Method and system for performing a lawful interception provisioning

Abstract

The present disclosure relates to a method and system for performing a lawful interception provisioning The disclosure encompasses: receiving, by a transceiver unit [302] at a User Plane Function (UPF) [128], a set of UE traffic data packets associated with user equipment(s) in a network; receiving, by the transceiver unit [302] at UPF [128], a Lawful Interception (LIM) provisioning request comprising at least a target UE ID associated with a target UE; identifying, by identification unit [304] at UPF [128], target UE traffic data packet(s) from set of UE traffic data packets associated with target UE; identifying, by processing unit [306], a dedicated port associated with network based on the target UE traffic data packet; performing, by processing unit [306] at UPF [128] via the dedicated port, the lawful interception associated with the target user based on the target UE traffic data packet associated with the target user.

Description

METHOD AND SYSTEM FOR PERFORMING A LAWFUL INTERCEPTION PROVISIONINGFIELD OF THE DISCLOSURE

[0001] The present disclosure relates generally to the field of wireless communication systems. More particularly, the present disclosure relates to methods and systems for performing a lawful interception provisioning.BACKGROUND

[0002] The following description of related art is intended to provide background information pertaining to the field of the disclosure. This section may include certain aspects of the art that may be related to various features of the present disclosure. However, it should be appreciated that this section be used only to enhance the understanding of the reader with respect to the present disclosure, and not as admissions of prior art.

[0003] Wireless communication technology has rapidly evolved over the past few decades, with each generation bringing significant improvements and advancements. The first generation of wireless communication technology was based on analog technology and offered only voice services. However, with the advent of the second-generation (2G) technology, digital communication and data services became possible, and text messaging was introduced. Third generation (3G) technology marked the introduction of high-speed internet access, mobile video calling, and location-based services. The fourth-generation (4G) technology revolutionized wireless communication with faster data speeds, better network coverage, and improved security. Currently, the fifth-generation (5G) technology is being deployed, promising even faster data speeds, low latency, and the ability to connect multiple devices simultaneously. With each generation, wireless communication technology has become more advanced, sophisticated, and capable of delivering more services to its users.

[0004] There are situations wherein law enforcement requires telecom operators to intercept and share data such as location and call details of a UE associated with a person, and the telecom operators in such a scenario are legally bound to comply with such a request. Therefore, the telecom operators put these UEs on the intercept / surveillance and their signals and data records related to that UE are intercepted which is then shared with the law enforcement agencies. Thedirection to put a UE on intercept / surveillance within the system and the network is received from the SMF (Session Management Function) and therefore the system forwards all the data such as browser data, Call data record (CDR) through an interface which is not very secure. Hence there is dire need for this data to be encrypted and delivered swiftly on a secure interface, as this is highly confidential data.

[0005] In the existing systems, there is only one interface provided between SMF and UPF (User Plane Function), that is N4 which uses Packet Forwarding Control Protocol (PFCP). Any message or direction, or data travelling between UPF and SMF on the N4 interface should be fully secure. But if we fully secure and encrypt the entire interface, troubleshooting for the engineers becomes tough as they will not be able to see the problem in the interface since it is fully secured. For example, SMF may be in Delhi and UPF may be in Mumbai, and if there is any issue in the interface which is completely encrypted, it would be cumbersome for the engineers to pinpoint the problem. Further, the operation of maintaining such large volume of encrypted message is a non- feasible task in terms of maintenance.

[0006] Further, over the period of time various solutions have been developed to improve the security of these data such as to add proprietary Identity Element (IE), as this was not visible to anyone. However, there are certain challenges with existing solutions such as a whole message may be vulnerable and therefore anyone could hack and access the information.

[0007] Thus, there exists an imperative need in the art to share the data with the law enforcement in a secure and swift way, which the present disclosure aims to address.OBJECTS OF THE INVENTION

[0008] Some of the objects of the present disclosure, which at least one embodiment disclosed herein satisfies are listed herein below.

[0009] It is an object of the present disclosure to provide a system and a method for secured transfer and sharing of data with the law enforcement.

[0010] It is another object of the present disclosure to provide a solution that aims to provide a fast transfer and sharing of data with the law enforcement.

[0011] It is yet another object of the present disclosure to provide a solution to perform a lawful interception provisioning.SUMMARY

[0012] This section is provided to introduce certain aspects of the present disclosure in a simplified form that are further described below in the detailed description. This summary is not intended to identify the key features or the scope of the claimed subject matter.

[0013] A first aspect of the present disclosure relates to a method for performing a lawful interception provisioning. The method includes receiving, by a transceiver unit at a User Plane Function (UPF) in the network, a set of user equipment (UE) traffic data packets associated with one or more user in the network. The method further comprises receiving, by the transceiver unit at the UPF in the network, a Lawful Interception (LIM) provisioning request including at least a target User Equipment ID (target UE ID) associated with a target user equipment. The method further includes identifying, by an identification unit at the UPF in the network, at least one target UE traffic data packet from the set of UE traffic data packets associated with the target user equipment based on the LIM provisioning request. The method further encompasses identifying, by a processing unit at the UPF in the network, a dedicated port associated with the network based on the target UE traffic data packet. The method further includes performing, by the processing unit at the UPF in the network via the dedicated port, the lawful interception provisioning associated with the target user equipment based on at least the identified dedicated port.

