Method and apparatus for lawful interception of web based messaging communication

• US 7,631,046 B2
• Filed: 10/26/2006
• Issued: 12/08/2009
• Est. Priority Date: 10/26/2006
• Status: Active Grant

• Current Assignee: Cyberbit Ltd.
• Original Assignee: Nice Systems Limited (Nice Ltd)
• Inventors: Litvin, Daphna, Weinberg, Adam
• Primary Examiner(s): Caldwell; Andrew
• Assistant Examiner(s): RECEK, JASON D
• Application Number:
  US11/553,096
• Publication Number:
  US 20080148397A1
• Time in Patent Office: 1,139 Days
• Field of Search: 709/206, 726/22, 706/45
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications

Abstract

A method and apparatus for web based mail lawful interception. The method and apparatus enable the detection and automatic analysis of web based mail interactions out of all intercepted web pages. The method and apparatus use and possibly generate scripts for identifying a web page as comprising a web mail message, and scripts for analyzing the web mail messages.

Claims

1. A method for the interception and analysis of an at least one web based messaging communication, the method comprising the steps of:

receiving an at least one detection scheme, the detection scheme used for determining a probability that a web site associated with an at least one HTTP content item provides web based mail services, and that the at least one HTTP content item represents a web based messaging communication having a proprietary format; and

receiving an at least one analysis scheme, the analysis scheme used for parsing the at least one HTTP content item representing the web based messaging communication.

2. The method of claim 1 wherein the at least one HTTP content item is a web page.

3. The method of claim 1 wherein the at least one HTTP content item is an uploaded parameter.

4. The method of claim 1 wherein the at least one web based messaging communication is a saved draft.

5. The method of claim 1 wherein the at least one web based messaging communication is a retrieved draft.

6. The method of claim 1 wherein the at least one web based messaging communication is sent.

7. The method of claim 1 wherein the at least one web based messaging communication is received.

8. The method of claim 1 further comprising a step of automatically generating the at least one detection scheme.

9. The method of claim 1 further comprising a step of automatically generating the at least one analysis scheme.

10. The method of claim 1 wherein the at least one detection scheme is a detection script.

11. The method of claim 1 wherein the at least one detection scheme is a detection configuration file.

12. The method of claim 1 wherein the at least one analysis scheme is an analysis script.

13. The method of claim 1 wherein the at least one analysis scheme is an analysis configuration file.

14. The method of claim 1 wherein the at least one detection scheme comprises an at least one rule for identifying an address as associated with the at least one web based messaging communication.

15. The method of claim 14 wherein the address is a Uniform Resource Locator.

16. The method of claim 14 wherein the address is a host name.

17. The method claim 14 wherein the address is an IP address.

18. The method of claim 1 wherein the at least one analysis scheme contains an association of an at least one part of an at least one HTTP message representing a web based messaging communication with an at least one string.

19. The method of claim 18 wherein the at least one part of the at least one HTTP message relates to one or more of the group consisting of:

a “

TO”

field, a “

FROM”

field, a “

SUBJECT”

field, a “

CC”

field, a “

BCC”

field, a “

NICKNAME”

field, a “

USERID”

field, a “

ATTACHMENT”

field, and a “

BUDDIES”

field.

20. The method of claim 1 further comprising the step of intercepting an at least one part of an at least one web based messaging communication.

21. The method of claim 1 further comprising the step of detecting according to the at least one detection scheme whether an at least one web page represents a web based messaging communication.

22. The method of claim 1 further comprising the step of detecting according to the at least one detection scheme whether an at least one uploaded parameter represents a web based messaging communication.

23. The method of claim 1 further comprising the step of parsing an at least one part of an at least one web based messaging communication according to the at least one analysis scheme.

24. The method of claim 1 further comprising a step of extracting an association of a unique user ID with a nick name.

25. The method of claim 24 wherein the unique user ID is an e-mail address.

26. The method of claim 1 further comprising a step of emulating a server for presenting the at least one web based messaging communication.

27. The method of claim 1 further comprising a step of intercepting an at least one detail selected from the group consisting of:

user name, login name, and password.

28. The method of claim 1 further comprising a step of denoting an at least one parameter as an indication for aggregation of at least two components of the at least one web based messaging communication.

29. The method of claim 1 wherein the HTTP content item is a HTTP e-mail message.

30. An apparatus for interception and analysis of an at least one web based messaging communication, the apparatus comprising:

an at least one address list repository;

an at least one web based messaging communication detection scheme repository for storing an at least one web based messaging communication detection scheme, the web based messaging communication detection scheme used for determining a probability that a web site associated with an at least one HTTP content item provides web based mail services, and that the at least one HTTP content item represents a web based messaging communication having a proprietary format;

a web based messaging communication detection engine for applying the web based messaging communication detection scheme,

an at least one web based messaging communication analysis repository for storing at least one web based messaging communication parsing scheme, the web based messaging communication analysis scheme used for parsing the at least one HTTP content item representing a web based messaging communication having a proprietary format; and

an at least one web based messaging communication analysis engine for activating the at least one web based messaging communication analysis scheme or pattern.

31. The apparatus of claim 30 wherein the at least one web based messaging communication is a saved draft.

32. The apparatus of claim 30 wherein the at least one web based messaging communication is a retrieved draft.

33. The apparatus of claim 30 wherein the at least one web based messaging communication is sent.

34. The apparatus of claim 30 wherein the at least one web based messaging communication is received.

35. The apparatus of claim 30 wherein the at least one address list repository stores an at least one Uniform Resource Locator.

36. The apparatus of claim 30 wherein the at least one address list repository stores an at least one host name.

37. The apparatus of claim 30 wherein the at least one address list repository stores an at least one IP address.

38. The apparatus of claim 30 wherein the at least one web based messaging communication detection scheme is a script.

39. The apparatus of claim 30 wherein the at least one web based messaging communication detection scheme is a configuration file.

40. The apparatus of claim 30 wherein the at least one web based messaging communication analysis scheme is a script.

41. The apparatus of claim 30 wherein the at least one web based messaging communication analysis scheme is a configuration file.

42. The apparatus of claim 30 further comprising a component for automatically generating an at least one web based messaging communication detection scheme.

43. The apparatus of claim 30 further comprising a component for automatically generating an at least one web based messaging communication analysis scheme.

44. The apparatus of claim 30 wherein the web based messaging communication is web mail.

45. The apparatus of claim 30 wherein the web based messaging communication is instant messaging.

46. The apparatus of claim 30 wherein the web based messaging communication is news group messaging.

47. The apparatus of claim 30 wherein the HTTP content item is a HTTP e-mail message.

48. A computer readable storage medium containing a set of instructions for a general purpose computer, the set of instructions comprising:

receiving an at least one detection scheme, the detection scheme used for determining a probability that a web site associated with an at least one HTTP content item provides web based mail services, and that the at least one HTTP content item represents a web based messaging communication having a proprietary format; and

receiving an at least one parsing scheme, the analysis scheme used for parsing the at least one HTTP content item representing the web based messaging communication.