Methods and devices for detecting and correlating data packet flows in a lawful interception system

Patent metadata

Field	Value
Publication number	US-10320851-B2
Application number	US-201515752726-A
Country	US
Kind code	B2
Filing date	Aug 27, 2015
Priority date	Aug 27, 2015
Publication date	Jun 11, 2019
Grant date	Jun 11, 2019

Abstract

The following disclosure relates a method and mediation device ( 100 ) in a Lawful Interception (LI) system for detecting and correlating copies of SIP and RTP flows, from different domains EPS or IMS, said method comprising to determine a unique IMS Communication Identity Number, IMS CIN, and a corresponding correlation set of identifiers, storing each unique IMS CIN together with its correlation set for an intercepted communication session, correlating a SIP or RTP flow received from one domain to the same SIP or RTP flows of the same communication session received from the other domain by comparing the flow identity information of the received flow to the stored correlation sets for identifying a matching correlation set and its unique IMS CIN and sending to a LEA requesting for LI of the target said received SIP or RTP flow comprising said identified unique IMS CIN for a matching correlation set.

First claim

The invention claimed is:

1. A method for detecting and correlating copies of Session Initiation Protocol (SIP) and Real-time Transport Protocol (RTP) flows, respectively, belonging to a communication session of an intercepted user (a target) the session being established via an Internet protocol Multimedia Subsystem (IMS) having a well-known Access Point Name (APN), which session is intercepted in an IMS domain by an Interception Access Point (IMS/IAP), and in an Evolved Packet System (EPSP) domain by an Interception Access Point (EPS/IAP), by which interception result in the generation of copies of the session's SIP and RTP flows comprising flow identity information defined by a set of identifiers (triplet) comprising Lawful Interception Identity (LI-ID) and one of assigned IP user addresses IP_SIP or IP_RTP of the target, and identical content, the copies of SIP and RTP flows being received by a mediation function of a Lawful Interception (LI) system, the method comprising:
determining a unique IMS Communication Identity Number (IMS CIN) and a corresponding correlation set of identifiers comprising Correlation Number of default Bearer (CN_def_B), Correlation Number of dedicated Bearer (CN_ded_B) and IMS Correlation Number (CN_IMS) for each intercepted communication session at Packet Data Protocol (PDP) context/Bearer set up and establishment event of the communication session via the IMS well-known APN;
storing each unique IMS CIN together with its correlation set for an intercepted communication session;
correlating a SIP or RTP flow received from one domain to the same SIP or RTP flows of the same communication session received from the other domain by comparing the flow identity information of the received flow to the stored correlation sets for identifying a matching correlation set and its unique IMS CIN;
sending, to a Law Enforcement Agency (LEA) requesting for LI of the target, the received SIP or RTP flow comprising the identified unique IMS CIN for a matching correlation set, enabling the LEA to match SIP and RTP flows of the same communication session regardless of whether intercepted in an IMS domain or an EPS domain.

2. The method of claim 1 , wherein the method comprises, at the PDP context/Bearer set up and communication session establishment event of a target:
receiving a default Bearer activation signaling from the EPS/IAP;
collecting identifiers LI-ID, CN_def_B, and IP_SIP constituting a first triplet of flow identity information from the default Bearer activation signaling;
storing the identifiers LI-ID, CN_def_B, and IP_SIP as identifiers in a correlation set for the communication session;
generating an IP Communication Identity Number (IP CIN) for the communication session;
sending a report of the Default Bearer Activation signaling comprising the IP CIN over HI2 to a LEA requesting for LI of the target.

3. The method of claim 2 , wherein the method comprises, at the PDP context/Bearer set up and communication session establishment event of a target:
receiving a dedicated Bearer activation signaling from the EPS/IAP;
collecting identifiers LI-ID, CN_ded_B, and IP_RTP constituting a second triplet from the dedicated Bearer activation signaling;
comparing LI-ID of the second triplet with LI-ID the stored first triplet;
storing the identifiers LI-ID, CN_ded_B, and IP_RTP as identifiers in the correlation set for the communication session, if the received LI-ID matches stored identifiers LI-ID in the first triplet;
sending a report of the Dedicated Bearer Activation signaling comprising the IP CIN over HI2 to a LEA requesting for LI of the target.

