Method, system and computer readable medium for routing packets for lawful interception

Abstract

A method, system, and computer-readable medium for routing packets for lawful intercept (LI). The system includes at least one session border controller (SBC), where the at least one SBC is configured to forward media streams to a forwarding function. The system includes a forwarding function implemented on a centralized node for a telecommunications network. The forwarding function is configured to receive the media streams and forward each media stream to a respective lawful intercept intermediary server in at least one country associated with the media stream. In response to receiving a first packet of a first media stream from the SBC, the forwarding function is configured to perform a destination lookup for the first media stream and send an intermediary server identifier for the first media stream to the SBC. The SBC can be configured to send a session release indicator and a direction flag to the forwarding function.

Description

[Technical field]

[0001] Priority claim This application claims the benefit of priority to U.S. Patent Application No. 17 / 006,800, filed August 29, 2020, the disclosure of which is incorporated herein by reference in its entirety.

[0002] Technical Field The subject matter described herein relates to methods and systems for routing packets for Lawful Interception (LI). More particularly, the subject matter described herein relates to methods, systems, and computer-readable media for routing packets for LI in a centralized network. [Background technology]

[0003] background Some telecommunications network operators deploy centralized networks to provide session-based communication services over IP (voice or multimedia) to users from multiple countries. These networks may use Session Border Controllers (SBCs), which are typically placed between two service provider networks (i.e., interconnect / peering SBCs) or between access and backbone networks (i.e., access SBCs) to serve residential and / or business customers. These SBCs are typically deployed at the border between two Voice over IP (VoIP) networks, and therefore would be a good place to implement a lawful intercept solution.

[0004] Enabling lawful interception in a centralized network may require provisioning of authorizations (legally permitted interception targets and associated regulations) for access to Session Border Controllers deployed outside the respective country. Some countries have regulatory provisions that prohibit this practice, as authorizations are considered sensitive information.

[0005] Therefore, what is needed is a method, system, and computer readable medium for routing packets for LI in a centralized network. Summary of the Invention

[0006] overview A method, system, and computer-readable medium for routing packets for lawful interception. In one aspect, the system includes at least one Session Border Controller (SBC), the at least one SBC configured to forward a plurality of media streams to a forwarding function. The system includes the forwarding function implemented on a centralized node for a telecommunications network, the centralized node comprising one or more processors. The forwarding function is configured to receive the plurality of media streams and forward each media stream to a respective lawful intercept intermediary server of at least one country associated with the media stream.

[0007] The forwarding function is configured to, in response to receiving a first packet of a first media stream from the at least one SBC, perform a destination lookup for the first media stream and send an intermediary server identifier for the first media stream to the at least one SBC. The at least one SBC is configured to store the intermediary server identifier and send the intermediary server identifier to the forwarding function together with each subsequent packet of a plurality of subsequent packets of the first media stream.

[0008] In some examples, the forwarding function is configured, in response to receiving the subsequent packets, to use the intermediary server identifier to route each subsequent packet of the subsequent packets to a first lawful intercept intermediary server identified by the intermediary server identifier. The at least one SBC may be configured to transmit a first correlation identifier for the first media stream along with the first packet and the subsequent packets of the first media stream.

[0009] The forwarding function may be configured to associate the first correlation identifier of the first media stream with the intermediary server identifier during a mapping of correlation identifiers to the lawful intercept intermediary server. The forwarding function may be configured, in response to receiving a second packet including a second correlation identifier and no intermediary server identifier, to use the mapping of correlation identifiers to route the second packet to a second lawful intercept intermediary server associated with the second correlation identifier during the mapping of correlation identifiers.

[0010] In some examples, the first packet of the first media stream is a signaling packet that establishes the first media stream, and each subsequent packet of the subsequent packets is a media packet. In general, a subsequent packet may be either a signaling packet or a media packet. In some examples, the at least one SBC is an access SBC configured to provide access to a telecommunications service provider access network.

[0011] In another aspect, a system includes at least one Session Border Controller (SBC) configured to forward a plurality of media streams to a forwarding function implemented on a centralized node for a telecommunications network, the centralized node comprising one or more processors, the forwarding function configured to receive the plurality of media streams and forward each media stream to a respective lawful intercept intermediary server of at least one country associated with the media stream.

[0012] The at least one SBC is configured to transmit a first correlation identifier for a first media stream along with a first packet and a number of subsequent packets of the first media stream.

[0013] The forwarding function is configured, in response to receiving the first packet, to perform a destination lookup for the first media stream to associate the first correlation identifier of the first media stream with an intermediary server identifier in mapping a correlation identifier to the lawful intercept intermediary server. The at least one SBC is configured, in response to determining that the first media stream has terminated, to send a second packet of the first media stream to the forwarding function with a session release indicator.

