SYSTEM FOR ACCESSING A SET OF COMMUNICATION AND TRANSACTION DATA ASSOCIATED WITH A USER OF INTEREST SOURCED FROM MULTIPLE DIFFERENT NETWORK CARRIERS AND FOR ENABLING MULTIPLE ANALYSTS TO INDEPENDENTLY AND CONFIDENTIALLY ACCESS THE SET OF COMMUNICATION AND TRANSACTION DATA

• US 20130191493A1
• Filed: 01/20/2012
• Published: 07/25/2013
• Est. Priority Date: 12/30/2010
• Status: Active Grant

• Current Assignee: SS8 Networks Incorporated
• Original Assignee: SS8 Networks Incorporated
• Inventors: Bean, Timothy, Huang, Henry, Le, Robert
• Granted Patent: US 9,058,323 B2
• Time in Patent Office: Days
• US Class Current: 709/217
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: H04L 2012/5685 Addressing issues
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/302 gathering intelligence information for situation awareness or reconnaissance
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/80 Arrangements enabling lawful interception [LI]

Abstract

A system, method, and apparatus for collecting data streams, such as data packets, on a network, such as the Internet, are disclosed. Evaluation of the metadata and the relationships can be performed algorithmically, as predetermined by an analyst or as provided as preset options by the network monitoring system (NMS). The collected data associated with the users of the network may be accessed by multiple analysts belonging to different groups having a NMS of their own. The system may allow access to multiple analysts belonging to separate groups by parsing through a single instance of the stored data. Multiple analysts belonging to different groups may allow to access to a single instance of the stored data.

Claims

1. A method of monitoring a network, the method comprising:

receiving a known user ID associated with a known user of interest to be monitored at an access device;

receiving an identification of an analyst who is approved to receive a collected data of the known user of interest;

retrieving data streams from the network for the known user of interest; and

transmitting data streams of the known user of interest only to the analyst who is approved to receive the collected data of the known user of interest.

2. The method of claim 1 further comprising:

associating the identification of the analyst who is approved to receive the collected data with the set of collected data itself.

3. The method of claim 2 wherein the associating is performed by a look up table (LUT) providing a cross-reference of the collected data and the identification of the analyst who is approved to receive the collected data of the known user of interest.

4. The method of claim 1 further comprising:

receiving an identification of a plurality of analysts who are approved to receive collected data of at least one known user of interest.

5. The method of claim 4 wherein each of the plurality of analysts are approved to receive a different portion of collected data of at least one known user of interest.

6. The method of claim 5 wherein the collected data is parsed into different portions based on an approval type of the analyst.

7. The method of claim 6 further comprising:

associating an identification of the analyst with a portion of the collected data to which the analyst is approved to view.

8. The method of claim 1 further comprising:

retrieving the collected data associated with a known user of interest at a request of an analyst based on an analyst ID in a look up take identifying the analyst.

9. The method of claim 6 further comprising:

simultaneously retrieving a same portion of the collected data associated with the known user of interest for multiple analysts by parsing a single instance of the collected data on a storage device where the collected data is stored.

10. The method of claim 6 further comprising:

storing a first metadata associated with a first analysis of the collected data performed by a first analyst in a common storage server; and

storing a second metadata associated with a second analysis of the collected data performed by a second analyst in the common storage server.

11. The method of claim 1 wherein a known user ID associated with the known user of interest may be based on at least one of a network ID, a requesting agency ID, a network provider ID, a name of the known user of interest, and an associated information of the known user of interest.

12. The method of claim 1 wherein an output data from a common network monitoring system is duplicated and provided to multiple analysts based on an analyst ID.

13. A network monitoring system comprising:

an access device for retrieving data from a network;

a metadata processing device operative to;

identify an analyst who is approved to receive a collected data associated with a known user of interest through an analyst ID,

enable the analyst to access the set of collected data associated with the known user of interest when the analyst ID of the analyst is approved,

retrieve a data streams from the network for the known user of interest, and

transmit the data streams of the known user of interest to the analyst.

14. The network monitoring system of claim 13 wherein the metadata processing device is further operative to provide a cross-reference of the collected data and the identification of the analyst who is approved to access the collected data of the known user of interest.

15. The network monitoring system of claim 14 wherein the metadata processing device is further operative to simultaneously retrieve a same portion of the collected data associated with the known user of interest for multiple analysts by parsing a single instance of the collected data on a storage device where the collected data is stored.

16. A method comprising:

receiving a request from an analyst to access a collected data associated with a known user of interest;

approving the analyst based on at least one of an approval type of the analyst and an analyst ID;

translating a known user ID to a format applicable to each of a plurality of networks to access the set of collected data associated with the known user of interest and

transmitting to each of the plurality of networks a request to retrieve the collected data associated with the known user of interest.

17. The method of claim 16 further comprising:

storing a first metadata associated with a first analysis of the collected data performed by a first analyst in a common storage server; and

storing a second metadata associated with a second analysis of the collected data performed by a second analyst in the common storage server.

18. The method of claim 17 further comprising:

identifying the analyst who is approved to receive the collected data associated with a known user of interest through the analyst ID,

enabling the analyst to access the set of collected data associated with the known user of interest when the analyst ID of the analyst is approved.

19. The method of claim 18 further comprising:

simultaneously retrieving a same portion of the collected data associated with the known user of interest for multiple analysts by parsing a single instance of the collected data on a storage device where the collected data is stored.

20. The method of claim 19 further comprising:

retrieving the collected data associated with a known user of interest at a request of an analyst based on an analyst ID in a look up table identifying the analyst.