Lawful intercept trigger support within service provider networks

• US 8,548,132 B1
• Filed: 01/28/2010
• Issued: 10/01/2013
• Est. Priority Date: 03/16/2006
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Zielinski, Margaret, Raison, Paul
• Primary Examiner(s): WOO, STELLA L
• Application Number:
  US12/695,845
• Time in Patent Office: 1,342 Days
• Field of Search: 379/93.02, 379/90.01, 379/35, 370/352
• US Class Current: 379/93.02
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 50/18 Legal services
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 7/006 Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42

Abstract

The invention is directed to techniques for initiating lawful intercept of packets associated with subscriber sessions on a network device of a service provider network based on identification triggers. A law enforcement agency may send an intercept request for a subscriber to an administration device of the service provider network. The administration device may then configure one or more identification triggers for the subscriber based on the intercept request. The techniques described herein initiate lawful intercept when one or more subscriber sessions on a network device match the one or more identification triggers. The techniques described herein include configuring trigger rules that include identification triggers for subscribers on a network device via a command line interface (CLI) of the network device. In addition, the techniques described herein include configuring identification triggers in a subscriber profile on an authentication device connected to a network device.

Claims

1. A method comprising:

receiving a first mirroring configuration for a subscriber from a command line interface (CLI) of a network device;

receiving a second mirroring configuration for the subscriber from an authentication device connected to the network device; and

applying one of the first and second mirroring configurations to a subscriber session on the network device based on when the first and second mirroring configurations are received.

2. The method of claim 1, further comprising applying the second mirroring configuration from the authentication device to the subscriber session on the network device when both of the first and second mirroring configurations are received at establishment of the subscriber session.

3. The method of claim 1, further comprising applying the more recently received one of the first and second mirroring configurations to the subscriber session when at least one of the first and second mirroring configurations is received after establishment of the subscriber session.

4. The method of claim 1, wherein receiving the first mirroring configuration comprises receiving a trigger rule from the CLI of the network device that matches the subscriber session.

5. The method of claim 1, wherein receiving the second mirroring configuration comprises receiving an intercept message for the subscriber from the authentication device that includes an identification trigger that matches the subscriber session.

6. A network device comprising:

a command line interface (CLI) that receives a first mirroring configuration for a subscriber;

an authentication module that receives a second mirroring configuration for the subscriber from an authentication device connected to the network device; and

an intercept module that applies one of the first and second mirroring configurations to a subscriber session on the network device based on when the first and second mirroring configurations are received.

7. The network device of claim 6, wherein the intercept module applies the second mirroring configuration from the authentication device to the subscriber session on the network device when both of the first and second mirroring configurations are received at establishment of the subscriber session.

8. The network device of claim 6, wherein the intercept module applies the more recently received one of the first and second mirroring configurations to the subscriber session when at least one of the first and second mirroring configurations is received after establishment of the subscriber session.

9. The network device of claim 6, wherein the first mirroring configuration comprises a trigger rule from the CLI of the network device that matches the subscriber session.

10. The network device of claim 6, wherein the second mirroring configuration comprises an intercept message for the subscriber from the authentication device that includes an identification trigger that matches the subscriber session.

11. A non-transitory computer-readable medium comprising instructions causing a processor to:

receive a first mirroring configuration for a subscriber from a command line interface (CLI) of a network device;

receive a second mirroring configuration for the subscriber from an authentication device connected to the network device; and

apply one of the first and second mirroring configurations to a subscriber session on the network device based on when the first and second mirroring configurations are received.

12. The non-transitory computer-readable medium of claim 11, further comprising instructions causing the processor to apply the second mirroring configuration from the authentication device to the subscriber session on the network device when both of the first and second mirroring configurations are received at establishment of the subscriber session.

13. The non-transitory computer-readable medium of claim 11, further comprising instructions causing the processor to apply the more recently received one of the first and second mirroring configurations to the subscriber session when at least one of the first and second mirroring configurations is received after establishment of the subscriber session.

14. The non-transitory computer-readable medium of claim 11, wherein the instructions to receive the first mirroring configuration comprise instructions to receive a trigger rule from the CLI of the network device that matches the subscriber session.

15. The non-transitory computer-readable medium of claim 11, wherein the instructions to receive the second mirroring configuration comprise instructions to receive an intercept message for the subscriber from the authentication device that includes an identification trigger that matches the subscriber session.