[0014] In some examples, the forwarding function is configured to receive the session release indicator and, in response to receiving the session release indicator, remove an association between the first correlation identifier of the first media stream and the intermediary server identifier in the mapping of correlation identifiers to the lawful intercept intermediary server.

[0015] The forwarding function may be configured, in response to receiving the subsequent packets, to use the intermediary server identifier to route each subsequent packet of the subsequent packets to a first lawful intercept intermediary server identified by the intermediary server identifier.

[0016] The forwarding function may be configured, in response to receiving a second packet that includes a second correlation identifier and does not include an intermediary server identifier, to use the mapping of correlation identifiers to route the second packet to a second lawful intercept intermediary server that is associated with the second correlation identifier during the mapping of correlation identifiers.

[0017] In some examples, the first packet of the first media stream is a signaling packet establishing the first media stream and each subsequent packet of the subsequent packets is a media packet. In some examples, the at least one SBC is an access SBC configured to provide access to a telecommunications service provider access network.

[0018] In another aspect, a system includes at least one Session Border Controller (SBC) configured to forward a plurality of media streams to a forwarding function implemented on a centralized node for a telecommunications network, the centralized node comprising one or more processors, the forwarding function configured to receive the plurality of media streams and forward each media stream to a respective lawful intercept intermediary server of at least one country associated with the media stream.

[0019] The at least one SBC is configured to send a first direction indicator to the forwarding function along with a first packet of a first media stream, the first direction indicator specifying whether the first packet is an inbound or outbound initial request, and in response to receiving the first packet, the forwarding function is configured to perform a destination lookup for the first media stream using the first direction indicator.

[0020] In some examples, the forwarding function is configured to, in response to determining that the first direction indicator specifies an inbound initial request, perform the destination lookup using a source user identity of the first packet. The forwarding function may be configured to, in response to determining that the first direction indicator specifies an outbound initial request, perform the destination lookup using a destination user identity of the first packet.

[0021] The at least one SBC may be configured to transmit a first correlation identifier of the first media stream along with the first packet and multiple subsequent packets of a first media stream.

[0022] The forwarding function may be configured, in response to receiving the first packet, to associate the first correlation identifier of the first media stream with an intermediary server identifier during a mapping of correlation identifiers to the lawful intercept intermediary server. The forwarding function is configured, in response to receiving the subsequent packets, to use the intermediary server identifier to route each subsequent packet of the subsequent packets to a first lawful intercept intermediary server identified by the intermediary server identifier.

[0023] In some examples, the first packet of the first media stream is a signaling packet that establishes the first media stream, and each subsequent packet of the subsequent packets is a media packet. In general, a subsequent packet may be either a signaling packet or a media packet.

[0024] The subject matter described herein may be implemented in software in combination with hardware and / or firmware. For example, the subject matter described herein may be implemented in software executed by a processor. In one exemplary implementation, the subject matter described herein may be implemented using a computer-readable medium having computer-executable instructions stored thereon that, when executed by a processor of a computer, control a computer to perform steps.

[0025] Exemplary computer-readable media suitable for implementing the subject matter described herein include non-transitory devices such as disk memory devices, chip memory devices, programmable logic devices, and application specific integrated circuits, and the computer-readable media implementing the subject matter described herein may be located on a single device or computing platform or may be distributed across multiple devices or computing platforms. [Brief description of the drawings]

[0026] [Figure 1] FIG. 1 is a block diagram of an example network environment for routing packets for lawful interception. [Diagram 2] 1 is a block diagram of an exemplary network environment for establishing lawful interception of an exemplary telephone call. [Diagram 3] FIG. 2 is a block diagram illustrating an example packet transmitted for an example of packet forwarding for lawful interception. [Figure 4]FIG. 1 is a flow diagram of an example method for routing packets for lawful interception in an example forwarding function. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0027] Detailed Description Telecommunications network equipment providers can empower their network nodes (e.g., SBCs) to replicate signaling (e.g., SIP) and media (e.g., RTP, MSRP) traffic passing through them to LI Intermediary Servers (hereafter referred to as LI-MS) deployed in the respective countries, i.e., the countries of the source / calling user and the destination / called user. This allows authorizations to stay within each country's network, so that they can be easily controlled and managed locally by the Law Enforcement Agency (LEA) of each country.

[0028] Hereafter, the module / function responsible for forwarding these packets to the LI-MS of each country is referred to as the Forwarding Function (FF). In general, the FF will need to provision destination and routing lookup rules to determine the destination country (and its LI-MS) based on the source / destination user identity from the signaling packet.

[0029] A centralized network typically consists of hundreds of access / interconnect SBCs (which may be referred to as replication nodes or RNs) and can serve the needs of dozens of countries. Implementing FF on the RNs would require configuring and maintaining routing rules on all these nodes in addition to having to manage too many connections.

[0030] Therefore, it would be useful to deploy a separate dedicated network node, i.e. a centralized FF, that terminates packets from all replication nodes and forwards them to the LI-MS of each country, even if it means more traffic between RN and FF.