[0014] In an aspect of the present disclosure, the lawful interception provisioning associated with the target user equipment is performed by the processing unit via at least one of a N4 interface associated with the dedicated port and an interface of the network over Internet Protocol Security (IP SEC) / Transport Layer Security 2 (TLSv2) protocol associated with the dedicated port.

[0015] In an aspect of the present disclosure, each UE traffic data packet from the set of UE traffic data packets includes at least one of a user equipment identity (UE ID) associated with said each UE traffic data packet, a geographical location associated with said each UE traffic data packet, and a call detail record associated with said each UE traffic data packet, and wherein each UE ID is associated with at least a unique mobile identification number of a user equipment.

[0016] In an aspect of the present disclosure, the target UE traffic data packet from the set of UE traffic data packets associated with target user equipment is identified based on matching at least the target UE ID associated with the target user equipment and a UE ID associated with at least one UE traffic data packet from the set of UE traffic data packets.

[0017] Another aspect of the present invention relates to a system for performing a lawful interception provisioning. The system includes a transceiver unit, configured to receive, at a User Plane Function (UPF), a set of user equipment (UE) traffic data packets associated with one or more user equipment in a network; and receive, at the UPF, a Lawful Interception (LIM) provisioning request comprising at least a target user equipment identity (UE ID) associated with a target user equipment. Furthermore, the system includes an identification unit connected to at least the transceiver unit, the identification unit configured to identify, at the UPF, at least one target UE traffic data packet from the set of UE traffic data packets associated with the target user equipment based on the LIM provisioning request. The system further encompasses a processing unit connected to at least the identification unit, the processing unit is configured to identify, at the UPF, a dedicated port associated with the network based on the target UE traffic data packet; and perform, at the UPF via the dedicated port, the lawful interception provisioning associated with the target user equipment based on at least the target UE traffic data packet.

[0018] Yet another aspect of present invention relates to a non-transitory computer-readable storage medium storing instructions for performing a lawful interception provisioning, the instructions include an executable code which, when executed by one or more units of a system, causes: a transceiver unit of the system to: 1) receive at a User Plane Function (UPF), a set of user equipment traffic data packets associated with one or more user equipment in a network, and 2) receive, at the UPF, a lawful interception provisioning request including at least a target user equipment identity (target UE ID) associated with a target user equipment; an identification unit of the system to identify, at the UPF, at least one target UE traffic data packet from the set of UE traffic data packets associated with the target user equipment based on the LIM provisioning request; and a processing unit of the system to: 1) identify, at the UPF, a dedicated port associated with the network based on the target UE traffic data packet, and 2) perform, at the UPF via the dedicated port, the lawful interception provisioning associated with the target user equipment based on at least the target UE traffic data packet.BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings, which are incorporated herein, and constitute a part of this disclosure, illustrate exemplary embodiments of the disclosed methods and systems in which like reference numerals refer to the same parts throughout the different drawings. Components in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. Some drawings may indicate the components using block diagrams and may not represent the internal circuitry of each component. It will be appreciated by those skilled in the art that disclosure of such drawings includes disclosure of electrical components, electronic components or circuitry commonly used to implement such components.

[0020] FIG. 1, illustrating a 5GC network architecture comprising a plurality of network nodes.

[0021] FIG. 2 illustrates an an exemplary block diagram of a computing device

[1000] upon which an embodiment of the present disclosure may be implemented for performing a lawful interception provisioning, in accordance with exemplary embodiments of the present disclosure.

[0022] FIG.3 illustrates an exemplary block diagram of a system for performing a lawful interception provisioning, in accordance with exemplary embodiments of the present disclosure.

[0023] FIG.4 illustrates an exemplary scenario method flow diagram indicating the process for performing a lawful interception provisioning, in accordance with exemplary embodiments of the present disclosure.

[0024] The foregoing shall be more apparent from the following more detailed description of the disclosure.DETAILED DESCRIPTION

[0025] In the following description, for the purposes of explanation, various specific details are set forth in order to provide a thorough understanding of embodiments of the present disclosure. It will be apparent, however, that embodiments of the present disclosure may be practiced without these specific details. Several features described hereafter can each be used independently of one another or with any combination of other features. An individual feature may not address any of the problems discussed above or might address only some of the problems discussed above. Some of the problems discussed above might not be fully addressed by any of the features describedherein. Example embodiments of the present disclosure are described below, as illustrated in various drawings in which like reference numerals refer to the same parts throughout the different drawings.

[0026] The ensuing description provides exemplary embodiments only, and is not intended to limit the scope, applicability, or configuration of the disclosure. Rather, the ensuing description of the exemplary embodiments will provide those skilled in the art with an enabling description for implementing an exemplary embodiment. It should be understood that various changes may be made in the function and arrangement of elements without departing from the spirit and scope of the disclosure as set forth.

[0027] It should be noted that the terms "mobile device", "user equipment", "user device", “communication device”, “device” and similar terms are used interchangeably for the purpose of describing the invention. These terms are not intended to limit the scope of the invention or imply any specific functionality or limitations on the described embodiments. The use of these terms is solely for convenience and clarity of description. The invention is not limited to any particular type of device or equipment, and it should be understood that other equivalent terms or variations thereof may be used interchangeably without departing from the scope of the invention as defined herein.

