Method and apparatus for intercepting events in a communication system

• US 7,680,281 B2
• Filed: 09/16/2008
• Issued: 03/16/2010
• Est. Priority Date: 10/20/2004
• Status: Expired

• Current Assignee: Seven Networks LLC (SoftBank Group Corp.)
• Original Assignee: Seven Networks Inc
• Inventors: Fiatal, Trevor, Nanjundeswaran, Sridhar, Bavadekar, Shailesh, Sutaria, Jay
• Primary Examiner(s): Moise, Emmanuel L
• Assistant Examiner(s): Abyaneh, Ali S
• Application Number:
  US12/211,790
• Publication Number:
  US 20090016526A1
• Time in Patent Office: 546 Days
• Field of Search: 726/22, 380/250, 380/255, 713/150
• US Class Current: 380/255
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

An intercept system provides more effective and more efficient compliance with legal intercept warrants. The intercept system can provide any combination of operations that include near-real-time intercept, capture of intercepted data in structured authenticated form, clear text intercept for communications where there is access to encryption keys, cipher text intercept for communications where there is no access to encryption keys, provision of transactional logs to the authorized agency, interception without altering the operation of the target services, and encryption of stored intercepted information.

Claims

1. A method for intercepting data, comprising:

receiving, at a management server, a connection from a remote client, the connection being initiated by the remote client and established outbound from the remote client;

negotiating a point-to-point encryption scheme with a remote mobile device, the point-to-point encryption scheme negotiated between the management server and the remote mobile device;

receiving, at the management server, a value identifying an intercept target for a legal intercept and an indication that interception is authorized by a warrant, the intercept target corresponding to the remote mobile device;

automatically intercepting, at the management server, data received and/or sent by the intercept target identified by the value, wherein data is intercepted without altering operation of email application services that operate on the remote mobile device;

inspecting packets having the intercepted data to distinguish end-to-end encrypted information from other information that is encrypted according to the point-to-point encryption scheme negotiated with the remote mobile device;

preserving encryption that is included on the end-to-end encrypted information when received while removing encryption that is included on at least a portion of the other information, said other information decrypted using a key obtained during the point-to-point encryption scheme negotiation; and

transferring both the decrypted other information and the end-to-end information from the management server to a remote device.

2. The method of claim 1, wherein the packets are intercepted during a requested time period, and the method further comprises:

formatting the data that is intercepted during the requested time period and associated with the target user into one or more first log files, each of the first log files corresponding to a different time segment occurring during the requested time period and indicating one or more intercept events for its corresponding time segment; and

formatting one or more second different log files associated with the requested time period, the second log files indicating inactivity and corresponding to different remaining time segments that occur during the requested time period and that are unrepresented by the first log files that indicate the intercept events such that the first and second log files record monitoring for the entire requested time period independently of whether the data is intercepted intermittently during the requested time period.

3. The method of claim 2, wherein the data is intercepted according to an intercept configuration file that includes at least a unique intercept identifier and a user ID identifying the target user.

4. The method of claim 2, wherein the log files record an unbroken sequence of continuous monitoring over the requested time period independently of whether the data is intercepted intermittently.

5. The method of claim 2, further comprising transferring the log files to the remote device.

6. The method of claim 2, further comprising formatting the log files with different time values usable for verifying that communications from the remote mobile device were continuously monitored during the requested time period regardless of whether the data was intercepted intermittently.

7. The method according to claim 1, wherein the encryption that is included on the end-to-end encrypted information uses a security association that is kept secret from the management server such that the end-to-end encrypted information is kept private with respect to employees associated with the management server.

8. The method of claim 1, further comprising determining whether to encrypt at least one of the end-to-end information and the decrypted information prior to said transferring.

9. The method according to claim 1, further comprising:

combining, at the management server, the end-to-end encrypted information of the intercepted data with the decrypted other information of the intercepted data in a same log file.

10. The method according to claim 1, further comprising:

storing, at the management server, the intercepted data in a structure format that identifies when the data was intercepted and at the same time provides authentication that the stored intercepted data has not been altered or deleted.

11. The method according to claim 10, further comprising monitoring communications between the remote client and the remote mobile device for multiple contiguous time periods.

12. The method according to claim 11, further comprising:

generating, using the management server, log files over an intercept period that encompasses the multiple contiguous time periods;

storing the log files in a same intercept directory;

inserting a warrant identifier received together with the value into the intercept directory; and

generating a name for the intercept directory that identifies the intercept target and the intercept period over which the log files were generated.