[0031] In this approach, the RN embeds the original signaling and media packets into an outer packet that is sent to the FF. The FF then performs a destination lookup for each session and forwards all packets in that session to the LI-MS. This RN-FF interface can use any proprietary or standard protocol, such as Diameter, SIP, or IPFIX (Internet Protocol Flow Information Export).

[0032] Typically, there will be one connection / stream (one each for signaling and media) from each RN to the FF that carries all the replicated signaling and media packets from the multiple connections / streams on the RN.

[0033] In the centralized FF approach, the challenge is to correlate the signaling and media streams on the FF for all traffic from all RNs. This correlation is necessary because media packets do not normally contain the information necessary to perform a destination lookup. They must be routed towards the LI-MS pre-determined for the signaling packets that established the session to which these media packets belong.

[0034] The FF may be configured to process the embedded signaling packets and also maintain information about all reproduced signaling and media streams so that it can correlate the two. In some examples, the FF may also send a correlation ID with each signaling and media packet from the RN to the FF.

[0035] In some examples, the RN (e.g., SBC) stores this correlation, so the additional overhead to transmit this information may be minimal. The correlation ID, together with the RN identity, can uniquely identify the reproduced stream on the FF.

[0036] This allows the FF to create and maintain an association / mapping between a correlation ID (which uniquely identifies a particular stream / dialog) and the destination routing towards the corresponding LI-MS. This mapping is created when the first signaling packet for a new session arrives at the FF.

[0037] This approach saves the FF from parsing every packet in the session and performing a destination lookup, but still requires the FF to perform a lookup on the correlation ID->LI-MS mapping. This could be a per-RN mapping or a global mapping if the correlation ID is globally unique across all RNs. Since the FF has to handle traffic from hundreds of RNs, each hosting millions of subscribers, it could easily become a bottleneck.

[0038] The system described herein can enhance the above system architecture using one or more of the following three features:

[0039] 1) Improved forwarding logic in FF This feature is achieved by:

[0040] sending a LI-MS identifier (MS-ID) from the FF back to the RN after a destination lookup for the first packet of the new dialog has been performed; and Store this MS-ID in the replication node or access SBC (A-SBC) and send it towards the FF together with the correlation ID in each subsequent packet of the session.

[0041] When a packet arrives, the FF will look for the presence of an MS-ID in the outer packet (e.g., IPFIX). If present, the packet can be forwarded directly towards the associated LI-MS without having to do a correlation ID lookup or parsing the embedded packet. Any packets arriving at the FF without an MS-ID can fall back to a correlation ID lookup.

[0042] 2) Improved cleanup of correlation ID->MS-ID mapping Typically, the FF is configured to determine dialog termination (e.g., SIP BYE / CANCEL) so that the correlation ID->MS-ID association / mapping can be removed, which may require parsing all signaling packets, which would be additional overhead for the FF having to process millions of packets per second from all RNs.

[0043] This feature can alleviate this burden by sending a "session released" flag as additional metadata in every packet from the RN to the FF. Since the RN already keeps track of the session, it has this information available while replaying the packet to the FF. And the FF only needs to watch for this flag in the outer packets instead of parsing any "embedded" signaling packets, saving a lot of CPU cycles.

[0044] 3) Preventing unnecessary replication when the sending and receiving users are in different countries Some network nodes (e.g., SBCs) maintain two separate legs per session, one at the client and the other at the server, also referred to as the client dialog and the server dialog.

[0045] In case of call forking, there may be more than one dialog with the server. Packets coming into these SBCs (or other proxy nodes) are expected to be sometimes modified before being sent out on the other side. Therefore, it is useful to replay packets from all dialogs of a session separately.

[0046] In a centralized LI architecture, if the source and destination users of a session are in different countries, the source country will be interested in packets coming from or towards the user and will not want to receive packets coming from or towards the destination user.

[0047] The features described in this section will enable the FF to selectively search and determine the MS-IDs for different dialogs of the same session by having the RN also send a "direction" flag to the FF. This "direction (ingress / egress)" flag, together with a signaling packet (e.g., SIP INVITE) that establishes a new dialog, helps the FF to determine whether the packet belongs to the ingress or egress leg of the call at the RN and use the calling or called user identity (e.g., SIP FROM / TO headers) accordingly in the destination lookup.

[0048] In this way, FF associates different countries (or MS-IDs) with different dialogs of the same session, thereby replicating packets only from the relevant dialog to each country's LI-MS. Without this flag, FF can still prevent unnecessary replication, but only when both source and destination users belong to the same country. The proposed flag helps to achieve this even when users are in different countries.

[0049] 1 is a block diagram of an example network environment 100 for routing packets for lawful interception. The network environment 100 includes a centralized telecommunications network 102 that provides telecommunications services to multiple different networks 104, 106, and 108 in different countries. The centralized telecommunications network 102 includes multiple session border controllers (SBCs) 110 and a forwarding function 112. The forwarding function 112 is implemented on a centralized computing node having one or more processors.