[0028] Specific details are given in the following description to provide a thorough understanding of the embodiments. However, it will be understood by one of ordinary skill in the art that the embodiments may be practiced without these specific details. For example, circuits, systems, networks, processes, and other components may be shown as components in block diagram form in order not to obscure the embodiments in unnecessary detail. In other instances, well-known circuits, processes, algorithms, structures, and techniques may be shown without unnecessary detail in order to avoid obscuring the embodiments.

[0029] Also, it is noted that individual embodiments may be described as a process which is depicted as a flowchart, a flow diagram, a data flow diagram, a structure diagram, or a block diagram. Although a flowchart may describe the operations as a sequential process, many of the operations can be performed in parallel or concurrently. In addition, the order of the operations may be re-arranged. A process is terminated when its operations are completed but could have additional steps not included in a figure.

[0030] The word “exemplary” and / or “demonstrative” is used herein to mean serving as an example, instance, or illustration. For the avoidance of doubt, the subject matter disclosed herein is not limited by such examples. In addition, any aspect or design described herein as “exemplary” and / or “demonstrative” is not necessarily to be construed as preferred or advantageous over other aspects or designs, nor is it meant to preclude equivalent exemplary structures and techniques known to those of ordinary skill in the art. Furthermore, to the extent that the terms “includes,” “has,” “contains,” and other similar words are used in either the detailed description or the claims, such terms are intended to be inclusive — in a manner similar to the term “comprising” as an open transition word — without precluding any additional or other elements.

[0031] As used herein, an “electronic device”, or “portable electronic device”, or “user device” or “communication device” or “user equipment” or “device” refers to any electrical, electronic, electromechanical and computing device. The user device is capable of receiving and / or transmitting one or parameters, performing function / s, communicating with other user devices and transmitting data to the other user devices. The user equipment may have a processor, a display, a memory, a battery and an input-means such as a hard keypad and / or a soft keypad. The user equipment may be capable of operating on any radio access technology including but not limited to IP-enabled communication, Zig Bee, Bluetooth, Bluetooth Low Energy, Near Field Communication, Z-Wave, Wi-Fi, Wi-Fi direct, etc. For instance, the user equipment may include, but not limited to, a mobile phone, smartphone, virtual reality (VR) devices, augmented reality (AR) devices, laptop, a general-purpose computer, desktop, personal digital assistant, tablet computer, mainframe computer, or any other device as may be obvious to a person skilled in the art for implementation of the features of the present disclosure.

[0032] Further, the user device may also comprise a “processor” or “processing unit” includes processing unit, wherein processor refers to any logic circuitry for processing instructions. The processor may be a general-purpose processor, a special purpose processor, a conventional processor, a digital signal processor, a plurality of microprocessors, one or more microprocessors in association with a DSP core, a controller, a microcontroller, Application Specific Integrated Circuits, Field Programmable Gate Array circuits, any other type of integrated circuits, etc. The processor may perform signal coding data processing, input / output processing, and / or any other functionality that enables the working of the system according to the present disclosure. More specifically, the processor is a hardware processor.

[0033] As used herein, “a user equipment”, “a user device”, “a smart-user-device”, “a smartdevice”, “an electronic device”, “a mobile device”, “a handheld device”, “a wireless communication device”, “a mobile communication device”, “a communication device” may be any electrical, electronic and / or computing device or equipment, capable of implementing the features of the present disclosure. The user equipment / device may include, but is not limited to, a mobile phone, smart phone, laptop, a general-purpose computer, desktop, personal digital assistant, tablet computer, wearable device or any other computing device which is capable of implementing the features of the present disclosure. Also, the user device may contain at least one input means configured to receive an input from at least one of a transceiver unit, a processing unit, a storage unit, an identification unit and any other such unit(s) which are required to implement the features of the present disclosure.

[0034] As used herein, “storage unit” or “memory unit” refers to a machine or computer-readable medium including any mechanism for storing information in a form readable by a computer or similar machine. For example, a computer-readable medium includes read-only memory (“ROM”), random access memory (“RAM”), magnetic disk storage media, optical storage media, flash memory devices or other types of machine-accessible storage media. The storage unit may be a part of the system as disclosed in the present disclosure or may be connected to said system. The storage unit stores at least the data that may be required by one or more units of the system to perform their respective functions.

[0035] As used herein “interface” or “user interface refers to a shared boundary across which two or more separate components of a system exchange information or data. The interface may also be referred to a set of rules or protocols that define communication or interaction of one or more modules or one or more units with each other, which also includes the methods, functions, or procedures that may be called.

[0036] All modules, units, components used herein, unless explicitly excluded herein, may be software modules or hardware processors, the processors being a general-purpose processor, a special purpose processor, a conventional processor, a digital signal processor (DSP), a plurality of microprocessors, one or more microprocessors in association with a DSP core, a controller, a microcontroller, Application Specific Integrated Circuits (ASIC), Field Programmable Gate Array circuits (FPGA), any other type of integrated circuits, etc.

[0037] As used herein the transceiver unit include at least one receiver and at least one transmitter configured respectively for receiving and transmitting data, signals, information or a combination thereof between units / components within the system and / or connected with the system.

[0038] As portable electronic devices and wireless technologies continue to improve and grow in popularity, the advancing wireless technologies for data transfer are also expected to evolve and replace the older generations of technologies. In the field of wireless data communications, the dynamic advancement of various generations of cellular technology is also seen. The development, in this respect, has been incremental in the order of second generation (2G), third generation (3G), fourth generation (4G), and now fifth generation (5G), and more such generations are expected to continue in the forthcoming time.

