Intercepting GPRS data

• US 8,472,384 B2
• Filed: 11/30/2010
• Issued: 06/25/2013
• Est. Priority Date: 09/10/2004
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Shu, Jesse C., Zhang, Chaohui
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): Hsiung, Hai-Chang
• Application Number:
  US12/956,800
• Publication Number:
  US 20110069663A1
• Time in Patent Office: 938 Days
• Field of Search: 370/328
• US Class Current: 370/328
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04W 12/80 Arrangements enabling lawful interception [LI]
• CPC Class Codes: H04W 76/22 Manipulation of transport tunnels
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

GPRS Tunneling Protocol (“GTP”) packets are intercepted by receiving a GTP tunnel packet, determining whether the GTP tunnel packet is to be intercepted, intercepting GTP tunnel packets if it is determined that the GTP tunnel packet is to be intercepted, and processing the intercepted GTP tunnel packets. Multiple tunnels may be intercepted simultaneously and GTP tunnel packets from different tunnels may be processed differently. Implementations include both inline and offline interception of GTP traffic between SGSN and GGSN.

Claims

1. A method comprising:

receiving, by a network device, a first general packet radio service (GPRS) tunneling protocol (GTP) tunnel packet that includes tunnel identification information corresponding to a GTP tunnel;

determining, by the network device, that the tunnel identification information of the first GTP tunnel packet matches information in a list of interception identifiers;

intercepting, by the network device, the first GTP tunnel packet after determining that the tunnel identification information of the first GTP tunnel packet matches the information in the list of interception identifiers;

tracking, by the network device, a start time for the GTP tunnel based on a time of receiving the first GTP tunnel packet;

transmitting, by the network device, the first GTP tunnel packet to an endpoint of the GTP tunnel; and

tracking, by the network device, a stop time for the GTP tunnel based on a time of transmitting a final GTP tunnel packet to the endpoint of the GTP tunnel,

the first GTP tunnel packet being the final GTP tunnel packet until the network device receives a second GTP tunnel packet, and

the second GTP tunnel packet being the final GTP tunnel packet after the network device transmit the second GTP tunnel packet and until the network device receives a third GTP tunnel packet.

2. The method of claim 1, further comprising:

receiving a particular GTP tunnel packet that includes particular tunnel identification information corresponding to a particular GTP tunnel that is different from the GTP tunnel;

determining that the particular tunnel identification information of the particular GTP tunnel packet does not match any information in the list of interception identifiers; and

transmitting the particular GTP tunnel packet to an endpoint of the particular GTP tunnel, without interference, after determining that the particular tunnel identification information does not match any information in the list of interception identifiers.

3. The method of claim 1, where receiving the first GTP tunnel packet comprises:

determining to allow the first GTP tunnel packet to pass through the GTP tunnel based on an access control policy of a GTP firewall,

the GTP tunnel passing through the GTP firewall, and

receiving the first GTP tunnel packet after determining to allow the first GTP tunnel packet to pass through the GTP tunnel.

4. The method of claim 1, further comprising:

encapsulating a packet, at an entrance of the GTP tunnel, into the first GTP tunnel packet.

5. The method of claim 1, further comprising:

de-encapsulating the first GTP tunnel packet into a packet after intercepting the first GTP tunnel packet; and

recording the packet.

6. The method of claim 1,

where the list of interception identifiers further comprises processing instructions, and

where the method further comprises:

processing, after intercepting the first GTP tunnel packet, the first GTP tunnel packet based on the processing instructions.

7. The method of claim 1, further comprising:

determining whether a quantity of GTP tunnel packets that have passed through the GTP tunnel is equal to or greater than a particular threshold; and

recording the first GTP tunnel packet when the quantity of GTP tunnel packets that have passed through the GTP tunnel is less than the particular threshold.

8. The method of claim 1, further comprising:

processing the first GTP tunnel packet before transmitting the first GTP tunnel packet to the endpoint of the GTP tunnel.

