APPARATUS, METHOD AND COMPUTER-READABLE STORAGE MEDIUMS FOR DETERMINING APPLICATION PROTOCOL ELEMENTS AS DIFFERENT TYPES OF LAWFUL INTERCEPTION CONTENT

• US 20110154181A1
• Filed: 12/23/2009
• Published: 06/23/2011
• Est. Priority Date: 12/23/2009
• Status: Active Grant

• Current Assignee: Synchronica PLC (Myriad Group AG)
• Original Assignee: Nokia Corporation
• Inventors: Kontopoulos, Bob, Kawa, Claude
• Granted Patent: US 9,106,603 B2
• Time in Patent Office: Days
• US Class Current: 715/234
• CPC Class Codes: G06F 40/143 Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD]
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls

Abstract

An example apparatus is provided that includes a processor and a memory storing executable instructions that in response to execution by the processor cause the apparatus to at least perform a number of operations. The operations include receiving a communication including an application protocol primitive that itself includes protocol information element(s). The operations also include comparing the application protocol primitive to a protocol document type definition (DTD) including a plurality of elements, and lawful interception attribute(s) for one or more of its elements. The application protocol primitive is compared to the DTD to identify lawful interception attributes of protocol information element(s) of the primitive. The operations also include preparing one or more of the protocol information elements for transmission to an interception monitoring facility according to the lawful interception attributes of the respective protocol information element(s).

Claims

1. An apparatus comprising a processor and a memory storing executable instructions that in response to execution by the processor cause the apparatus to at least perform the following:

receiving a communication including an application protocol primitive, the application protocol primitive including one or more protocol information elements, each element comprising a component of the application protocol primitive carrying information;

comparing the application protocol primitive to a protocol document type definition including a plurality of elements, and one or more lawful interception attributes for one or more of the elements of the protocol document type definition, the lawful interception attributes including at least one of a type of content or a level of interception, the application protocol primitive being compared to the protocol document type definition to identify lawful interception attributes of one or more of the protocol information elements of the application protocol primitive of the communication; and

preparing one or more of the protocol information elements for transmission to an interception monitoring facility according to the lawful interception attributes of the respective one or more protocol information elements.

2. The apparatus of claim 1, wherein receiving a communication comprises receiving a communication including an application protocol primitive including one or more protocol information elements without any lawful interception attributes present in the communication.

3. The apparatus of claim 1, wherein the memory stores executable instructions that in response to execution by the processor cause the apparatus to further perform the following:

receiving a protocol document type definition including a plurality of elements; and

augmenting the protocol document type definition to include one or more lawful interception attributes for one or more of the elements of the protocol document type definition,

wherein the lawful interception attributes include a type of content selected from a group of types including content of communication, interception-related information or a combination of content of communication and interception-related information, and

wherein the lawful interception attributes also include a level of interception selected from a group of levels representing different amounts of information to be transmitted to the interception monitoring facility.

4. The apparatus of claim 1, wherein each of the application protocol primitive and the protocol document type definition is representable as a tree structure including a root node and one or more leaf nodes, each leaf node representing a protocol information element,

wherein comparing the application protocol primitive to a protocol document type definition comprises:

locating a sub-tree structure within the protocol document type definition that corresponds to the tree structure of the application protocol primitive; and

for each of the one or more protocol information elements of the application protocol primitive,

traversing the tree structure of the application protocol primitive from the root node to the leaf node representing the respective protocol information element; and

identifying, from the corresponding sub-tree structure within the protocol document type definition, any lawful interception attributes of the leaf node representing the respective protocol information element to thereby identify any lawful interception attributes of the respective protocol information element, and

wherein preparing one or more of the protocol information elements for transmission comprises preparing one or more of the identified protocol information elements for transmission.

5. The apparatus of claim 4, wherein for each of the one or more protocol information elements of the application protocol primitive, comparing the application protocol primitive to a protocol document type definition further comprises:

comparing the identified lawful interception attributes to a request for lawful interception of communications to determine whether the identified protocol information element satisfies the request,

wherein preparing one or more of the identified protocol information elements comprises preparing at least one identified protocol information element that satisfies the request for transmission.

6. The apparatus of claim 4, wherein identifying any lawful interception attributes comprises identifying any lawful interception attributes of the leaf node and any parent nodes of the leaf node.

7. A method comprising:

receiving a communication including an application protocol primitive, the application protocol primitive including one or more protocol information elements, each element comprising a component of the application protocol primitive carrying information;

comparing the application protocol primitive to a protocol document type definition including a plurality of elements, and one or more lawful interception attributes for one or more of the elements of the protocol document type definition, the lawful interception attributes including at least one of a type of content or a level of interception, the application protocol primitive being compared to the protocol document type definition to identify lawful interception attributes of one or more of the protocol information elements of the application protocol primitive of the communication; and

preparing one or more of the protocol information elements for transmission to an interception monitoring facility according to the lawful interception attributes of the respective one or more protocol information elements,

wherein receiving a communication, comparing the application protocol primitive and preparing one or more of the protocol information elements are performed by a processor configured to receive the communication, compare the application protocol primitive and prepare the one or more of the protocol information elements.

8. The method of claim 7, wherein receiving a communication comprises receiving a communication including an application protocol primitive including one or more protocol information elements without any lawful interception attributes present in the communication.