[0039] Radio Access Technology (RAT) refers to the technology used by mobile devices / user equipment (UE) to connect to a cellular network. It refers to the specific protocol and standards that govern the way devices communicate with base stations, which are responsible for providing the wireless connection. Further, each RAT has its own set of protocols and standards for communication, which define the frequency bands, modulation techniques, and other parameters used for transmitting and receiving data. Examples of RATs include GSM (Global System for Mobile Communications), CDMA (Code Division Multiple Access), UMTS (Universal Mobile Telecommunications System), LTE (Long-Term Evolution), and 5G. The choice of RAT depends on a variety of factors, including the network infrastructure, the available spectrum, and the mobile device's / device's capabilities. Mobile devices often support multiple RATs, allowing them to connect to different types of networks and provide optimal performance based on the available network resources.

[0040] As discussed in the background section, the current known solutions for performing a lawful interception provisioning have several shortcomings.

[0041] The present disclosure aims to overcome the above-mentioned and other existing problems in this field of technology by providing a dedicated port for the flow of identified targeted traffic data packets. Particularly, according to the solution as provided in the present disclosure to ensure proper security for all the lawful interception provisions done at User Plane Function (UPF), provision of Separate Port for Lawful Provisioning is made. Also, basis the present solution, during a provisioning of a target, as a result of the dedicated port used, segregation of the provisioningflow from the N4 signalling traffic is achieved. Moreover, the present solution leads to helping in much faster and better debugging in case any issue is found during LI provisioning.

[0042] Hereinafter, exemplary embodiments of the present disclosure will be described with reference to the accompanying drawings.

[0043] Referring to FIG. 1, illustrating a 5th generation (5GC) network architecture comprising a plurality of network nodes. As shown in FIG. 1, the 5GC network architecture

[0100] includes a user equipment (UE)

[0102] , a radio access network (RAN)

[0104] , an access and mobility management function (AMF)

[0106] , a Session Management Function (SMF)

[0108] , a Service Communication Proxy (SCP)

[0110] , an Authentication Server Function (AUSF)

[0112] , a Network Slice Specific Authentication and Authorization Function (NSSAAF)

[0114] , a Network Slice Selection Function (NSSF)

[0116] , a Network Exposure Function (NEF)

[0118] , a Network Repository Function (NRF)

[0120] , a Policy Control Function (PCF)

[0122] , a Unified Data Management (UDM)

[0124] , an application function (AF)

[0126] , a User Plane Function (UPF)

[0128] , a data network (DN)

[0130] , wherein all the components are assumed to be connected to each other in a manner as obvious to the person skilled in the art for implementing features of the present disclosure.

[0044] The User Equipment (UE)

[0102] interfaces with the network via the Radio Access Network (RAN)

[0104] ; the Access and Mobility Management Function (AMF)

[0106] manages connectivity and mobility, while the Session Management Function (SMF)

[0108] administers session control; the service communication proxy (SCP)

[0110] routes and manages communication between network services, enhancing efficiency and security, and the Authentication Server Function (AUSF)

[0112] handles user authentication; the Network Slice Specific Authentication and Authorization Function (NSSAAF)

[0114] for integrating the 5G core network with existing 4G LTE networks i.e., to enable Non-Standalone (NSA) 5G deployments, the Network Slice Selection Function (NSSF)

[0116] , Network Exposure Function (NEF)

[0118] , and Network Repository Function (NRF)

[0120] enable network customization, secure interfacing with external applications, and maintain network function registries respectively; the Policy Control Function (PCF)

[0122] develops operational policies, and the Unified Data Management (UDM)

[0124] manages subscriber data; the Application Function (AF)

[0126] enables application interaction, the User Plane Function (UPF)

[0128] processes and forwards user data, and the Data Network (DN)

[0130] connects to external internet resources; collectively, these components are designed to enhancemobile broadband, ensure low-latency communication, and support massive machine-type communication, solidifying the 5GC as the infrastructure for next-generation mobile networks.

[0045] Radio Access Network (RAN)

[0104] is the part of a mobile telecommunications system that connects user equipment (UE)

[0102] to the core network (CN) and provides access to different types of networks (e.g., 5G network). It consists of radio base stations and the radio access technologies that enable wireless communication.

[0046] Access and Mobility Management Function (AMF)

[0106] is a 5G core network function responsible for managing access and mobility aspects, such as UE registration, connection, and reachability. It also handles mobility management procedures like handovers and paging.

[0047] Session Management Function (SMF)

[0108] is a 5G core network function responsible for managing session-related aspects, such as establishing, modifying, and releasing sessions. It coordinates with the User Plane Function (UPF) for data forwarding and handles IP address allocation and QoS enforcement.

[0048] Service Communication Proxy (SCP)

[0110] is a network function in the 5G core network that facilitates communication between other network functions by providing a secure and efficient messaging service. It acts as a mediator for service-based interfaces.

[0049] Authentication Server Function (AUSF)

[0112] is a network function in the 5G core responsible for authenticating UEs during registration and providing security services. It generates and verifies authentication vectors and tokens.

[0050] Network Slice Specific Authentication and Authorization Function (NSSAAF)

[0114] is a network function that provides authentication and authorization services specific to network slices. It ensures that UEs can access only the slices for which they are authorized.

