further comprises the steps of:

determining whether the network communication conforms to a voice over Internet protocol;

if the network communication conforms to a voice over Internet protocol, then determining whether the network communication includes a call setup stage for the voice over Internet protocol;

if the network communication includes the call setup stage, then storing a first identifier that identifies subsequent network communications associated with the network communication.

3. The method of claim 2 further comprising the step of:

if the network communication includes the call setup stage, then receiving a response to the call setup stage, the response being identified in part by the first identifier; and

storing a second identifier included in the response.

4. The method of claim 3 wherein the step of sending the network communication and all subsequent related network communications to the surveillance server further includes the steps of:

determining whether any further network communications from or directed to the party include the first identifier or second identifier; and

sending further network communications with the first identifier or the second identifier to the surveillance server.

5. The method of claim 4 wherein the first identifier includes an IP address and a port number.

6. The method of claim 5 wherein the first identifier includes a unique session identifier.

7. The method of claim 6 wherein the second identifier includes an IP address and a port number.

8. The method of claim 1 wherein the first server and the second server are a same server.

9. The method of claim 2 wherein the call setup stage includes one of a SIP INVITE request and an H.323 setup request.

10. A server for surveillance of voice over Internet protocol communications for a party, the server providing Internet access to the party, the server comprising:

a processor that;

receives an identification of the party for which surveillance is sought;

determines a computer identity of the party for which surveillance is sought;

determines whether a network communication received by the server is from or directed to the party;

if the network communication received by the server is from or direct to the party, analyzes whether the network communication is a voice over Internet protocol communication; and

if the network communication is a voice over Internet protocol communication, then sends the network communication and subsequent related network communications to a surveillance server.

11. The server of claim 10 wherein when the processor analyzes whether the network communication is a voice over Internet protocol communication, the processor:

determines whether the network communication conforms to a voice over Internet protocol;

if the network communication conforms to a voice over Internet protocol, then determines whether the network communication includes a call setup stage for the voice over Internet protocol; and

if the network communication includes the call setup stage, then stores a first identifier that identifies subsequent network communications associated with the network communication.

12. The server of claim 11 wherein the processor:

if the network communication includes the call setup stage, then receives a response to the call setup stage, the response being identified in part by the first identifier; and

stores a second identifier included in the response.

13. The method of claim 12 wherein when the processor sends the network communication and subsequent related network communications to the surveillance server, the processor:

determines whether any further network communications from or directed to the party include the first identifier or second identifier; and

sends further network communications with the first identifier or the second identifier to the surveillance server.

14. The server of claim 13 wherein the first identifier includes an IP address and a port number.

15. The server of claim 14 wherein the first identifier includes a unique session identifier.

16. The method of claim 15 wherein the second identifier includes an IP address and a port number.

17. The method of claim 11 wherein the call setup stage includes one of a SIP INVITE request and an H.323 setup request.