13. The method according to claim 12, further comprising:

encrypting the log files in the intercept directory with an encryption scheme known by an agency issuing the warrant, said encryption performed using the management server that intercepted the data; and

sending the encrypted intercept directory to an electronic mailbox accessible by the agency.

14. The method according to claim 13, further comprising:

generating a Cyclic Redundancy Check (CRC) or other digital signature value for all of the log files in the intercept directory;

encrypting the resulting generated value; and

providing the encrypted generated value to the enforcement agency, said encrypted generated value sent in a different communication than the encrypted intercept directory, said encrypted generated value verifying that the log files have not been altered.

15. The method according to claim 1, further comprising:

reading an intercept configuration file that contains a warrant identifier, the value identifying the user, an enforcement agency known encryption key and an electronic mailbox address;

upon reading the intercept configuration file automatically intercepting data received and/or sent by the remote mobile device;

formatting any intercepted data into log files that identify when the data was intercepted; and

encrypting the log files using the encryption key.

16. The method according to claim 1, wherein the end-to-end encrypted information is associated with content and is protected with an end-to-end encryption scheme that is kept secret from any midpoints located on a call path between transmitting and receiving endpoints, and the other information is associated with transaction routing information and is protected with the negotiated point-to-point encryption scheme.

17. A communication management system, comprising:

a management server configured to receive a connection initiated by a remote client and established outbound from the remote client;

the management server configured to negotiate a point-to-point encryption scheme with a remote mobile device, the point-to-point encryption scheme negotiated between the management server and the remote mobile device;

the management server configured to receive a value identifying an intercept target for a legal intercept and an indication that interception is authorized by a warrant, the intercept target corresponding to the remote mobile device;

the management server configured to automatically intercept data received and/or sent by the intercept target identified by the value, wherein the data is intercepted without altering operation of email application services that operate on the remote mobile device;

the management server configured to inspect packets having the intercepted data to distinguish end-to-end encrypted information from other information that is encrypted according to the point-to-point encryption scheme negotiated with the remote mobile device;

the management server configured to preserve encryption that is included on the end-to-end encrypted information when received while removing encryption that is included on at least a portion of the other information, said other information decrypted using a key obtained during the point-to-point encryption scheme negotiation; and

the management server configured to transfer both the decrypted other information and the end-to-end information from the management server to a remote device.

18. The communication management system of claim 17, further comprising:

the management server configured to automatically format the intercepted data into log files;

the management server configured to generate multiple log files that identify any intercepted data for associated contiguous predetermined time periods extending over a continuous intercept period; and

the management server configured to generate the log files for back-to-back time periods, the management server further configured to generate each log file by selecting between inserting the intercepted data and an inactivity indication therein such that each of the log files contains at least one selected from the group comprising the intercepted data for the associated time period and an indication that no data was intercepted during the associated time period.

19. The communication management system of claim 18, further comprising:

the management server is configured to select a same duration for the time periods according to selectable time interval values included in an intercept configuration file.

20. The communication management system of claim 18, further comprising:

the management server configured to encrypt the log files according to an encryption key known by an enforcement agency associated with the warrant before emailing the encrypted log files to a mailbox for the enforcement agency.

21. The communication management system of claim 18, further comprising:

the management server configured to identify a first portion of the intercepted data encrypted using a first known security association for which the management server has knowledge of the encryption key and identify a second portion of the intercepted data encrypted using a second unknown security association, the management server configured to decrypt and store the first portion of the intercepted data into an associated one of the log files and combine the encrypted second portion of the intercepted data with the decrypted first portion of the intercepted data in the same associated log file.

22. The communication management system of claim 21, wherein the first portion of the intercepted data is encrypted with a known point-to-point encryption key and the second portion of the intercepted data is encrypted with an unknown end-to-end encryption key.

23. The communication management system of claim 21, further comprising:

the management server is configured to encrypt both the decrypted first portion of the intercepted data and the second encrypted portion of the intercepted data.

24. The communication management system of claim 21, wherein the first portion of the intercepted data includes transaction authentication and routing information and the second portion of the intercepted data includes the contents of email messages, electronic files, or other electronic data.

25. The communication management system of claim 17, wherein the management server is configured to process communications exchanged between a local device operating in an enterprise or local network and a mobile wireless device that synchronizes with a portion of the data in the local device.