Policy routing-based lawful interception in communication system with end-to-end encryption

Patent metadata

Field	Value
Publication number	US-9544334-B2
Application number	US-201113212788-A
Country	US
Kind code	B2
Filing date	Aug 18, 2011
Priority date	May 11, 2011
Publication date	Jan 10, 2017
Grant date	Jan 10, 2017

Abstract

A method for intercepting encrypted communications exchanged between first and second computing devices in a communication network, wherein interception is performed by a third computing device in the computing network. The third computing device obtains one or more packets having a packet address associated with one of the first and second computing devices in response to at least one interception routing policy being implemented in at least one element in the communication network, such that the obtained packets may be decrypted to obtain data contained therein. The third computing device preserves the packet address of the obtained packets and forwards the obtained packets toward a packet-destination one of the first and second computing devices such that the packet-destination one of the first and second computing devices is unable to detect from the one or more packets that the one or more packets were intercepted by the third computing device.

First claim

What is claimed is:

1. A method for intercepting encrypted communications exchanged between a first computing device and a second computing device in a communication network, wherein the interception is performed by a third computing device in the communication network, the method comprising:
the third computing device obtaining one or more packets which are encrypted as part of an end-to-end encryption session associated with the first computing device and the second computing device, the one or more packets having a given packet address associated with one of the first computing device and the second computing device, wherein the one or more packets are obtained by the third computing device in response to at least one interception routing policy being implemented in at least one element in the communication network which is also responsible for routing non-intercepted packet traffic therethrough, wherein the at least one interception routing policy is configured to forward packets having the given packet address to the third computing device, the third computing device decrypting the one or more obtained packets using a security association established for a packet-source comprising the first computing device so as to obtain data contained therein;
the third computing device preserving the given packet address of the one or more obtained packets such that the one or more obtained packets do not appear to have been obtained by the third computing device; and
the third computing device re-encrypting the one or more obtained packets using a security association established for a packet-destination comprising the second computing device, and forwarding the one or more packets toward the packet-destination;
wherein the one or more packets forwarded toward the packet-destination have the given packet address; and
wherein the interception routing policy re-routes bearer flows from the packet-source and the packet-destination to the third computing device.

2. The method of claim 1 , wherein the element of the communication network in which the interception routing policy is implemented comprises a device connected in a local area network in which the third computing device is connected.

3. The method of claim 2 , wherein the element comprises a switching element.

4. The method of claim 3 , wherein the interception routing policy is implemented in the switching element by modifying a forwarding table in the switching element to cause the one or more packets having the given packet address associated with one of the first computing device and the second computing device to be forwarded to the third computing device.

5. The method of claim 4 , further comprising the third computing device decrypting the one or more packets.

6. The method of claim 4 , further comprising the third computing device copying the one or more packets before forwarding the one or more packets toward the packet-destination.

7. The method of claim 6 , further comprising the third computing device forwarding the one or more copied packets to another entity for decryption.

8. The method of claim 1 , wherein the element of the communication network in which the interception routing policy is implemented comprises a device that is remote from the third computing device.

9. The method of claim 8 , wherein the element comprises a routing element through which one of the first computing device and the second computing device accesses the communication network.

10. The method of claim 9 , further comprising the third computing device, with knowledge of a security association for the packet-source, decrypting the one or more routed packets to obtain the data contained therein.

11. The method of claim 10 , further comprising the third computing device, with knowledge of a security association for the packet-destination, re-encrypting the one or more routed packets before forwarding the one or more packets.

12. The method of claim 9 , further comprising the third computing device establishing a virtual private network (VPN) tunnel with the routing element.

13. The method of claim 12 , wherein the interception routing policy is implemented in the routing element by instructing the routing element to encapsulate the one or more packets having the given packet address associated with one of the first computing device and the second computing device, and to route the one or more encapsulated packets through the established VPN tunnel to the third computing device.

14. The method of claim 13 , further comprising the third computing device establishing a second virtual private network (VPN) tunnel with a second routing element, the second routing element being a routing element through which the other of the first computing device and the second computing device accesses the communication network.

15. The method of claim 14 , wherein the one or more packets are re-encrypted by the third computing device after the data contained therein is obtained, encapsulated, and routed through the second established VPN tunnel to the second computing device.

16. The method of claim 1 , wherein the third computing device comprises a lawful interception server (LIS).

17. The method of claim 16 , wherein the LIS comprises a signaling element and at least one bearer element.

18. The method of claim 16 , wherein the element of the communication network in which the interception routing policy is implemented is the LIS.

19. The method of claim 1 , wherein the given packet address comprises a source address and a destination address, the source address being associated with the packet-source and the destination address being associated with the packet-destination.

20. The method of claim 1 , wherein the one or more packets forwarded toward the packet-destination comprise original header information of the one or more obtained packets.

21. An apparatus for intercepting encrypted communications exchanged between a first computing device and a second computing device in a communication network, the apparatus comprising:
a memory; and
a processor coupled to the memory and operative to:
obtain one or more packets which are encrypted as part of an end-to-end encryption session associated with the first computing device and the second computing device, the one or more packets having a given packet address associated with one of the first computing device and the second computing device, wherein the one or more packets are obtained in response to at least one interception routing policy being implemented in at least one element in the communication network which is also responsible for routing non-intercepted packet traffic therethrough, wherein the at least one interception routing policy is configured to forward packets having the given packet address to the third computing device;
decrypt the one or more obtained packets using a security association established for a packet-source comprising the first computing device so as to obtain data contained therein;
preserve the given packet address of the one or more obtained packets such that the one or more obtained packets do not appear to have been obtained by the third computing device;
re-encrypt the one or more obtained packets using a security association established for a packet-destination comprising the second computing device; and
forward the one or more packets toward the packet-destination;
wherein the one or more packets forwarded toward the packet-destination have the given packet address; and
wherein the intercep

Assignees

• Heck John Frederick
• Sundaram Ganapathy S
• Varney Douglas William
• Alcatel Lucent

Inventors

• Heck John Frederick
• Sundaram Ganapathy S
• Varney Douglas William

Classifications

• H04L63/306 Primary

  intercepting packet switched data communications, e.g. Web, Internet or IMS communications · CPC title

• H04L63/0464

  using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• H04L65/1016

  IP multimedia subsystem [IMS] · CPC title