[0050] In general, an SBC is a system of one or more computers configured, through appropriate programming, to control the signaling and media streams used in setting up, conducting, and tearing down telephone calls and other types of media communications. For example, an SBC can control Voice over Internet Protocol (VoIP) calls.

[0051] In some cases, an SBC may be deployed at the boundary between two service provider networks in a peering environment or between a service provider's access network and backbone network to provide services to the service provider's customers.

[0052] SBC 110 is configured to forward media streams, e.g., voice and video calls and other types of media, to forwarding function 112. Forwarding function 112 is configured to receive these media streams and forward each media stream to a respective lawful intercept intermediary server (one of servers 114, 116, and 118) for at least one country associated with the media stream. In some examples, forwarding function 112 is implemented as an enhanced SBC.

[0053] The centralized telecommunications network 102 may be configured to achieve one, two or three of the above three features as follows.

[0054] 1. Improved forwarding logic in forwarding function 112 In some examples, the forwarding function 112 is configured to perform a destination lookup for the first media stream and send an intermediary server identifier for the first media stream to the SBC in response to receiving a first packet of the first media stream from one of the SBCs 110. The SBC is configured to store the intermediary server identifier and send the intermediary server identifier to the forwarding function 112 with each subsequent packet of the first media stream.

[0055] In some examples, the forwarding function 112 is configured, in response to receiving the subsequent packets, to use the intermediary server identifier to route each subsequent packet of the subsequent packets to a first lawful intercept intermediary server identified by the intermediary server identifier. The SBC may be configured to transmit a first correlation identifier of the first media stream along with the first packet and the subsequent packets of the first media stream. The forwarding function may be configured to associate the first correlation identifier of the first media stream to the intermediary server identifier upon mapping of the correlation identifier to a lawful intercept intermediary server. In response to receiving a second packet that includes a second correlation identifier and does not include an intermediary server identifier, the forwarding function 112 may be configured to use the correlation identifier mapping to route the second packet to a second lawful intercept intermediary server associated with the second correlation identifier upon mapping of the correlation identifier.

[0056] 2. Improved cleanup of correlation ID->MS-ID mapping In some examples, one of the SBCs 110 is configured to transmit a first correlation identifier for the first media stream along with a first packet and multiple subsequent packets of the first media stream. In response to receiving the first packet, the forwarding function 112 is configured to perform a destination lookup for the first media stream to associate the first correlation identifier for the first media stream with an intermediary server identifier upon mapping the correlation identifier to a lawful intercept intermediary server. In response to determining that the first media stream is terminating, the SBC is configured to transmit a second packet of the first media stream along with a session release indicator to the forwarding function.

[0057] In some examples, the forwarding function 112 is configured to receive a session release indicator and, in response to receiving the session release indicator, to remove an association between a first correlation identifier of the first media stream and the intermediary server identifier in a mapping of correlation identifiers to lawful intercept intermediary servers. In response to receiving subsequent packets, the forwarding function 112 may be configured to use the intermediary server identifier to route each subsequent packet of the subsequent packets to the first lawful intercept intermediary server identified by the intermediary server identifier.

[0058] In response to receiving a second packet that includes a second correlation identifier and does not include an intermediary server identifier, the forwarding function 112 may be configured to use the correlation identifier mapping to route the second packet to a second lawful intercept intermediary server associated with the second correlation identifier in the correlation identifier mapping. This may occur, for example, when the second packet is part of the same stream but does not include the intermediary server identifier due to an error. In some examples, the second packet is part of a new stream, e.g., the second packet is a start packet of the new stream, and the forwarding function 112 is unable to route the second packet using the correlation identifier mapping; instead, the forwarding function 112 performs a destination lookup to create a new association in the mapping for the new stream.

[0059] 3. Preventing unnecessary replication when the sending and receiving users are in different countries In some examples, one of the SBCs 110 is configured to send a first direction indicator along with a first packet of the first media stream to the forwarding function 112, the first direction indicator specifying whether the first packet is an inbound or outbound initial request. In response to receiving the first packet, the forwarding function 112 is configured to perform a destination lookup for the first media stream using the first direction indicator.

[0060] In some examples, the forwarding function 112 is configured to perform a destination lookup using a source user identity of the first packet in response to determining that the first direction indicator specifies an inbound initial request. The forwarding function 112 may be configured to perform a destination lookup using a destination user identity of the first packet in response to determining that the first direction indicator specifies an outbound initial request.

