61 results about "Lawful interception" patented technology

A network mediation device (32) in a communication network (10) receives application-layer control messages (24) intercepted in the communication network (10) as part of a lawful interception service. Each of the application-layer control messages (24) received is configurable to include (i) a session identity field (28) indicating an identity of an application-layer control session (26) to which the application-layer control message belongs: and (ii) one or more linking fields (30) that link the identified application-layer control session (26) with another application-layer control session (26). The network mediation device (32) sends. over a handover interface (33) from the network mediation device (32) towards a law enforcement device (16), the application-layer control messages (24) and signaling (34) indicating which application-layer control messages (24) belong to application-layer control sessions (26) that are linked to one another.

A Lawful Interception Administration Function device (102) comprising a memory and a processor, the memory containing instructions which when executed on the processor, cause the LI ADMF device (102) to send to a Network Repository Function (110) a discovery request message for discovering at least one NEF device (103) and at least one Application Function, AF, device (107) served by the NEF device; receive a discovery response message comprising information about the NEF device and the AF device; receive from a LEA (101) a first request message for subscribing to a notification of the event provided by the AF device, the application identified by an identifier; send a second request message, to a NEF device comprising an IRI-POI (104) to subscribe to the notification of the event, the NEF device identified based on the information comprised in the discovery response message; and receive a subscribe response message confirming the subscription to the notification of the event.

A communications network node (100) operable to: receive a sidelink connection request from a user equipment, UE, including an identification of at least one other UE involved in the sidelink; determine that the UE is a target UE to be monitored for lawful interception, LI, purposes; inform the target UE and the at least one other UE of a UE-to-UE direct communication interface frequency to use for the sidelink; send a request message to the at least one other UE requesting it to provide information about the sidelink connection and a copy of communications data exchanged on the sidelink connection to the node; send to an access and mobility management function, AMF, network element, NE, an information message including information about the sidelink connection received from the at least one other UE; and send to a user plane function, UPF, NE content messages including a copy of communications data exchanged on the sidelink connection received from the at least one other UE.

Disclosure are techniques for allocating aggregation devices in a lawful intercept system. In an embodiment, a method includes maintaining a list of point of interception aggregation (PAG) functions in a network function repository function (NRF) of a cellular network upon instantiation of the PAG functions; receiving a lawful intercept (LI) request; querying the NRF to determine a respective PAG function; and associating a point of interception (POI) function with the respective PAG function.

Methods and apparatus for automatically securing communications between a mediation device (MD) and a law enforcement device, such as an agent's terminal, to which intercepted communications, e.g., traffic, is sent are described. Based on a desired intercept request to be implemented, a Lawful Interception (LI) administration (admin) device (LID) identifies at least a first mediation device (MD) which will be involved in implementing the intercept request. The LID then proceeds to enable the use of a private certificate authority to automatically generate and provision the MD and a law enforcement device with certificates and private keys via an automated process. Each of the MD and law enforcement device automatically obtain a security certificate and corresponding private key. The security certificates and corresponding private keys are then used, in an automated manner, to establish a mutual TLS connection between the MD and the law enforcement device.

A method of enabling lawful interception of an encrypted communication comprises generating a secret key for a second user and deriving a proof-of-work-protected key from the secret key. The secret key is reconstructable with less cryptographic work with the proof-of-work-protected key than without the proof-of-work-protected key. The method further comprises providing the proof-of-work-protected key to a system of a law enforcement organization, receiving, at a system of the second user, an encrypted communication from a system of a first user, and decrypting the encrypted communication with the secret key or with a further secret key generated based on the secret key. This method allows the system of the law enforcement organization to reconstruct the secret key based on the proof-of-work-protected key by performing cryptographic work and decrypt the encrypted communication with or based on the reconstructed secret key.

