Method and apparatus for intercepting events in a communication system

• US 20060093135A1
• Filed: 10/20/2005
• Published: 05/04/2006
• Est. Priority Date: 10/20/2004
• Status: Active Grant

• Current Assignee: Seven Networks Inc
• Original Assignee: Seven Networks Inc
• Inventors: Sutaria, Jay, Fiatal, Trevor, Nanjundeswaran, Sridhar, Bavadekar, Shailesh
• GRANTED PATENT: US 7,441,271 B2
• Time in patent office: 0 Days
• US Class Current: 380/28
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for supporting authentication of entities communicating through a packet data network cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

An intercept system provides more effective and more efficient compliance with legal intercept warrants. The intercept system can provide any combination of operations that include near-real-time intercept, capture of intercepted data in structured authenticated form, clear text intercept for communications where there is access to encryption keys, cipher text intercept for communications where there is no access to encryption keys, provision of transactional logs to the authorized agency, interception without altering the operation of the target services, and encryption of stored intercepted information.

Claims

1. A communication management device, comprising:

a processor configured to operate as a legal intercept for intercepting data associated with a target user pursuant to a legal warrant.

2. The device according to claim 1 wherein the processor is configured to intercept the data according to an intercept configuration file that includes, but is not limited to, a unique intercept identifier and a user ID identifying the target user subject to a legal intercept operation.

3. The device according to claim 1 wherein the processor is configured to automatically format the intercepted data into log files.

4. The device according to claim 3 wherein the processor automatically sends the log files to a remote server accessible by an enforcement agency issuing the legal warrant.

5. The device according to claim 3 wherein the processor generates multiple log files that identify any intercepted data for associated contiguous predetermined time periods extending over a continuous intercept period.

6. The device according to claim 5 wherein the processor generates the individual log files for back-to-back time periods that each either contain intercepted data for the associated time period or indicate that no data was intercepted during the associated time period.

7. The device according to claim 3 wherein the processor is configured to derive one or more digital signatures for the log files in the intercept directory.

8. The device according to claim 3 wherein the processor is configured to encrypt the log files according to an encryption key known by an enforcement agency issuing the warrant.

9. The device according to claim 1 wherein the processor is configured to identify a first portion of the intercepted data encrypted using a first known security association for which the processor has knowledge of the encryption key and identify a second portion of the intercepted data encrypted using a second unknown security association, the processor decrypting and storing the first portion of the intercepted data into a log file and combining the encrypted second portion of the intercepted data with the decrypted first portion of the intercepted data in the same log file.

10. The device according to claim 9 wherein the first portion of the intercepted data is encrypted with a known point-to-point encryption key and the second portion of the intercepted data is encrypted with an unknown end-to-end encryption key.

11. The device according to claim 10 wherein the processor is configured to encrypt both the decrypted first portion of the intercepted data and the second encrypted portion of the intercepted data.

12. The device according to claim 9 wherein the first portion of the intercepted data includes transaction authentication and routing information and the second portion of the intercepted data includes the contents of email messages, electronic files, or other electronic data.

13. The device according to claim 1 wherein the processor operates in a management server that manages communications between a local device operating in an enterprise or local network and a mobile wireless device that synchronizes with a portion of the data in the local device.

14. A method for intercepting data, comprising:

receiving a warrant identifier for a warrant authorizing a legal intercept;

receiving a user identifier identifying an intercept target for the legal intercept associated with the warrant; and

automatically intercepting data received and/or sent by the intercept target identified by the user identifier.

15. The method according to claim 14 wherein the intercept target is a mobile device and the intercept data are messages that update email information between the mobile device and a corresponding local device operating in an enterprise or local network.

16. The method according to claim 14 including:

identifying a first portion of the intercepted data encrypted using a first known security association;

identifying a second portion of the intercepted data encrypted using a second unknown security association;

decrypting the first portion of the intercepted data and formatting the decrypted first portion of the intercepted data into a log file; and

combining the encrypted second portion of the intercepted data with the decrypted first portion of the intercepted data in the same log file.