[0051] Network Slice Selection Function (NSSF)

[0116] is a network function responsible for selecting the appropriate network slice for a UE based on factors such as subscription, requested services, and network policies.

[0052] Network Exposure Function (NEF)

[0118] is a network function that exposes capabilities and services of the 5G network to external applications, enabling integration with third-party services and applications.

[0053] Network Repository Function (NRF)

[0120] is a network function that acts as a central repository for information about available network functions and services. It facilitates the discovery and dynamic registration of network functions.

[0054] Policy Control Function (PCF)

[0122] is a network function responsible for policy control decisions, such as QoS, charging, and access control, based on subscriber information and network policies.

[0055] Unified Data Management (UDM)

[0124] is a network function that centralizes the management of subscriber data, including authentication, authorization, and subscription information.

[0056] Application Function (AF)

[0126] is a network function that represents external applications interfacing with the 5G core network to access network capabilities and services.

[0057] User Plane Function (UPF)

[0128] is a network function responsible for handling user data traffic, including packet routing, forwarding, and QoS enforcement.

[0058] Data Network (DN)

[0130] refers to a network that provides data services to user equipment (UE) in a telecommunications system. The data services may include but are not limited to Internet services, private data network related services.

[0059] FIG. 2 illustrates an exemplary block diagram of a computing device

[1000] upon which an embodiment of the present disclosure may be implemented. It is to be noted that the computing device

[1000] may be included in a system

[0300] (as shown in Fig.3). It is further noted that the computing device

[1000] is able to perform the steps of a method

[0400] (as shown in Fig. 4). In another implementation, the computing device

[1000] itself implements the method

[0400] for performing a lawful interception provisioning using one or more units configured within the computing device

[1000] , wherein said one or more units are capable of implementing the features as disclosed in the present disclosure.

[0060] The computing device

[1000] may include a bus

[1002] or other communication mechanism for communicating information, and a hardware processor

[1004] coupled with bus

[1002] for processing information. The hardware processor

[1004] may be, for example, a general- purpose microprocessor. The computing device

[1000] may also include a main memory

[1006] , such as a random-access memory (RAM), or other dynamic storage device, coupled to the bus

[1002] for storing information and instructions to be executed by the processor

[1004] , The main memory

[1006] also may be used for storing temporary variables or other intermediate information during execution of the instructions to be executed by the processor

[1004] , Such instructions, when stored in non-transitory storage media accessible to the processor

[1004] , render the computing device

[1000] into a special-purpose machine that is customized to perform the operations specified in the instructions. The computing device

[1000] further includes a read only memory (ROM)

[1008] or other static storage device coupled to the bus

[1002] for storing static information and instructions for the processor

[1004] ,

[0061] A storage device

[1010] , such as a magnetic disk, optical disk, or solid-state drive is provided and coupled to the bus

[1002] for storing information and instructions. The computing device

[1000] may be coupled via the bus

[1002] to a display

[1012] , such as a cathode ray tube (CRT), for displaying information to a computer user. An input device

[1014] , including alphanumeric and other keys, may be coupled to the bus

[1002] for communicating information and command selections to the processor

[1004] . Another type of user input device may be a cursor controller

[1016] , such as a mouse, a trackball, or cursor direction keys, for communicating direction information and command selections to the processor

[1004] , and for controlling cursor movement on the display

[1012] , This input device

[1014] typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), that allow the device to specify positions in a plane.

[0062] The computing device

[1000] may implement the techniques described herein using customized hard-wired logic, one or more ASICs or FPGAs, firmware and / or program logic which in combination with the computing device

[1000] causes or programs the computing device

[1000] to be a special -purpose machine. According to one embodiment, the techniques herein are performed by the computing device

[1000] in response to the processor

[1004] executing one or more sequences of one or more instructions contained in the main memory

[1006] , Such instructions may be read into the main memory

[1006] from another storage medium, such as the storage device

[1010] , Execution of the sequences of instructions contained in the main memory

[1006] causes the processor

[1004] to perform the process steps described herein. In alternativeembodiments, hard-wired circuitry may be used in place of or in combination with software instructions.

[0063] The computing device

[1000] also may include a communication interface

[1018] coupled to the bus

[1002] , The communication interface

[1018] provides a two-way data communication coupling to a network link

[1020] that is connected to a local network

[1022] , For example, the communication interface

[1018] may be an integrated services digital network (ISDN) card, cable modem, satellite modem, or a modem to provide a data communication connection to a corresponding type of telephone line. As another example, the communication interface

[1018] may be a local area network (LAN) card to provide a data communication connection to a compatible LAN. Wireless links may also be implemented. In any such implementation, the communication interface

[1018] sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.

[0064] The computing device

[1000] can send messages and receive data, including program code, through the network(s), the network link

[1020] and the communication interface 1018. In the Internet example, a server

[1030] might transmit a requested code for an application program through the Internet

[1028] , the ISP

[1026] , the local network

[1022] and the communication interface

[1018] ,

[0065] The Host

[1024] maybe the computing device

[1000] connected to the network . The Host

[1024] may provide information, application or services to other hosts or nodes on the network. The received code may be executed by the processor

[1004] as it is received, and / or stored in the storage device

[1010] , or other non-volatile storage for later execution.