[0061] The SBC may be configured to transmit a first correlation identifier for the first media stream along with the first packet and the multiple subsequent packets of the first media stream. In response to receiving the first packet, the forwarding function 112 may be configured to associate the first correlation identifier for the first media stream with the intermediary server identifier in a mapping of correlation identifiers to lawful intercept intermediary servers. In response to receiving the subsequent packets, the forwarding function 112 is configured to use the intermediary server identifier to route each subsequent packet of the subsequent packets to a first lawful intercept intermediary server identified by the intermediary server identifier.

[0062] In some examples, the forwarding function 112 is implemented on an SBC platform or system. The SBC, acting as a centralized forwarding function, is configured to perform routing of signaling and media packets to a lawful intercept intermediary server.

[0063] Signaling packets are routed based on routing rules / policies configured in the forwarding function 112. These lookups may be done in the host application. In some cases, as described further herein, only the first signaling packet of a new session is routed based on the policy lookup in the host. All subsequent signaling packets should also be routed as described further below.

[0064] A module has been configured to realize this function on the SBC. This module should be IPFIX aware since it receives / sends IPFIX packets.

[0065] This module needs to be SIP aware, since it needs to decode the SIP headers from the SIP packets embedded within the IPFIX packets and then perform the lookup.

[0066] It also manages session mapping in the platform to enable subsequent routing of signaling and / or media packets via the fastpath.

[0067] Routing rules specify the following: The SIP header name to extract the number from (for example, From, To, Referred-By, Refer-To, R-URI, Diversion headers) Number prefix for lookup Destination ME as next hop In some examples, routing is based on the CGPN for ingress packets (i.e., packets coming into the A-SBC) and the CDPN for egress packets (i.e., packets going out of the A-SBC).

[0068] FIG. 2 is a block diagram of an example network environment 200 for establishing an example lawful intercept of a telephone call.

[0069] 2, a first user device 202 in country A ("UA A") initiates a call with a second user device 206 in country B ("UA B") via an access SBC 204 (A-SBC). Messages flowing towards country A are classified as going "West" and messages flowing towards country B are classified as going "East."

[0070] The SBC 204 forwards packets in the media stream of the call to a centralized forwarding function 208. The forwarding function 208 forwards packets sent by the user device 202 to a lawful intercept intermediation server 210 in country A ("ME A"), and the forwarding function 208 forwards packets sent to the user device 206 to a lawful intercept intermediation server 212 in country B ("ME B"). Although the example in Figure 2 shows eastbound packets, the system can operate similarly with westbound packets or packets heading in other directions in general.

[0071] The example shown in FIG. 2 illustrates actions performed in the SBC 204 and forwarding function 208 for the Session Initiation Protocol (SIP) and the Message Session Relay Protocol (MSRP).

[0072] In the first step, the user device 202 sends Invite 1A to the SBC 204. The SBC 204 performs the following actions:

[0073] · Add a unique correlation ID (eg, randomly generated) to the IPFIX packet and send it to the forwarding function 208 as IPFIX(Invite 1A).

[0074] While creating a media flow, the system adds a correlation ID and an “ingress” direction indicator.

[0075] In the second step, the forwarding function 208 performs the following actions: · Perform a routing lookup based on the "FROM" header (since the direction indicator is ingress) to find the Dest Flow.

[0076] ·Add correlation ID (from IPFIX) => destination flow mapping. Update the ingress media flow (corresponding to the ASBC config) with the new correlation ID => destination flow mapping.

[0077] In a third step, the SBC 204 sends Invite 1B to the user device 206 and sends IPFIX(Invite 1B) to the forwarding function 208. The SBC 204 performs the following actions:

[0078] Add a unique correlation ID and an "egress" flag to the IPFIX packet and send it to the FF.

[0079] In the fourth step, the forwarding function 208 performs the following actions: · Perform a lookup based on the "TO" header to find the destination flow.

[0080] ·Add correlation ID (from IPFIX) => destination flow mapping. Update the ingress media flow (corresponding to the ASBC config) with the new correlation ID => destination flow mapping.

[0081] In a fifth step, the user device 202 sends the MSRP E-1A to the SBC 204, and the SBC 204 sends the MSRP E-1B to the user device 206. The SBC 204 performs the following actions:

[0082] · The SBC 204 adds the correlation ID to the IPFIX packet and sends it to the FF. In a sixth step, the SBC 204 sends the IPFIX(MSRP E-1A) and IPFIX(MSRP E-1B) to the forwarding function 208. The forwarding function 208 performs the following actions:

[0083] · Perform a lookup based on the correlation ID in IPFIX to determine the destination flow.

[0084] In a seventh step, the user device 206 sends the MSRP W-1B to the SBC 204, and the SBC 204 sends the MSRP W-1A to the user device 202. The SBC 204 performs the following actions:

[0085] · The system adds the correlation ID to the IPFIX packet and sends it to the FF. In an eighth step, the SBC 204 sends the IPFIX(MSRP W-1A) and IPFIX(MSRP W-1B) to the forwarding function 208. The forwarding function 208 performs the following actions:

[0086] · Perform a lookup based on the correlation ID in IPFIX to determine the destination flow.

