System and method for monitoring network communications originating in monitored jurisdictions

• US 9,363,231 B2
• Filed: 09/13/2007
• Issued: 06/07/2016
• Est. Priority Date: 09/13/2007
• Status: Active Grant

• Current Assignee: Caterpillar Incorporated
• Original Assignee: Caterpillar Incorporated
• Inventors: Force, Paul, Crumb, Anthony, Hutson, James, Cox, Steven
• Primary Examiner(s): Zele, Krista
• Assistant Examiner(s): FORMAN, JAMES Q
• Application Number:
  US11/900,933
• Publication Number:
  US 20090077227A1
• Time in Patent Office: 3,190 Days
• Field of Search: 709/224, 709/206
• US Class Current: 1/1
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 63/304 intercepting circuit switched data communications lawful interception of wireless network communications H04W12/02
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications

Abstract

A method of monitoring network communications originating in monitored jurisdictions includes a step of identifying a monitored jurisdiction within a computer network based on predetermined criteria. The computer network includes at least one monitored jurisdiction and at least one unmonitored jurisdiction. A database is queried to identify at least one communication identifier associated with the monitored jurisdiction. The method also includes a step of storing a list including the at least one communication identifier. Only network communication having communication identifiers included in the list are monitored.

Claims

1. A method of monitoring network communications in a computer network having a plurality of network devices, wherein the computer network is divided into a plurality of jurisdictions each having at least one of the plurality of network devices, and each of the network devices is disposed in only one of the jurisdictions, and wherein the computer network has a monitoring tool connecting the computer network to an outside network, the method comprising:

identifying a monitored jurisdiction within the computer network based on predetermined criteria, wherein the computer network includes at least one monitored jurisdiction and at least one unmonitored jurisdiction;

querying a database to identify at least one communication identifier associated with the monitored jurisdiction, wherein each communication on the computer network includes a communication identifier, and each communication identifier includes identifying information associating the communication identifier with one of the jurisdictions of the computer network;

creating a list including the at least one communication identifier;

storing the list including the at least one communication identifier;

receiving at the monitoring tool outgoing communications from the plurality of network devices being transmitted from the computer network to the outside network;

for each outgoing communication, comparing the communication identifier in the outgoing communication to the list of communication identifiers of the monitored jurisdiction; and

monitoring only outgoing communications having communication identifiers included in the list of communication identifiers of the monitored jurisdiction, the monitoring comprising scanning content of the outgoing communication for a violation of a security policy.

2. The method of claim 1, wherein the identifying step includes identifying a jurisdiction having a regulation permitting monitoring of communications and identifying a jurisdiction having regulations forbidding monitoring of communications.

3. The method of claim 2, wherein the identifying step includes identifying a jurisdiction having an uncertain regulation regarding monitoring of communications.

4. The method of claim 2, wherein the identifying step is repeated at a predetermined frequency.

5. The method of claim 1, wherein a communication identifier may be a network address corresponding to a network device, and wherein the querying step includes querying at least one database to identify a network address associated with the monitored jurisdiction.

6. The method of claim 5, wherein a communication identifier may be an email address corresponding to a user of the computer network, and wherein the monitoring step includes monitoring network address based network communications leaving the computer network.

7. The method of claim 1, wherein the querying step includes querying at least one database to identify an email address associated with the monitored jurisdiction.

8. The method of claim 7, wherein the monitoring step includes monitoring email address based network communications leaving the computer network.

9. The method of claim 1, wherein the querying step, the storing step, and the monitoring step are repeated on a daily basis.

10. The method of claim 1, wherein the monitoring step includes identifying network communication events within the network communications.

18. The method of claim 1, wherein for situations in which regulations are unclear regarding monitoring of communications for a jurisdiction, deciding a categorization for the jurisdiction for monitoring.

11. A system for monitoring network communications, comprising:

a computer network with portions located in at least one monitored jurisdiction and at least one unmonitored jurisdiction, wherein the monitored jurisdiction is identified based on predetermined criteria, wherein the computer network includes a plurality of network devices, wherein each jurisdiction of the computer network includes at least one of the plurality of network devices, and wherein each of the network devices is disposed in only one of the jurisdictions;

at least one database having at least one communication identifier associated with the monitored jurisdiction, wherein each communication on the computer network includes a communication identifier, and each communication identifier includes identifying information associating the communication identifier with one of the jurisdictions of the computer network;

a process for creating and storing a list including the at least one communication identifier associated with the monitored jurisdiction; and

a monitoring tool for monitoring only network communications having communication identifiers included in the list, wherein the monitoring tool connects the computer network to an outside network,

the monitoring tool being configured to receive outgoing communications from the plurality of network devices being transmitted from the computer network to the outside network,

the monitoring tool being configured to compare the communication identifier in each outgoing communication to the list of communication identifiers for the monitored jurisdiction, and

the monitoring tool being configured to monitor only outgoing communications having communication identifiers included in the list of communication identifiers of the monitored jurisdictions, wherein monitoring comprises scanning content of the outgoing communication for a violation of a security policy.

12. The system of claim 11, wherein the predetermined criteria include a regulation permitting monitoring of communications.

13. The system of claim 11, wherein the communication identifier includes a network address associated with the monitored jurisdiction.

14. The system of claim 13, wherein the network communications include network address based network communications leaving the computer network.

15. The system of claim 11, wherein the communication identifier includes an email address associated with the monitored jurisdiction.

16. The system of claim 15, wherein the network communications include email address based network communications leaving the computer network.

17. The system of claim 11, wherein the monitoring tool is configured to identify network communication events within the network communications.

19. The system of claim 11, wherein for situations in which regulations are unclear regarding monitoring of communications for a jurisdiction, the monitoring tool comprising categorizing the jurisdiction for monitoring.