Method and system for communications monitoring

• US 7,925,889 B2
• Filed: 08/21/2003
• Issued: 04/12/2011
• Est. Priority Date: 08/21/2002
• Status: Active Grant

• Current Assignee: Verint Americas Incorporated (Verint Systems Incorporated)
• Original Assignee: Verint Americas Incorporated (Verint Systems Incorporated)
• Inventors: Blair, Christopher Douglas
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Sanders; Stephen
• Application Number:
  US10/525,260
• Publication Number:
  US 20060123106A1
• Time in Patent Office: 2,791 Days
• Field of Search: 713/189, 709/224
• US Class Current: 713/189
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04M 3/42221 Conversation recording systems at the subscriber's set H04M1/656

Abstract

The present invention provides for a system, and related method, for use in the monitoring of communications traffic, comprising the step of recording the said traffic and storing the recorded traffic in an encrypted data format such that the data can be decrypted only by means of keys that exhibit restricted availability.

Claims

1. A method for monitoring of communications traffic, comprising:

connecting a recorder to a network switch to record packet-data communication traffic received from, and passing through, the network switch;

encrypting the packet-data communication traffic at an encryption engine communicatively connected to the recorder after the packet-data communication traffic has passed through the network switch to create encrypted data;

storing the encrypted data in a storage device such that the encrypted data can be decrypted only by means of decryption keys that exhibit restricted availability; and

providing the decryption keys having embedded encrypted search conditions therein to only provide access to encrypted data meeting criteria specified by the encrypted search conditions,

wherein the criteria specify an identification of the portions of the packet-data communications traffic within the encrypted data to be decrypted.

2. The method as claimed in claim 1 further including employment of a spare disk and/or CPU capacity within a telecommunications system.

3. The method as claimed in claim 1, further including the step of employing separate levels of authorization for access to the stored data.

4. The method as claimed in claim 1, further including the step of employing a decryption key that is useable only once.

5. The method as claimed in claim 1, further including the step of logging all accesses to the stored data to an encrypted secure audit trail.

6. The method as claimed in claim 1, further including a tamper detection reference within the encrypted data.

7. The method as claimed in claim 1, further including the step of monitoring all the available communications traffic.

8. The method as claimed in claim 7, wherein the step of storing the recorded traffic comprises the step of recording all of the recorded traffic.

9. The method as claimed in claim 1, wherein the communications traffic to be recorded comprises traffic through a telecommunications switch, router or gateway.

10. The method as claimed in claim 1, further including the step of encrypting details relating to the communications traffic and storing the said encrypted details for subsequent access.

11. The method as claimed in claim 1, further including the step of authorizing use of the required decryption key in a restricted manner.

12. A system for monitoring of communications traffic, comprising:

a recorder that records the communications traffic, the communications traffic being received by the recorder from a network switch;

an encryption engine that encrypts the communications traffic after the communications traffic has passed through the network switch to the recorder; and

a storage device that stores recorded communications traffic as encrypted data, such that the encrypted data can be decrypted only by means of decryption keys that exhibit restricted availability, wherein encrypted search conditions are included within the keys that only provide access to encrypted data meeting criteria specified by the encrypted search conditions, and wherein the criteria specify an identification of the portions of the communications traffic within the encrypted data to be decrypted.

13. The system as claimed in claim 12 further including application software that executes any one or more of the following method steps:

the step of employing separate levels of authorization for access to the stored data;

the step of employing a decryption key that is useable only once;

the step of logging all accesses to the stored data to an encrypted secure audit trail;

the step of monitoring all the available communications traffic;

the step of storing the recorded traffic comprises the step of recording all of the recorded traffic;

the step of encrypting details relating to the communications traffic and storing the said encrypted details for subsequent access;

the step of authorizing use of the required decryption key in a restricted manner.