[0066] Referring to FIG. 3, an exemplary block diagram of a system

[0300] for performing a lawful interception provisioning, is shown, in accordance with the exemplary embodiments of the present invention. The system

[0300] comprises at least one transceiver unit

[0302] , atleastone identification unit

[0304] and at least one processing unit

[0306] , Also, all of the components / units of the system

[0300] are assumed to be connected to each other unless otherwise indicated below. Also, in Fig. 3 only a few units are shown, however, the system

[0300] may comprise multiple such units or the system

[0300] may comprise any such numbers of said units, as required to implement the features of the present disclosure. Further, in an implementation, the system

[0300] may reside in a network entity. In yet another implementation, the system

[0300] may be in connection with the network entity.

[0067] The system

[0300] is configured for performing a lawful interception provisioning of target devices over a dedicated port, with the help of the interconnection between the components / units of the system

[0100] ,

[0068] Further, in accordance with the present disclosure, it is to be acknowledged that the functionality described for the various the components / units can be implemented interchangeably. While specific embodiments may disclose a particular functionality of these units for clarity, it is recognized that various configurations and combinations thereof are within the scope of the disclosure. The functionality of specific units as disclosed in the disclosure should not be construed as limiting the scope of the present disclosure. Consequently, alternative arrangements and substitutions of units, provided they achieve the intended functionality described herein, are considered to be encompassed within the scope of the present disclosure.

[0069] In order to perform a lawful interception provisioning, the transceiver unit

[0302] of the system

[0300] is configured to receive, at a User Plane Function (UPF) in the network, a set of user equipment (UE) traffic data packets associated with one or more user equipment in the network. In an implementation of the present disclosure each traffic data packet from the set of UE traffic data packets is associated with one of the one or more user equipment in the network. In an exemplary embodiment of the present solution, the transceiver unit

[0302] may be configured with a SMF (Session Management Function) and the UPF (User Plane Function) nodes wherein a flow of signals is over the N4 interface using Packet Forwarding Control (PFC) protocol.

[0070] Further, the transceiver unit

[0302] of the system

[0300] is configured to receive, at the UPF

[0128] in the network, a Lawful Interception (LIM) provisioning request comprising at least a target user equipment identity (target UE ID) associated with a target user equipment (UE). Also, in an implementation of the present disclosure, each UE traffic data packet from the set of UE traffic data packets comprises at least one of a user equipment identity (UE ID) associated with said each UE traffic data packet, a geographical location associated with said each UE traffic data packet, and a call detail record associated with said each UE traffic data packet. Also, each UE ID is associated with at least a unique mobile identification number of a UE in the network.

[0071] In one implementation, the user equipment (UE) is communicatively coupled with a network. The network comprises one or more network functions for example, UPF. The UE is configured to generate a traffic data, due to being in communication with the network. In addition,the LIM provisioning is performed in association with the UE based on method as explained below in FIG. 4.

[0072] Further, a lawful interception (LIM) provisioning request may be received from at least one of a lawful agency, or from an appropriate authority such as a court or government server which are authorised to make such a request.

[0073] Further, an identification unit

[0304] is connected to the transceiver unit

[0302] of the system

[0300] , The identification unit

[0304] is configured to identify, at the UPF

[0128] in the network, at least one target UE traffic data packet from the set of UE traffic data packets associated with the target user based on the LIM provisioning request. In an implementation of the present disclosure, the target UE traffic data packet from the set of UE traffic data packets associated with target user is identified based on matching at least the target UE ID associated with the target UE and a UE ID associated with at least one UE traffic data packet from the set of UE traffic data packets.

[0074] Further, the target traffic data packet may be associated with targeting data that comprises at least the UE ID associated with the target user. The UE ID is associated with a unique mobile identification number of the target user. Also, in an implementation, the identification unit

[0304] , based on the LIM provisioning request, identifies a signalling traffic for provisioning (i.e., the at least one target UE traffic data packet from the set of UE traffic data packets), wherein the signalling traffic is associated with at least a UE ID, and wherein said UE ID is associated with the unique mobile identification number associated with the target user equipment.

[0075] Further, the identification unit

[0304] of the system

[0300] is connected with the processing unit

[0306] that is configured to identify, at the UPF

[0128] in the network, a dedicated port associated with the network based on the target UE traffic data packet. In an embodiment of the present solution, the dedicated port associated with the network (say 5G network) may have the same IP address as associated with the target UE traffic data packet(s), such that the target UE traffic data packet(s) may travel through the N4 interface using the PFC protocol, but they have dedicated separate ports.

[0076] Further, the processing unit

[0306] of the system

[0300] is configured to perform, at the UPF

[0128] in the network via the dedicated port, the lawful interception provisioning associated with the target UE based on at least the target UE traffic data packet associated with the target UE.

[0077] Also, the lawful interception provisioning associated with the target UE is performed by the processing unit

[0306] via at least one of a N4 Interface associated with the dedicated port and an interface of the network over Internet Protocol Security (IPSEC)ZTransport Layer Security 2.0 (TLSv2) associated with the dedicated port. In an embodiment of the present solution, the target UE traffic data packets are duplicated by the processing unit

[0306] and sent separately via the dedicated separate ports to ensure security of the target UE traffic data packets and also to ensure smooth and faster transmission of the target UE traffic data packets.

[0078] Therefore, based on the implementation of features of the present disclosure, optimized debugging takes place as separate dedicated ports are used for Lawful Interception provisioning, which further segregates provisioning flow from the N4 signalling traffic. With an anticipation of increase in the signalling traffic over the N4 interface, having a dedicated port streamlines the debugging process.