A communication network device hosting a lawful interception administration function, LI-ADMF, network element, NE. The device comprises includes interface circuitry, a processor and memory having instructions executable by the processor whereby the communication network device is operative to receive, from a law enforcement agency, LEA, a request to receive information related to at least one unmanned aerial system, UAS, hosted communication device registered with a communication network, send a request to at least one of a mobility management device or a user subscription management device to provide the information, receive at least part of the requested information from at least one of the mobility management device or the user subscription management device and send the received information to a law enforcement management function, LEMF.

A communications network device (100) hosting a lawful interception. LI, administration function. ADMF, the communications network device comprising interface circuitry (102), a processor (104) and a memory (106), said memory containing instructions (110) executable by said processor whereby the communications network device (100) is operative to:—send an X1 request message to a network element, NE, the X1 request message configured to request the NE to send status information of a field of an X1 GetAllDetailsResponse message to the LI ADMF; and—receive an X1 response message from the NE including the requested status information.

Access, mobility management and regulatory services are supported for satellite access to a Fifth Generation (5G) core network. A coverage area, e.g., country, region, multiple countries, and international areas, are divided into fixed virtual cells having well defined geographic boundaries and fixed tracking areas. Information for the virtual cells and / or tracking areas and associated with one or more public land mobile networks (PLMNs) may be provided to a user equipment (UE). The UE may obtain its position, e.g., using a satellite positioning system, and determine the serving virtual cell or tracking area in which it is located. The UE may perform registration with a serving core network in a serving PLMN associated with the serving virtual cell or tracking area. Regulatory services, such as emergency (EM) calls, lawful interception (LI), wireless emergency alerts (WEA) may be provided based on the serving virtual cell or tracking area.

The present invention discloses a legal eavesdropping method for physical-layer security-assisted suspicious ad-hoc communication, belonging to the field of wireless communication, which includes: establishing an optimization problem model for active eavesdropping interference power allocation in physical-layer security-assisted suspicious ad-hoc communication; transforming the established optimization problem into a two-layer optimization problem with inner and outer nesting, where the outer-layer optimization problem optimizes the relative eavesdropping rate and the inner-layer optimization problem optimizes the interference power allocation; solving the outer-layer optimization problem by the bisection method to obtain the relative eavesdropping rate, and for a given relative eavesdropping rate, solving the inner-layer optimization problem by the Lagrange method to obtain the interference power allocation. The present invention mainly aims at the scenario where suspicious ad-hoc communication terminals use physical-layer security technology for communication. The legal eavesdropper can optimize the interference power allocation to maximize the relative eavesdropping rate of the eavesdropping node, and use active eavesdropping to interfere to reduce the channel quality of the suspicious communication link and greatly improve the eavesdropping performance.

A method (400) for performing a lawful interception for managing services in a network (106) is disclosed The method (400) includes receiving (402) at least one service request corresponding to at least one service associated with at least one User Equipment (UE). The method (400) includes dynamically generating (404) at least one information header comprising a plurality of information corresponding to the at least one service. The method (400) further includes transmitting (406) the at least one information header to at least one of a Lawful Interception and Monitoring (LIM) system or / and one or more network components. The LIM system performs the lawful interception corresponding of the at least one service based on the at least one information header. The one or more network components provide the at least one service based on the at least one service request and the at least one information header.

Access, mobility management and regulatory services are supported for satellite access to a Fifth Generation (5G) core network. A coverage area, e.g., country, region, multiple countries, and international areas, are divided into fixed virtual cells having well defined geographic boundaries and fixed tracking areas. Information for the virtual cells and / or tracking areas and associated with one or more public land mobile networks (PLMNs) may be provided to a user equipment (UE). The UE may obtain its position, e.g., using a satellite positioning system, and determine the serving virtual cell or tracking area in which it is located. The UE may perform registration with a serving core network in a serving PLMN associated with the serving virtual cell or tracking area. Regulatory services, such as emergency (EM) calls, lawful interception (LI), wireless emergency alerts (WEA) may be provided based on the serving virtual cell or tracking area.