17. The method according to claim 14 including:

managing the transfer of contents between a computer operating in an enterprise or network and a mobile device associated with the intercept target;

receiving authorization via the warrant identifier and user identifier to intercept communications between the computer and/or mobile device;

automatically intercepting data transferred between the computer and the mobile device pursuant to the warrant identifier and the user identifier; and

storing the intercepted data in a structure format that identifies when data was intercepted and at the same time provides authentication that the stored intercepted data has not been altered or deleted.

18. The method according to claim 17 including monitoring communications between the computer and the mobile device for multiple contiguous time periods.

19. The method according to claim 18 including:

generating the log files over an intercept period that encompasses multiple contiguous time periods;

storing the log files in a same intercept directory;

inserting the warrant identifier into the intercept directory; and

generating a name for the intercept directory that identifies the intercept target and the intercept period over which the log files were generated.

20. The method according to claim 19 including:

encrypting the log files in the intercept directory with an encryption scheme known by an agency issuing the warrant; and

sending the encrypted intercept directory to an electronic mailbox accessible by the agency.

21. The method according to claim 20 including:

generating a Cyclic Redundancy Check (CRC) or other digital signature value for all of the log files in the intercept directory;

encrypting the resulting generated value; and

providing the encrypted generated value to the enforcement agency separately from the encrypted intercept directory to verify that the log files have not been altered.

22. The method according to claim 14 including:

reading an intercept configuration file that contains the warrant identifier, the user identifier, an enforcement agency known encryption key and an electronic mailbox address;

upon reading the intercept configuration file automatically intercepting data received and/or sent by a device corresponding with the user identifier;

formatting any intercepted data into log files that identify when the data was intercepted; and

encrypting the log files using the encryption key.

23. The method according to claim 14 including:

identifying a first portion of the intercepted data encrypted with a known encryption key;

decrypting the first portion of the intercepted data using the known encryption key;

storing the decrypted first portion of the intercepted data in a log file;

identifying a second portion of the intercepted data encrypted with an unknown encryption key; and

combining the decrypted first portion of the intercepted data with the encrypted second portion of the intercepted data in the same log file.

24. A communication management system, comprising:

a management server used for managing communications between a computer in an enterprise or local network and a mobile device;

the management server configurable to operate as an interception device for intercepting the communications between the computer and the mobile device pursuant to a warrant from an enforcement agency.

25. The communication management system according to claim 24 including a software utility operating on a terminal that configures the management server for intercepting the communications between the computer and the mobile device.

26. The communication management system according to claim 25 wherein the software utility modifies a configuration file in the management server to include a warrant identifier and a user identifier for a targeted mobile device for the intercepted communications.

27. The communication system according to claim 26 wherein the software utility is configured to access end-to-end encryption keys located in either the target computer or the mobile device pursuant to a legal seizure warrant.

28. The communication system according to claim 25 wherein the software utility contains an encryption key used for decrypting log files generated by the management server that contain encrypted intercepted communications between the computer and the mobile device.

29. A communication management system, comprising:

a processor configured to operate as a legal intercept for intercepting data associated with a target user pursuant to a legal warrant,

the processor configured to identify a first unencrypted portion of the intercepted data and identify a second encrypted portion of the intercepted data encrypted using an unknown security association, and

the processor further configured to store the first portion of the intercepted data into a log file and combine the encrypted second portion of the intercepted data with the first portion of the intercepted data in the same log file.

30. The system according to claim 29 wherein the second portion of the intercepted data is encrypted with an unknown end-to-end encryption key.

31. The system according to claim 30 wherein the processor is configured to encrypt the first and second portion of the intercepted data stored in the log file.

32. The system according to claim 29 wherein the first portion of the intercepted data includes transaction authentication and routing information and the second portion of the intercepted data includes the contents of email messages, electronic files, or other electronic data.

33. The system according to claim 29 wherein the processor is configured to identify a third portion of the intercepted data encrypted using a known security association, decrypt the third portion of the intercepted data, and combine the decrypted third portion of the intercepted data with the first and second portion of the data in the same log file.

34. The system according to claim 33 wherein the processor is configured to encrypt the first, second and third portion of the intercepted data before being stored in the log file.