[0079] In an implementation of the present solution, wherein the processing unit

[0306] configured to perform the lawful provisioning interception is further configured to perform at least one of optimising debugging of the lawful interception at the UPF

[0128] and optimising security associated with the lawful interception at the UPF

[0128] , Optimized debugging takes place as separate dedicated ports are used for Lawful Interception provisioning, which further segregates provisioning flow from the N4 signalling traffic. With an anticipation of increase in the signalling traffic over the N4 interface, having a dedicated port will streamline the debugging process.

[0080] Referring to FIG. 4, an exemplary method flow diagram

[0400] , for performing a lawful interception provisioning, in accordance with exemplary embodiments of the present invention is shown. In an implementation the method

[0400] is performed by the system

[0300] , As shown in Figure 4, the method

[0400] starts at step

[0402] .

[0081] At step

[0404] , the method

[0400] as disclosed by the present disclosure comprises receiving, by a transceiver unit

[0302] at a User Plane Function (UPF)

[0128] , a set of user equipment (UE) traffic data packets associated with one or more user equipment in a network. Also, each UE traffic data packet from the set of UE traffic data packets comprises at least one of a user equipment identity (UE ID) associated with said each UE traffic data packet, a geographical location associated with said each UE traffic data packet, and a call detail record associated with said each UE traffic data packet. Additionally, each UE ID is associated with at least a unique mobile identification number of a user equipment in the network.

[0082] In an exemplary embodiment of the present solution, the transceiver unit

[0302] may be configured with a SMF (Session Management Function) and the UPF (User Plane Function) nodes wherein a flow of signals is over the N4 interface using Packet Forwarding Control Protocol (PFCP).

[0083] Further, at step

[0406] , the method comprises receiving, by the transceiver unit

[0302] at the UPF

[0128] , a Uawful Interception (UIM) provisioning request comprising at least a target user equipment identity (target UE ID) associated with a target user equipment.

[0084] Next, at step

[0408] , the method encompasses identifying, by an identification unit

[0304] at the UPF

[0128] , at least one target UE traffic data packet from the set of UE traffic data packets associated with the target user equipment based on the LIM provisioning request. The at least one target UE traffic data packet from the set of UE traffic data packets associated with target user equipment is identified based on matching at least the target UE ID associated with the target user equipment and a UE ID associated with at least one UE traffic data packet from the set of UE traffic data packets. In an implementation, the identification unit

[0304] , based on the LIM provisioning request, identifies a signalling traffic for provisioning (i.e., the at least one target UE traffic data packet from the set of UE traffic data packets), wherein the signalling traffic is associated with at least a UE ID, and wherein said UE ID is associated with the unique mobile identification number associated with the target user equipment.

[0085] Next at step

[0410] , the method includes identifying, by a processing unit

[0306] at the UPF

[0128] , a dedicated port associated with the network based on the target UE traffic data packet. In an embodiment of the present solution, the dedicated port associated with the network (say 5G network) may have the same IP address as associated with the target UE traffic data packet(s), such that the target UE traffic data packet(s) may travel through the N4 interface using the PFC protocol but they have dedicated separate ports.

[0086] Further at step

[0412] , the method includes performing, by the processing unit

[0306] at the UPF

[0128] via the dedicated port, the lawful interception provisioning associated with the target user equipment based on at least the target UE traffic data packet. The lawful interception provisioning associated with the target user equipment is performed by the processing unit

[0306] via at least one of a N4 Interface associated with the dedicated port and an interface of the networkover Internet Protocol Security (IPSEC)ZTransport Layer Security 2.0 (TLSv2) protocol associated with the dedicated port.

[0087] In an embodiment of the present solution, the target UE traffic data packet(s) are duplicated by the processing unit

[0306] and sent separately via the dedicated separate ports to ensure security of the target UE traffic data packet(s) and also to ensure smooth and faster transmission of the target UE traffic data packet(s).

[0088] Therefore, based on the implementation of features of the present disclosure, optimized debugging takes place as separate dedicated ports are used for Lawful Interception provisioning, which further segregates provisioning flow from the N4 signaling traffic. With an anticipation of increase in the signaling traffic over the N4 interface, having a dedicated port streamlines the debugging process.

[0089] Thereafter, the method terminates at step (414).

[0090] The present disclosure relates to a non-transitory computer-readable storage medium storing instructions for performing a lawful interception provisioning, the instructions include an executable code which, when executed by one or more units of a system

[0300] , causes: a transceiver unit

[0302] of the system

[0300] to: 1) receive at a User Plane Function (UPF)

[0128] , a set of user equipment traffic data packets associated with one or more user equipment in a network, and 2) receive, at the UPF

[0128] , a lawful interception provisioning request including at least a target user equipment identity (target UE ID) associated with a target user equipment; an identification unit

[0304] of the system

[0300] to identify, at the UPF

[0128] , at least one target UE traffic data packet from the set of UE traffic data packets associated with the target user equipment based on the LIM provisioning request; and a processing unit

[0306] of the system

[0300] to: 1) identify, at the UPF

[0128] , a dedicated port associated with the network based on the target UE traffic data packet, and 2) perform, at the UPF

[0128] via the dedicated port, the lawful interception provisioning associated with the target user equipment based on at least the target UE traffic data packet.

