System for accessing a set of communication and transaction data associated with a user of interest sourced from multiple different network carriers and for enabling multiple analysts to independently and confidentially access the set of communication and transaction data

• US 9,058,323 B2
• Filed: 01/20/2012
• Issued: 06/16/2015
• Est. Priority Date: 12/30/2010
• Status: Active Grant

• Current Assignee: SS8 Networks Incorporated
• Original Assignee: SS8 Networks Incorporated
• Inventors: Le, Robert, Bean, Timothy, Huang, Henry
• Primary Examiner(s): Swearingen, Jeffrey R
• Application Number:
  US13/355,397
• Publication Number:
  US 20130191493A1
• Time in Patent Office: 1,243 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: H04L 2012/5685 Addressing issues
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/302 gathering intelligence information for situation awareness or reconnaissance
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/80 Arrangements enabling lawful interception [LI]

Abstract

A system, method, and apparatus for collecting data streams, such as data packets, on a network, such as the Internet, are disclosed. Evaluation of the metadata and the relationships can be performed algorithmically, as predetermined by an analyst or as provided as preset options by the network monitoring system (NMS). The collected data associated with the users of the network may be accessed by multiple analysts belonging to different groups having a NMS of their own. The system may allow access to multiple analysts belonging to separate groups by parsing through a single instance of the stored data. Multiple analysts belonging to different groups may allow to access to a single instance of the stored data.

Claims

1. A method comprising:

capturing data streams from multiple carriers on common data lines on a Wide Area Network (WAN) to be stored within a multi-tenant capable Network Monitoring System (NMS) configured to monitor a set of activities between users of the WAN;

receiving, at the NMS, an identification of a first analyst authorized to receive data related to a known user of interest thereto, the known user of interest being a user of the WAN whose activity is monitored through the NMS;

receiving, at the NMS, an identification of a second analyst also authorized to receive data related to the known user of interest;

receiving, at the NMS, a known user ID associated with the known user of interest configured to be monitored at an access device communicatively coupled to the WAN from the first analyst and the second analyst;

parsing, at the NMS, a data stream of the captured data streams related to the known user of interest into a common portion relevant to both the first analyst and the second analyst, a first unique portion solely relevant to the first analyst and a second unique portion solely relevant to the second analyst following the reception of the identification of the first analyst and the identification of the second analyst and the reception of the known user ID from the first analyst and the second analyst;

parsing, at the NMS, a single instance of the common portion of the data stream to simultaneously retrieve the common portion for both the first analyst and the second analyst;

retrieving, through the NMS, a first data stream related to the known user of interest based on the reception of the known user ID from the first analyst and the identification of the first analyst, the retrieving of the first data stream comprising retrieving both the first unique portion and the common portion;

retrieving, through the NMS, a second data stream related to the known user of interest based on the reception of the known user ID from the second analyst and the identification of the second analyst, the retrieving of the second data stream comprising retrieving both the second unique portion and the common portion;

transmitting the retrieved first data stream related to the known user of interest solely to the first analyst;

transmitting the retrieved second data stream related to the known user of interest solely to the second analyst; and

modularizing the NMS such that the first analyst and the second analyst are provided with a capability to scale a functionality providing the data stream related to the known user of interest as per a requirement thereof.

2. The method of claim 1, further comprising:

associating the identification of the first analyst with the data stream related to the known user of interest; and

additionally associating the identification of the second analyst with the data stream related to the known user of interest.

3. The method of claim 2, wherein the association is performed by a look up table (LUT) providing a cross-reference of the data stream related to the known user of interest and the identification of the first analyst and the identification of the second analyst.

4. The method of claim 1, further comprising:

receiving an identification of at least one analyst other than the first analyst and the second analyst, the at least one analyst also being authorized to receive the data stream related to the known user of interest.

5. The method of claim 4, wherein each of the first analyst, the second analyst and the at least one analyst is approved to receive a unique portion of the data stream related to the known user of interest.

6. The method of claim 5, comprising parsing the data stream related to the known user of interest into different portions based on a type of approval of the first analyst, the second analyst and the at least one analyst.

7. The method of claim 1, further comprising:

retrieving one of the first data stream and the second data stream at a request of a corresponding one of the first analyst and the second analyst based on an analyst ID in an LUT identifying both the first analyst and the second analyst.

8. The method of claim 1, further comprising:

storing a first metadata associated with a first analysis of the data stream related to the known user of interest performed by the first analyst in a common storage server; and

storing a second metadata associated with a second analysis of the data stream related to the known user of interest performed by the second analyst in the common storage server.

9. The method of claim 1, wherein the known user ID is based on at least one of a network ID, a requesting agency ID, a network provider ID, a name of the known user of interest, and an associated information of the known user of interest.

10. The method of claim 1, further comprising duplicating output data from the NMS to provide to the first analyst and the second analyst based on the identification thereof.