9. A method comprising:

receiving, by a network device, a first general packet radio service (GPRS) tunneling protocol (GTP) tunnel packet that includes tunnel identification information corresponding to a GTP tunnel;

determining, by the network device, that the tunnel identification information of the first GTP tunnel packet matches information in an entry of a list of interception identifiers;

intercepting, by the network device, the first GTP tunnel packet after determining that the tunnel identification information of the first GTP tunnel packet matches the information in the entry of the list of interception identifiers;

tracking, by the network device and after intercepting the first GTP tunnel packet, a start time for the GTP tunnel based on a time of receiving the first GTP tunnel packet; and

tracking, by the network device, a stop time for the GTP tunnel based on a time of transmitting a final GTP tunnel packet associated with the GTP tunnel,

the first GTP tunnel packet being the final GTP tunnel packet until receiving a second GTP tunnel packet, and

the second GTP tunnel packet being the final GTP tunnel packet after receiving the second GTP tunnel packet and until receiving a third GTP tunnel packet.

10. The method of claim 9, further comprising:

receiving the second GTP tunnel packet,

the second GTP tunnel packet including the tunnel identification information;

determining that the tunnel identification information of the second GTP tunnel packet matches the information in the entry of the list of interception identifiers; and

intercepting the second GTP tunnel packet after determining that the tunnel identification information of the second GTP tunnel packet matches the information in the list of interception identifiers and after intercepting the first GTP tunnel packet.

11. The method of claim 9,

where the entry further comprises processing instructions,

where the method further comprises:

processing the first GTP tunnel packet based on the processing instructions.

12. The method of claim 9, further comprising:

processing the first GTP tunnel packet by at least one of logging information regarding the first GTP tunnel packet or transmitting the first GTP tunnel packet to an external location for analysis.

13. The method of claim 9, further comprising:

tracking a quantity of packets transmitted through the GTP tunnel.

14. The method of claim 9, further comprising:

determining that an amount of recorded data is less than a particular threshold; and

recording data of the first GTP tunnel packet after determining that the amount of recorded data recorded is less than the particular threshold.

15. The method of claim 9, further comprising:

processing the first GTP tunnel packet by creating a log entry corresponding to the first GTP tunnel packet, and

providing an external interface to view the log entry corresponding to the first GTP tunnel packet.

16. A system comprising:

a device to;

receive a first general packet radio service (GPRS) tunneling protocol (GTP) tunnel packet that includes tunnel identification information corresponding to a GTP tunnel,

determine that the tunnel identification information of the first GTP tunnel packet matches an entry in a list of interception identifiers,

intercept the first GTP tunnel packet after determining that the tunnel identification information matches the entry,

track a start time for the GTP tunnel based on a time of receiving the first GTP tunnel packet, and

track a stop time for the GTP tunnel based on a time of transmitting a final GTP tunnel packet associated with the GTP tunnel,

the first GTP tunnel packet being the final GTP tunnel packet until receiving a second GTP tunnel packet, and

the second GTP tunnel packet being the final GTP tunnel packet after receiving the second GTP tunnel packet and until receiving a third GTP tunnel packet.

17. The system of claim 16, where the device is further to:

receive a particular GTP tunnel packet that includes particular tunnel identification information corresponding to a particular GTP tunnel that is different from the GTP tunnel,

determine that the particular tunnel identification information of the particular GTP tunnel packet does not match any entry in the list of interception identifiers, and

forward the particular GTP tunnel packet to a serving GPRS support node or a gateway GPRS support node, without interception, after determining that the particular tunnel identification information does not match any entry in the list of interception identifiers.

18. The system of claim 16, where the device is further to:

receive a request to create the GTP tunnel,

create the GTP tunnel based on the request, and

update the list of interception identifiers to include the tunnel identification information that corresponds to the GTP tunnel in the entry of the list of interception identifiers.

19. The system of claim 16, where the device is positioned between a serving GPRS support node and a gateway GPRS support node, between the serving GPRS support node and the firewall, or between the gateway GPRS support node and the firewall.

20. The system of claim 16,

where the entry is associated with processing instructions, and

where the device is further to:

process the first GTP tunnel packet based on the processing instructions after intercepting the first GTP tunnel packet, and

transmit the first GTP tunnel packet to an endpoint of the GTP tunnel after processing the first GTP tunnel packet.