[0087] FIG. 3 is a block diagram illustrating an example packet transmitted for an example of packet forwarding 300 for lawful interception.

[0088] 3, the access SBC 302 forwards the first packet 304 and the subsequent packets 306 to a forwarding function 308. The forwarding function 308 forwards the packets 304 and 306 to a lawful intercept intermediary server 314 by sending modified packets 310 and 312.

[0089] Packet 304 is an IPFIX packet, specifically SIP over Transmission Control Protocol (TCP). Packet 304 includes an IPFIX header and IPv4 data. Packet 304 also includes a correlation ID, a direction flag, and a session release flag. Packet 304 includes a SIP message.

[0090] Packet 306 is an IPFIX packet, specifically MSRP over TCP. Packet 306 includes an IPFIX header and IPv4 data. Packet 306 includes a mediation server identifier that was stored in SBC 302 after forwarding function 308 performed a destination lookup for packet 304. Packet 306 includes an MSRP message.

[0091] When forwarding function 308 receives packet 304 from SBC 302, forwarding function 308 performs a destination lookup to determine that lawful intercept intermediation server 314 is the destination for packet 304 and subsequent packets that belong to the same media stream as packet 304, such as packet 306. Forwarding function 308 stores an association between the correlation ID in mapping the correlation identifier to a lawful intercept intermediation server and the intermediation server identifier of lawful intercept intermediation server 314. Forwarding function 308 also sends the intermediation server identifier to SBC 302.

[0092] The forwarding function 308 generates a packet 310 based on the packet 304 and sends the packet 310 to the lawful intercept intermediary server 314. The packet 310 is an IPFIX packet, i.e., SIP over TCP. The packet 310 includes the IPFIX header, IPv4 data, and SIP message of the packet 304. The packet 310 does not include the correlation ID, direction flag, and session release flag of the packet 304.

[0093] When forwarding function 308 receives a packet 306 from SBC 302, forwarding function 308 can avoid checking the mapping of the correlation identifier to a lawful intercept intermediary server. Instead, forwarding function 308 uses the intermediary server identifier in packet 306 to route packet 306.

[0094] Forwarding function 308 generates packet 312 based on packet 306 and sends packet 312 to lawful intercept intermediary server 314. Packet 312 is an IPFIX packet, i.e., MSRP over TCP. Packet 312 contains the IPFIX header, IPv4 data, and MSRP message of packet 306. Packet 312 does not contain the intermediary server identifier of packet 306.

[0095] In some examples, new set IDs and templates are used to implement the features described herein, for example, a common template may be used to replicate both ingress and egress signaling packets in the SBC 302.

[0096] · The "direction flag" indicates whether this is an ingress or egress packet.

[0097] · The forwarding function 308 uses this flag to determine which SIP header (of the calling or called number) should be used for the routing lookup.

[0098] · The "release session" flag indicates whether call session cleanup is required on FF.

[0099] Similarly, a common template may be used to replicate ingress and egress media packets at the SBC 302. For MSRP media IPFIX packets, no direction flag is required because the forwarding function uses the identified correlation to determine the destination lawful intercept intermediary server. It also does not require a session release flag.

[0100] To facilitate session cleanup in the forwarding function 308, the forwarding function 308 clears / erases stored dialog information (e.g., correlation ID->destination flow mapping) upon receiving an IPFIX packet with the "session release" flag set.

[0101] In some examples, there is also a timer implemented in the forwarding function 308 to clean up the session in the forwarding function 308 to handle cases where an IPFIX packet with the "session release" flag set is discarded for some reason.

[0102] This can also happen if the A-SBC reboots in the middle of a session. This timer is cancelled / stopped upon receipt of an IPFIX packet with the "session released" flag set.

[0103] Regarding the correlation ID, a unique correlation (or replication) ID may be sent from the SBC 302 to the forwarding function 308. This uniquely identifies each dialog on the SBC 302 or (e.g., if the ID also includes the A-SBC hostname) on the forwarding function 308.

[0104] This is per dialog rather than per session to handle forking scenarios where multiple client dialogs may exist, each of which is replicated to an ME in a different country.

[0105] There are various options for generating this ID in the SBC302. Option 1: Use media specific information from the packets.

[0106] This can be cumbersome to achieve as it requires a separate approach for each media type.

[0107] In an offerless INVITE, this requires parsing each signaling packet until no media information is received.

[0108] Option 2: Using Media Flow Identifiers This may not be the most plausible solution in some cases, for the following reasons:

[0109] In the case of an offerless INVITE, no media flow identifier is available. After an A-SBC switch, the (locally generated) media flow identifiers will change during the same session, so they need to be recreated.

[0110] If the A-SBC is deployed in standalone mode, mechanisms must be built to ensure that the same ID is not used for different sessions across reboots.

