Method and Apparatus for Identifying and Monitoring VOIP Media Plane Security Keys for Service Provider Lawful Intercept Use

• US 20070297418A1
• Filed: 06/21/2006
• Published: 12/27/2007
• Est. Priority Date: 06/21/2006
• Status: Active Grant

• Current Assignee: Genband US LLC (Ribbon Communications, Inc.)
• Original Assignee: Nortel Networks Limited (Nortel Networks Corporation)
• Inventors: Lee, Michael
• Granted Patent: US 8,934,609 B2
• Time in Patent Office: Days
• US Class Current: 370/395.52
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04L 65/1083 In-session procedures

Abstract

A mechanism is described that enables encrypted end-point communications in a VoIP network to be accessed by a service provider. The mechanism includes a session information retrieval component which gathers session information such as encryption keys for each session that traverses a network element. The encryption keys may be used to decrypt data to make it available for lawful interception. A media stream monitoring component monitors media streams and verifies that the identified keys for each session are valid, to ensure continuity in compliance with LI regulations. Advantageously a security alert component may be used to controls further session operation for those sessions identified as potential security risks. With such an arrangement, the service provider can satisfy the legal requirement to provide interception, verify that the accuracy of the legal interception support and take appropriate steps to handle security risks.

Claims

1. A method of obtaining session information in a network comprising a plurality of end points coupled by at least one network element includes the step of:

establishing a secure communication channel with a first end-point by the at least one network element;

forwarding session initiation requests and responses between the first end-point and the second end-point to establish a session for an exchange of media between the first end-point and the second end-point, the session having at least one characteristic;

retrieving a characteristic of the session from the first end-point using the secure channel; and

storing the characteristic of the session.

2. The method of claim 1, wherein the characteristic of the session is associated with a manipulation of media data that is exchanged between the first end-point and the second end-point.

3. The method of claim 2, wherein the manipulation of media data includes encryption of the media data, and wherein the characteristic is a key that is used to encrypt the media data.

4. The method of claim 2, wherein the manipulation of media data includes translation of audio signals to digital signals, and wherein the characteristic is a codec associated with the media data.

5. The method of claim 2, wherein the manipulation of media data includes compression of the media data, and wherein the characteristic identifies a type and degree of compression applied to the media data.

6. The method of claim 1, wherein the step of forwarding requests and responses uses the Session Initiation Protocol.

7. The method of claim 1, wherein the step of forwarding requests and responses uses the H.323 protocol.

8. The method of claim 1, wherein the first end-point and second end-point communicate using a Voice over Internet Protocol network.

9. The method according to claim 3, wherein the key is obtained via a negotiation between the first end-point, the second-end user and the network element.

10. The method according to claim 3 wherein the key is obtained via a secure negotiation between the first end-point and the second-end user.

11. The method according to claim 1, wherein the characteristic of the session is a key that is used to encrypt media of the session, and wherein the method further includes the steps of:

periodically capturing blocks of media exchanged between the first end-point and second-end point;

decrypting the blocks of media using the key; and

analyzing the decrypted blocks of media to determine whether the key provided by the first end-point is valid.

12. The method of claim 11, wherein the step of analyzing includes performing at least one of a Chi Square spectral analysis, a Monobit analysis, a Poker analysis, a Runs analysis and a Long Runs analysis of the decrypted blocks of media.

13. The method of claim 11, further including the steps of:

receiving a request from a legal interceptor for access to the session;

forwarding characteristic information associated with the session to the legal interceptor.

14. The method of claim 1, wherein the characteristic of the session includes codec information associated with the media, and wherein the method further includes the step of:

periodically capturing blocks of media exchanged between the first end-point and second end-point; and

processing the blocks of media using the codec and spectral analysis to determine whether the bocks of media are encrypted.

15. The method associated with claim 11 or 14, further including the step of logging information associated with the session if it is determined that the media remains encrypted after performing spectral analysis.

16. A network element comprising:

session sampling logic for periodically sampling media exchanged in a peer-to-peer session between two end-points; and

analysis logic, coupled to the session sampling logic, for;

monitoring media exchanged between the two end-points; and

determining whether the encryption methods used on the media are known; and

marking sessions having unknown encryption methods as potential security risks.

17. The network element of claim 16, wherein the analysis logic further includes logging logic for logging session information of sessions determined to be at risk for use by legal interceptors.

18. The network element of claim 16 further including notification logic for notifying legal interceptors of sessions identified to be potential security risks.

19. The network element of claim 16, further comprising a key table for storing, for each session between each one of a plurality of end-points coupled to the network element, a value of a key used to encrypt media of the associated session, and wherein the analysis logic includes decryption logic for decrypting the periodically sampled media using the associated key and spectral analysis logic for determining whether the decrypted periodically sampled media remains encrypted.

20. A method of maintaining an ability to access end user communications in a network includes the steps of:

detecting a session between two end-points, the session including a control plane and a media plane;

storing a key used to encrypt the media plane of the session;

sampling media data exchanged during the session; and

decrypting the sampled data using the stored key to determine whether the media plane of the session is accessible.

21. The method of claim 20 further including the step of performing a spectral analysis of the decrypted sampled data to determine whether the media plane of the session remains encrypted.

22. The method of claim 20, wherein the step of analyzing includes performing at least one of a Chi Square spectral analysis, a Monobit analysis, a Poker analysis, a Runs analysis and a Long Runs analysis of the decrypted blocks of media.