9. The method of claim 7 further comprising:

receiving a protocol document type definition including a plurality of elements; and

augmenting the protocol document type definition to include one or more lawful interception attributes for one or more of the elements of the protocol document type definition,

wherein the lawful interception attributes include a type of content selected from a group of types including content of communication, interception-related information or a combination of content of communication and interception-related information, and

wherein the lawful interception attributes also include a level of interception selected from a group of levels representing different amounts of information to be transmitted to the interception monitoring facility.

10. The method of claim 7, wherein each of the application protocol primitive and the protocol document type definition is representable as a tree structure including a root node and one or more leaf nodes, each leaf node representing a protocol information element,

wherein comparing the application protocol primitive to a protocol document type definition comprises:

locating a sub-tree structure within the protocol document type definition that corresponds to the tree structure of the application protocol primitive; and

for each of the one or more protocol information elements of the application protocol primitive,

traversing the tree structure of the application protocol primitive from the root node to the leaf node representing the respective protocol information element; and

identifying, from the corresponding sub-tree structure within the protocol document type definition, any lawful interception attributes of the leaf node representing the respective protocol information element to thereby identify any lawful interception attributes of the respective protocol information element, and

wherein preparing one or more of the protocol information elements for transmission comprises preparing one or more of the identified protocol information elements for transmission.

11. The method of claim 10, wherein for each of the one or more protocol information elements of the application protocol primitive, comparing the application protocol primitive to a protocol document type definition further comprises:

comparing the identified lawful interception attributes to a request for lawful interception of communications to determine whether the identified protocol information element satisfies the request,

wherein preparing one or more of the identified protocol information elements comprises preparing at least one identified protocol information element that satisfies the request for transmission.

12. The method of claim 10, wherein identifying any lawful interception attributes comprises identifying any lawful interception attributes of the leaf node and any parent nodes of the leaf node.

13. A computer-readable storage medium having computer-readable program code portions stored therein that in response to execution by a processor, cause an apparatus to at least perform the following:

receiving a communication including an application protocol primitive, the application protocol primitive including one or more protocol information elements, each element comprising a component of the application protocol primitive carrying information;

comparing the application protocol primitive to a protocol document type definition including a plurality of elements, and one or more lawful interception attributes for one or more of the elements of the protocol document type definition, the lawful interception attributes including at least one of a type of content or a level of interception, the application protocol primitive being compared to the protocol document type definition to identify lawful interception attributes of one or more of the protocol information elements of the application protocol primitive of the communication; and

preparing one or more of the protocol information elements for transmission to an interception monitoring facility according to the lawful interception attributes of the respective one or more protocol information elements.

14. The computer-readable storage medium of claim 13, wherein receiving a communication comprises receiving a communication including an application protocol primitive including one or more protocol information elements without any lawful interception attributes present in the communication.

15. The computer-readable storage medium of claim 13, wherein the computer-readable storage medium has computer-readable program code portions stored therein that in response to execution by the processor cause the apparatus to further perform the following:

receiving a protocol document type definition including a plurality of elements; and

augmenting the protocol document type definition to include one or more lawful interception attributes for one or more of the elements of the protocol document type definition,

wherein the lawful interception attributes include a type of content selected from a group of types including content of communication, interception-related information or a combination of content of communication and interception-related information, and

wherein the lawful interception attributes also include a level of interception selected from a group of levels representing different amounts of information to be transmitted to the interception monitoring facility.

16. The computer-readable storage medium of claim 13, wherein each of the application protocol primitive and the protocol document type definition is representable as a tree structure including a root node and one or more leaf nodes, each leaf node representing a protocol information element,

wherein comparing the application protocol primitive to a protocol document type definition comprises:

locating a sub-tree structure within the protocol document type definition that corresponds to the tree structure of the application protocol primitive; and

for each of the one or more protocol information elements of the application protocol primitive,

traversing the tree structure of the application protocol primitive from the root node to the leaf node representing the respective protocol information element; and

identifying, from the corresponding sub-tree structure within the protocol document type definition, any lawful interception attributes of the leaf node representing the respective protocol information element to thereby identify any lawful interception attributes of the respective protocol information element, and

wherein preparing one or more of the protocol information elements for transmission comprises preparing one or more of the identified protocol information elements for transmission.

17. The computer-readable storage medium of claim 16, wherein for each of the one or more protocol information elements of the application protocol primitive, comparing the application protocol primitive to a protocol document type definition further comprises:

comparing the identified lawful interception attributes to a request for lawful interception of communications to determine whether the identified protocol information element satisfies the request,

wherein preparing one or more of the identified protocol information elements comprises preparing at least one identified protocol information element that satisfies the request for transmission.

18. The computer-readable storage medium of claim 16, wherein identifying any lawful interception attributes comprises identifying any lawful interception attributes of the leaf node and any parent nodes of the leaf node.

19. An apparatus comprising:

a first means for receiving a communication including an application protocol primitive, the application protocol primitive including one or more protocol information elements, each element comprising a component of the application protocol primitive carrying information;

a second means for comparing the application protocol primitive to a protocol document type definition including a plurality of elements, and one or more lawful interception attributes for one or more of the elements of the protocol document type definition, the lawful interception attributes including at least one of a type of content or a level of interception, the application protocol primitive being compared to the protocol document type definition to identify lawful interception attributes of one or more of the protocol information elements of the application protocol primitive of the communication; and

a third means for preparing one or more of the protocol information elements for transmission to an interception monitoring facility according to the lawful interception attributes of the respective one or more protocol information elements.