[0111] Option 3: Use a randomly generated unique replication Id. It is unique across all A-SBCs and works in offer-less INVITE scenarios as well.

[0112] FIG. 4 is a flow diagram of an example method 400 for routing packets for lawful interception in an example forwarding function.

[0113] The method 400 illustrates an improved forwarding logic in a forwarding function, which is achieved by:

[0114] sending a LI-MS identifier (MS-ID) from the forwarding function back to the SBC after a destination lookup for the first packet of the new media stream is performed; and Store this MS-ID in the A-SBC and send it together with the correlation ID in each subsequent packet of that media stream towards the transport function.

[0115] When a packet arrives, the forwarding function looks for the presence of an MS-ID in the outer packet (e.g., IPFIX). If present, the packet can be forwarded directly towards the associated LI-MS without having to do a correlation ID lookup or parsing the embedded packet. Any packets arriving at the forwarding function without an MS-ID can fall back to a correlation ID lookup.

[0116] Method 400 includes parsing 402 the packet and determining whether a destination identifier (e.g., referred to elsewhere herein as an MS-ID) is present in the packet 404. If the destination identifier is present, method 400 includes forwarding 410 the packet to a lawful intercept intermediary server identified by the destination identifier.

[0117] If the destination identifier is not found, the method 400 includes checking a mapping of correlation identifiers to lawful intercept intermediary servers for an entry in the correlation identifier in the packet (406). If a match is found in the mapping of correlation identifiers to lawful intercept intermediary servers, the method 400 includes forwarding the packet to the lawful intercept intermediary server identified in the entry in the correlation identifier in the packet.

[0118] If no match is found, the method 400 includes determining (412) whether the packet is a signaling packet, e.g., whether the packet is a SIP packet. If the packet is not a signaling packet, the method 400 includes discarding (414) the packet. If the packet is a signaling packet, the method 400 includes obtaining (416) a source user identity of the packet and a destination user identity of the packet from the packet.

[0119] The method 400 includes performing a destination lookup in a destination table using one of the user identities as a key (418). The destination table specifies lawful intercept intermediary servers in various countries. The method 400 includes determining whether the destination lawful intercept intermediary server is found (420).

[0120] If a destination lawful intercept intermediary server is found, method 400 includes creating an association between the correlation identifier of the packet and the destination lawful intercept intermediary server in mapping the correlation identifier to the lawful intercept intermediary server (422), sending an intermediary server identifier identifying the destination lawful intercept intermediary server to the SBC (424), and forwarding the packet to the destination lawful intercept intermediary server (410).

[0121] If the destination lawful intercept intermediary server is not found, the method 400 includes a step 414 of discarding the packet.

[0122] Although specific examples and features have been described above, these examples and features are not intended to limit the scope of the disclosure, even if only one example is described for a particular feature. The examples of features provided in this disclosure are intended to be illustrative rather than limiting, unless otherwise stated. The above description is intended to cover such alternatives, modifications and equivalents as would be apparent to one of ordinary skill in the art having the benefit of this disclosure.

[0123] The scope of the present disclosure includes any feature or combination of features disclosed herein (explicitly or implicitly), or any generalization of the disclosed features, regardless of whether such feature or generalization alleviates any or all of the problems described herein. Accordingly, new claims may be prepared to any such combination of features during prosecution of this application (or an application claiming priority to this application).

[0124] In particular, with reference to the appended claims, features from the dependent claims may be combined with features of the independent claims, and features from each independent claim may be combined in any suitable manner and not just in the specific combinations recited in the appended claims.

Claims

1. 1. A system for routing packets for lawful interception, comprising: At least one Session Border Controller (SBC), the at least one SBC providing a plurality of media streams to a forwarding function. and configured to forward the received signal to the second storage device, the system further comprising: the forwarding function implemented on a centralized node for a telecommunications network, the centralized node comprising one or more processors, the forwarding function configured to receive the plurality of media streams and forward each media stream to a respective lawful intercept intermediary server in at least one country associated with the media stream; the forwarding function is configured, in response to receiving a first packet from the at least one SBC, the first packet being a signaling packet establishing a first media stream, to perform a destination lookup for the first media stream using a source user identity or a destination user identity of the first packet and to send an intermediary server identifier for the first media stream to the at least one SBC; the at least one SBC is configured to store the intermediary server identifier and to transmit the intermediary server identifier to the forwarding function with each subsequent packet of a plurality of subsequent packets of the first media stream.

2. 2. The system of claim 1, wherein the forwarding function is configured, in response to receiving the subsequent packets, to use the intermediary server identifier to route each subsequent packet of the subsequent packets to a first lawful intercept intermediary server identified by the intermediary server identifier.

3. 3. The system of claim 1 or 2, wherein the at least one SBC is configured to transmit a first correlation identifier for the first media stream along with the first packet and the subsequent packet.