[0091] As is evident from the above, the present disclosure provides a technically advanced solution for performing the transfer of the target traffic data packet. The present disclosure has many advantages such as the targeted traffic data is transmitted over a separate and secured port unknown to others, it will significantly improve the security of the data without having to makeany changes to regular flow of average data. Further, the flow of targeted data packages will be faster due to availability of dedicated port.

[0092] While considerable emphasis has been placed herein on the disclosed embodiments, it will be appreciated that many embodiments can be made and that many changes can be made to the embodiments without departing from the principles of the present disclosure. These and other changes in the embodiments of the present disclosure will be apparent to those skilled in the art, whereby it is to be understood that the foregoing descriptive matter to be implemented is illustrative and non-limiting.

Claims

We claim:

1. A method for performing a lawful interception provisioning, the method comprising: receiving, by a transceiver unit [302] at a User Plane Function (UPF) [128], a set of user equipment (UE) traffic data packets associated with one or more user equipment in a network; receiving, by the transceiver unit [302] at the UPF [128], a Lawful Interception (EIM) provisioning request comprising at least a target user equipment identity (target UE ID) associated with a target user equipment; identifying, by an identification unit [304] at the UPF [128], at least one target UE traffic data packet from the set of UE traffic data packets associated with the target user equipment based on the LIM provisioning request; identifying, by a processing unit [306] at the UPF [128], a dedicated port associated with the network based on the target UE traffic data packet; and performing, by the processing unit [306] at the UPF [128] via the dedicated port, the lawful interception provisioning associated with the target user equipment based on at least the target UE traffic data packet.

2. The method as claimed in claim 1, wherein the lawful interception provisioning associated with the target user equipment is performed by the processing unit [306] via at least one of a N4 Interface associated with the dedicated port and an interface of the network over Internet Protocol Security (IPSEC) / Transport Layer Security 2.0 (TLSv2) protocol associated with the dedicated port.

3. The method as claimed in claim 1, wherein each UE traffic data packet from the set of UE traffic data packets comprises at least one of a user equipment identity (UE ID) associated with said each UE traffic data packet, a geographical location associated with said each UE traffic data packet, and a call detail record associated with said each UE traffic data packet, and wherein each UE ID is associated with at least a unique mobile identification number of a user equipment.

4. The method as claimed in claim 3, wherein the target UE traffic data packet from the set of UE traffic data packets associated with target user equipment is identified based on matching at least the target UE ID associated with the target user equipment and a UE ID associated with at least one UE traffic data packet from the set of UE traffic data packets.

5. A system [300] for performing a lawful interception provisioning, the system [300] comprises: a transceiver unit [302] configured to:• receive, at a User Plane Function (UPF) [128], a set of user equipment (UE) traffic data packets associated with one or more user equipment in a network, and• receive, at the UPF [128], a Lawful Interception (EIM) provisioning request comprising at least a target user equipment identity (target UE ID) associated with a target user equipment; an identification unit [304] connected to at least the transceiver unit [302], wherein the identification unit [304] is configured to identify, at the UPF [128], at least one target UE traffic data packet from the set of UE traffic data packets associated with the target user equipment based on the LIM provisioning request; and a processing unit [306] connected to at least the identification unit [304], wherein the processing unit is configured to:• identify, at the UPF [128], a dedicated port associated with the network based on the target UE traffic data packet, and• perform, at the UPF [128] via the dedicated port, the lawful interception provisioning associated with the target user equipment based on at least the target UE traffic data packet.

6. The system [300] as claimed in claim 5, wherein the lawful interception provisioning associated with the target user equipment is performed by the processing unit [306] via at least one of a N4 Interface associated with the dedicated port and an interface of the network over Internet Protocol Security (IPSEC) / Transport Layer Security 2.0 (TLSv2) protocol associated with the dedicated port.

7. The system [300] as claimed in claim 5, wherein each UE traffic data packet from the set of UE traffic data packets comprises at least one of a user equipment identity (UE ID) associated with said each UE traffic data packet, a geographical location associated with said each UE traffic data packet, and a call detail record associated with said each UE traffic data packet, and wherein each UE ID is associated with at least a unique mobile identification number of a user equipment.

8. The system [300] as claimed in claim 7, wherein the target UE traffic data packet from the set of UE traffic data packets associated with target user equipment is identified based on matchingat least the target UE ID associated with the target user equipment and a UE ID associated with at least one UE traffic data packet from the set of UE traffic data packets.

9. A non-transitory computer readable storage medium for performing a lawful interception provisioning, the storage medium comprising executable code which, when executed by one or more units of a system [300], causes: a transceiver unit [302] to:• receive, at a User Plane Function (UPF) [128], a set of user equipment (UE) traffic data packets associated with one or more user equipment in a network, and• receive, at the UPF [128], a Lawful Interception (LIM) provisioning request comprising at least a target user equipment identity (target UE ID) associated with a target user equipment; an identification unit [304] connected to at least the transceiver unit [302], to identify, at the UPF [128], at least one target UE traffic data packet from the set of UE traffic data packets associated with the target user equipment based on the LIM provisioning request; and a processing unit [306] connected to at least the identification unit [304], to:• identify, at the UPF [128], a dedicated port associated with the network based on the target UE traffic data packet, and• perform, at the UPF [128] via the dedicated port, the lawful interception provisioning associated with the target user equipment based on at least the target UE traffic data packet.

Images