4. The method of claim 3 , wherein the determining comprises:
receiving a SIP flow for the first time after the communication session establishment event is finalized;
collecting identifiers LI-ID, CN_IMS, IP_SIP constituting a third triplet from the SIP flow;
comparing LI-ID and IP_SIP of the third triplet with LI-ID and IP_SIP of the stored first triplet;
storing the identifiers LI-ID, CN_IMS, and IP_SIP as identifiers in the correlation set for the communication session, if the comparison result is a match of LI-ID and IP_SIP with corresponding identifiers in the first triplet;
generating a unique IMS Communication Identity Number (IMS CIN) for identifying the correlation set of identifiers comprising CN_def_B, CN_ded_B, and CN_IMS of the communication session.

5. The method of claim 1 , wherein the correlating comprises:
comparing the flow identity information of the received flow to the stored correlation sets for identifying a matching correlation set and its unique IMS CIN;
identifying a matching correlation set comprising flow identity information of identifiers of the received flow;
inserting the unique IMS Communication Identity Number (IMS CIN) of a matching correlation set into a generated report of the received flow to be sent to the requesting LEA.

6. The method of claim 5 , wherein the correlating further comprises:
detecting if the triplet of identifiers is missing in the correlation set of the communication session;
inserting the missing triplet of identifiers of the flow into the correlation set of identifiers.

7. The method of claim 1 , wherein a complete correlation set comprises values of the identifiers CN_def_B, CN_ded_B, CN_IMS, IP_SIP, IP_RTP, and LI-ID.

8. The method of claim 7 , wherein the identifiers are constituting triplets of three identifiers, each triplet enabling identification whether the received flow is received from an EPS/IAP or IMS/IAP.

9. The method of claim 1 , wherein the identifier values of IP_SIP and IP_RTP both are the IP address of the assigned user, and the values are equal for a communication session.

10. The method of claim 9 , further comprising:
identifying a timestamp regarding a start time of the communication session; and
identifying a timestamp regarding a stop time of the communication session.

11. The method according to claim 10 , further comprising sending, to the LEA, the identified timestamps regarding the start and stop of a communication session.

12. A mediation device in a Lawful Interception (LI) system for detecting and correlating copies of Session Initiation Protocol (SIP) and Real-time Transport Protocol (RTP) flows, respectively, belonging to a communication session of an intercepted user (a target), the session being established via an Internet Protocol Multimedia subsystem (IMS) having a well-known Access Point Name (APN), which session is intercepted in an IMS domain by an Interception Access Point (IMS/IAP) and in an Evolved Packet System (EPS) domain by an Interception Access Point (EPS/IAP), by which interception result in the generation of copies of the session's SIP and RTP flows comprising flow identity information defined by a set of identifiers (triplet) comprising Lawful Interception Identity, (LI-ID), and one of assigned IP user addresses IP_SIP or IP_RTP of the target, and identical content, the copies of SIP and RTP flows being received by the mediation device of a LI system, wherein the mediation device comprises:
processing circuitry;
memory containing instructions executable by the processing circuitry whereby the mediation device is operative to:
determine a unique IMS Communication Identity Number (IMS CIN) and a corresponding correlation set of identifiers comprising Correlation Number of default Bearer (CN_def_B), Correlation Number of dedicated Bearer (CN_ded_B), and IMS Correlation Number (CN_IMS) for each intercepted communication session at Packet Data Protocol (PDP) context/Bearer set up and establishment event of the communication session via the IMS well-known APN;
store each unique

Assignees

• Ericsson Telefon Ab L M

Inventors

• Senatore Andrea
• Toro Francesco
• Villani Elvira

Classifications

• H04M2207/185

  wireless packet-switched · CPC title

• H04L65/1016

  IP multimedia subsystem [IMS] · CPC title

• H04M3/2281

  Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls · CPC title

• H04L63/306 Primary

  intercepting packet switched data communications, e.g. Web, Internet or IMS communications · CPC title

• H04L2463/121

  Timestamp · CPC title