4. 4. The system of claim 3, wherein the forwarding function is configured to associate the first correlation identifier of the first media stream with the intermediary server identifier upon mapping of the correlation identifier to the lawful intercept intermediary server.

5. 5. The system of claim 4, wherein the forwarding function is configured, in response to receiving a second packet that includes a second correlation identifier and does not include an intermediary server identifier, to use the mapping of correlation identifiers to route the second packet to a second lawful intercept intermediary server that is associated with the second correlation identifier during the mapping of correlation identifiers.

6. A system as described in any one of claims 1 to 5, wherein each subsequent packet of the plurality of subsequent packets is a media packet.

7. The system of any one of claims 1 to 6, wherein the at least one SBC is an access SBC configured to provide access to a telecommunications service provider access network.

8. 1. A system for routing packets for lawful interception, comprising: The system further comprises at least one Session Border Controller (SBC), the at least one SBC configured to forward a plurality of media streams to a forwarding function, the system further comprising: the forwarding function implemented on a centralized node for a telecommunications network, the centralized node comprising one or more processors, the forwarding function configured to receive the plurality of media streams and forward each media stream to a respective lawful intercept intermediary server in at least one country associated with the media stream; the at least one SBC is configured to transmit a first correlation identifier for the first media stream with a first packet and a number of subsequent packets, the first packet being a signaling packet establishing a first media stream; the forwarding function is configured, in response to receiving the first packet, to perform a destination lookup for the first media stream using a source user identity or a destination user identity of the first packet to associate the first correlation identifier of the first media stream with an intermediary server identifier in a mapping of correlation identifiers to the lawful intercept intermediary server; wherein the at least one SBC is configured to, in response to determining that the first media stream has terminated, send a second packet, the second packet being an IPFIX packet, with a session release indicator to the forwarding function.

9. 9. The system of claim 8, wherein the forwarding function is configured to receive the session release indicator and, in response to receiving the session release indicator, remove an association between the first correlation identifier of the first media stream and the intermediary server identifier in the mapping of correlation identifiers to the lawful intercept intermediary server.

10. 10. The system of claim 8 or 9, wherein the forwarding function is configured, in response to receiving the subsequent packets, to use the intermediary server identifier to route each subsequent packet of the subsequent packets to a first lawful intercept intermediary server identified by the intermediary server identifier.

11. The system of any one of claims 8 to 10, wherein the forwarding function is configured, in response to receiving a second packet that includes a second correlation identifier and does not include an intermediary server identifier, to use the mapping of correlation identifiers to route the second packet to a second lawful intercept intermediary server that is associated with the second correlation identifier during the mapping of correlation identifiers.

12. A system as described in any one of claims 8 to 11, wherein the first packet is a signaling packet establishing the first media stream, and each subsequent packet of the subsequent packet is a media packet.

13. The system of any one of claims 8 to 12, wherein the at least one SBC is an access SBC configured to provide access to a telecommunications service provider access network.

14. 1. A system for routing packets for lawful interception, comprising: The system further comprises at least one Session Border Controller (SBC), the at least one SBC configured to forward a plurality of media streams to a forwarding function, the system further comprising: the forwarding function implemented on a centralized node for a telecommunications network, the centralized node comprising one or more processors, the forwarding function configured to receive the plurality of media streams and forward each media stream to a respective lawful intercept intermediary server in at least one country associated with the media stream; the at least one SBC is configured to send a first direction indicator to the forwarding function along with a first packet, the first packet being a signaling packet establishing a first media stream, the first direction indicator specifying whether the first packet is an inbound initial request or an outbound initial request; The forwarding function is configured to, in response to receiving the first packet, perform a destination lookup for the first media stream using the first direction indicator and a source user identity or a destination user identity of the first packet.

15. 15. The system of claim 14, wherein the forwarding function is configured to, in response to determining that the first direction indicator specifies an inbound initial request, perform the destination lookup using a source user identity of the first packet.

16. 15. The system of claim 14, wherein the forwarding function is configured to, in response to determining that the first direction indicator specifies an outbound initial request, perform the destination lookup using a destination user identity of the first packet.

17. The system of any one of claims 14 to 16, wherein the at least one SBC is configured to transmit a first correlation identifier for the first media stream together with the first packet and a number of subsequent packets.

18. 20. The system of claim 17, wherein the forwarding function is configured to, in response to receiving the first packet, associate the first correlation identifier of the first media stream with an intermediary server identifier during mapping of correlation identifiers to the lawful intercept intermediary server.

19. 20. The system of claim 18, wherein the forwarding function is configured, in response to receiving the subsequent packets, to use the intermediary server identifier to route each subsequent packet of the subsequent packets to a first lawful intercept intermediary server identified by the intermediary server identifier.

20. A system as described in any one of claims 14 to 19, wherein the first packet is a signaling packet establishing the first media stream, and each subsequent packet of the subsequent packet is a media packet.

Images