Method for providing a law enforcement agency with sampled content of communications

• US 9,602,551 B2
• Filed: 11/15/2012
• Issued: 03/21/2017
• Est. Priority Date: 11/15/2012
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Marfia, Francesca, Fiorillo, Lorenzo
• Primary Examiner(s): Musa, Abdelnabi O
• Application Number:
  US14/443,014
• Publication Number:
  US 20150341392A1
• Time in Patent Office: 1,587 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications

Abstract

Presented are a method and a node in a Lawful Interception (LI) network, in which the node is configured to provide a Law Enforcement Agency with Intercept Related Information (IRI) and Content of Communications (CC) of data traffic in a digital communications network. The IRI and CC are forwarded to an Intercept Mediation and Delivery unit node (IMDU) of the LI network, wherein the IMDU is configured to sample the content of communications according a certain sampling rate to achieve one or more samples of the CC, and to forward the generated one or more samples to the Law Enforcement Agency.

Claims

1. A method in an Intercept Mediation and Delivery unit (IMDU) node in a Lawful Interception (LI) network, the method comprising:

providing a Law Enforcement Agency with Intercept Related Information (IRI) and Content of Communications (CC) from data traffic in a digital communications network, said data traffic being related to one or more target identities and interceptable by an Intercepting Control Element in a common node of said LI network and digital communications network, wherein said Intercepting Control Element being configured to receive a request to intercept data traffic related to one or more target identities, collect IRI and CC related to said one or more requested target identities, and forward the IRI and CC to the IMDU node of the LI network;

receiving the IRI and CC from said Intercepting Control Element;

sampling the CC according a certain sampling rate to achieve one or more samples;

retrieving and analyzing data packet headers of the CC for locating a block of one or more data packets to be selected as a sample;

generating each sample based on the located block of data by gathering data packets having the same timestamp; and

forwarding the generated one or more samples to the Law Enforcement Agency.

2. The method according to claim 1, wherein the intercepted data traffic involves a video stream, comprising a sequence of frames, said frames being split across a number of data packets involving data packet headers comprising a timestamp field and a marker bit, said marker bit indicates the start and the end of a frame.

3. The method according to claim 1, wherein forwarding the generated one or more samples comprises:

forwarding the generated one or more samples via a third Handover Interface in the LI network to a Law Enforcement Management Function unit.

4. The method according to claim 1, wherein a sample comprises one or more data packets, each data packet involving a Lawful Intercept header comprising at least one of the following data:

frame number;

type;

timestamp;

or

samples correlation Identification.

5. The method according to claim 1, the method further comprising:

collecting metadata from the received IRI;

inserting said metadata into an IRI report; and

forwarding the IRI report via a second Handover Interface in the LI network to the Law Enforcement Agency.

6. The method according to claim 5, wherein the IRI report may comprise at least one of the following metadata:

URL;

IP address;

file name;

or

sample correlation Identification.

7. The method according to claim 1, wherein the method further comprises:

receiving a request to intercept data traffic related to one or more target identities, said request involving a request for sending samples of the CC.

8. An Intercept Mediation and Delivery unit (IMDU) node of a Lawful Interception (LI) network, configured to provide a Law Enforcement Agency with Intercept Related Information (IRI) and Content of Communications (CC) of data traffic in a digital communications network, the IMDU comprising:

components comprising hardware to provide a Law Enforcement Agency with Intercept Related Information (IRI) and Content of Communications (CC) from data traffic in a digital communications network, said data traffic being related to one or more target identities and interceptable by an Intercepting Control Element in a common node of said LI network and digital communications network, wherein said Intercepting Control Element being configured to receive a request to intercept data traffic related to one or more target identities, collect IRI and CC related to said one or more requested target identities, and forward the IRI and CC to the IMDU node of the LI network;

components comprising hardware to receive the IRI and CC from said Intercepting Control Element;

a sampling filter configured to sample the CC according a certain sampling rate to achieve one or more samples of the CC, to retrieve and analyze data packet headers of the CC for locating a block of one or more data packets to be selected as a sample, and to generate each sample based on the located block of data by gathering data packets having the same timestamp; and

an interface configured to forward the generated one or more samples to the Law Enforcement Agency.

9. The IMDU node according to claim 8, wherein the intercepted data traffic involves a video stream which is composed of a sequence of frames, said frames being split across a number of data packets involving data packet headers comprising a timestamp field and a marker bit, said marker bit indicates the start and the end of a frame.

10. The IMDU node according to claim 8, wherein the interface is a third Handover Interface.

11. The IMDU node according to claim 8, wherein each of the one or more samples comprises one or more data packets, each data packet involving a Lawful Intercept header comprising at least one of the following data:

frame number;

type;

timestamp;

or

samples correlation Identification.

12. The IMDU node according to claim 8, further configured to:

collect metadata from the received IRI;

insert said metadata into an IRI report;

forward the IRI report via a second Handover Interface to the Law Enforcement Agency node.

13. The IMDU node according to claim 12, wherein the IRI report may comprise at least one of the following metadata:

URL;

IP address;

file name;

or

sample correlation Identification.

14. The IMDU node according to claim 8, wherein the IMDU node is further configured to receive, from the Law Enforcement Management Function unit node, the request to intercept data traffic related to one or more target identities via a first Handover Interface of the IMDU node, said request involving a request for sending samples of the CC back to the Law Enforcement Agency node.

15. A non-transitory computer readable medium comprising a memory to store computer program code loadable into a processor, which when executed in the processor causes an Intercept Mediation and Delivery Unit (IMDU) to:

provide a Law Enforcement Agency with Intercept Related Information (IRI) and Content of Communications (CC) from data traffic in a digital communications network, said data traffic being related to one or more target identities and interceptable by an Intercepting Control Element in a common node of said LI network and digital communications network, wherein said Intercepting Control Element being configured to receive a request to intercept data traffic related to one or more target identities, collect IRI and CC related to said one or more requested target identities, and forward the IRI and CC to the IMDU node of the LI network;

receive the IRI and CC from said Intercepting Control Element;

sample the CC according a certain sampling rate to achieve one or more samples;

retrieve and analyze data packet headers of the CC for locating a block of one or more data packets to be selected as a sample;

generate each sample based on the located block of data by gathering data packets having the same timestamp; and

forward the generated one or more samples to the Law Enforcement Agency.