11. A multi-tenant capable NMS configured to monitor a set of activities between users of a WAN comprising:

at least one memory; and

at least one processor communicatively coupled to the at least one memory, the at least one processor being configured to execute instructions to;

capture data streams from multiple carriers on common data lines on the WAN to be stored within the at least one memory,

receive an identification of a first analyst authorized to receive data related to a known user of interest thereto, the known user of interest being a user of the WAN whose activity is monitored through the NMS,

receive an identification of a second analyst also authorized to receive data related to the known user of interest,

receive a known user ID associated with the known user of interest configured to be monitored at an access device communicatively coupled to the WAN from the first analyst and the second analyst,

parse a data stream of the captured data streams related to the known user of interest into a common portion relevant to both the first analyst and the second analyst, a first unique portion solely relevant to the first analyst and a second unique portion solely relevant to the second analyst following the reception of the identification of the first analyst and the identification of the second analyst and the reception of the known user ID from the first analyst and the second analyst,

parse a single instance of the common portion of the data stream to simultaneously retrieve the common portion for both the first analyst and the second analyst,

retrieve a first data stream related to the known user of interest based on the reception of the known user ID from the first analyst and the identification of the first analyst, the retrieving of the first data stream comprising retrieving both the first unique portion and the common portion,

retrieve a second data stream related to the known user of interest based on the reception of the known user ID from the second analyst and the identification of the second analyst, the retrieving of the second data stream comprising retrieving both the second unique portion and the common portion,

transmit the retrieved first data stream related to the known user of interest solely to the first analyst, and

transmit the retrieved second data stream related to the known user of interest solely to the second analyst,

wherein the NMS is modularized such that the first analyst and the second analyst are provided with a capability to scale a functionality providing the data stream related to the known user of interest as per a requirement thereof.

12. The NMS of claim 11, wherein the at least one processor is further configured to execute instructions to cross-reference the data stream related to the known user of interest through an LUT and perform the identification of the first analyst and the second analyst.

13. The NMS of claim 11, wherein the at least one processor is configured to execute instructions to approve each of the first analyst and the second analyst to receive unique portions of the data stream related to the known user of interest.

14. The NMS of claim 13, wherein the at least one processor is configured to enable parsing the data stream related to the known user of interest into different portions based on a type of approval of the first analyst and the second analyst.

15. A system comprising:

a WAN; and

a multi-tenant capable NMS configured to monitor a set of activities between users of the WAN through access devices thereof communicatively coupled to the WAN, the NMS further being configured to;

capture data streams from multiple carriers on common data lines on the WAN to be stored therewithin,

receive an identification of a first analyst authorized to receive data related to a known user of interest thereto, the known user of interest being a user of the WAN whose activity is monitored through the NMS,

receive an identification of a second analyst also authorized to receive data related to the known user of interest,

receive a known user ID associated with the known user of interest configured to be monitored at an access device communicatively coupled to the WAN from the first analyst and the second analyst,

parse a data stream of the captured data streams related to the known user of interest into a common portion relevant to both the first analyst and the second analyst, a first unique portion solely relevant to the first analyst and a second unique portion solely relevant to the second analyst following the reception of the identification of the first analyst and the identification of the second analyst and the reception of the known user ID from the first analyst and the second analyst,

parse a single instance of the common portion of the data stream to simultaneously retrieve the common portion for both the first analyst and the second analyst,

retrieve a first data stream related to the known user of interest based on the reception of the known user ID from the first analyst and the identification of the first analyst, the retrieving of the first data stream comprising retrieving both the first unique portion and the common portion,

retrieve a second data stream related to the known user of interest based on the reception of the known user ID from the second analyst and the identification of the second analyst, the retrieving of the second data stream comprising retrieving both the second unique portion and the common portion,

transmit the retrieved first data stream elated to thr known user of interest solely to the first analyst, and

transmit the retrieved second data stream related to the known user of interest solely to the second analyst,

wherein the NMS is modularized such that the first analyst and the second analyst are provided with a capability to scale a functionality providing the data stream related to the known user of interest as per a requirement thereof.

16. The system of claim 15, wherein the NMS is further configured to perform a cross-reference of the data stream related to the known user of interest through an LUT.

17. The system of claim 15, wherein the NMS is further configured to receive an identification of at least one analyst other than the first analyst and the second analyst, the at least one analyst also being authorized to receive the data stream related to the known user of interest,

18. The system of claim 17, wherein the NMS is further configured to approve each of the first analyst, the second analyst and the at least one analyst to receive a unique portion of the data stream related to the known user of interest.

19. The system of claim 18, wherein the NMS is configured to parse the data stream related to the known user of interest into different portions based on a type of approval of the first analyst, the second analyst and the at least one analyst.

20. The system of claim 15, wherein the NMS is configured to retrieve one of the first data stream and the second data stream in accordance with a request from a corresponding one of the first analyst and the second analyst based on an analyst ID in an LUT identifying both the first analyst and the second analyst.