A lawful interception administrative function (ADMF) transmits (201) to a network element (NE) via an XI interface, a request for information pertaining to LI tasks that are associated with the NE. The request comprises a bulk indicator that indicates a procedure of transmission, from the NE to the ADMF, of said information pertaining to LI tasks. The NE determines (203), based at least on the bulk indicator, whether or not transmission of said information pertaining to LI tasks is to be performed using the procedure of transmission indicated by the bulk indicator. If it is determined that transmission of said information pertaining to LI tasks is to be performed using the procedure of transmission indicated by the bulk indicator, the NE transmits (205), to the ADMF via the X1 interface using the procedure of transmission indicated by the bulk indicator, said information pertaining to LI tasks.

Methods, systems, and computer-readable media for routing of packets for lawful interception (LI). A system includes at least one session border controller (SBC) configured to forward media streams to a forwarding function. The system includes a forwarding function implemented on a centralized node of a telecommunications network. The forwarding function is configured to receive media streams and forward each media stream to a respective lawful interception intermediary server of at least one country associated with the media stream. The forwarding function is configured to, in response to receiving a first packet of a first media stream from the SBC, perform a destination lookup on the first media stream and send an intermediary server identifier for the first media stream to the SBC. The SBC can be configured to send a session release indicator and a direction flag to the forwarding function.

A method (400) for performing a lawful interception for managing services in a network (106) is disclosed The method (400) includes receiving (402) at least one service request corresponding to at least one service associated with at least one User Equipment (UE). The method (400) includes dynamically generating (404) at least one information header comprising a plurality of information corresponding to the at least one service. The method (400) further includes transmitting (406) the at least one information header to at least one of a Lawful Interception and Monitoring (LIM) system or / and one or more network components. The LIM system performs the lawful interception corresponding of the at least one service based on the at least one information header. The one or more network components provide the at least one service based on the at least one service request and the at least one information header.

A method (600) for providing cryptographic information to a Lawful Interception Function (LIF) (also referred to as ALICP). The method comprises obtaining (s602) an address for the LIF. The method further includes obtaining (s604) cryptographic information (e.g., a cryptographic key) used to secure communications between a user equipment (UE) and an application function (AF). The method further comprises using (s606) the obtained address for the LIF to provide a report message (m518, m524) of the obtained cryptographic information to the LIF.

A lawful interception administrative function (LI ADMF) provides a virtual network function (VNF) implemented (i.e. implemented in a cloud infrastructure) LI intercept access point (IAP) only with one-way encrypted targets instead of clear-text targets while keeping the lawful interception triggering capability of the IAP unaffected. The ADMF, being external to the cloud infrastructure in which the IAP is running, executes hashing of targets before the targets are provided to the IAP. The IAP will never receive targets in clear text and thereby greatly reducing the LI security risks.

The invention provides an IMS data stream legal interception method and system based on GEO satellite communication, and the method comprises the steps: deploying an MEC in a base station or a ground station, and presetting an interception target list in the MEC; constructing a special network slice special for intercepting data transmission; analyzing the IMS call signaling from the first terminal device based on the MEC so as to extract corresponding user identity information; if the user identity information exists in the interception target list, the MEC applies for reserved slice resources corresponding to the private network slice from a base station or a ground station; and the MEC copies the voice data stream of the first terminal device to a specified interface through the private network slice. According to the method, the interception response time of the voice data stream is greatly shortened, and the capture timeliness requirement of the key data of the voice data stream in a high-delay environment is met. In addition, by using the special network slice, the problem of signal attenuation caused by long-distance transmission is effectively solved, and the integrity of intercepted data is guaranteed.

The present disclosure provides a method for performing International Mobile Equipment Identity (IMEI) based Lawful Interception (LI) monitoring for multi-device service performed by a Point of Interception (POI) function device (202) associated with a Serving Call Session Control Function (S-CSCF) (104) of an Internet Protocol Multimedia Subsystem (IMS) core network (510). The method can include examining (302) a header of a message (116) received by the S-CSCF to determine whether the first header comprises an IMEI that matches a target IMEI, and if so initiate (304) monitoring of the first session. The method can also include examining (306) a request field of a second message (120) sent by the S-CSCF (104) to the first UE (108-1) to determine whether the request field of the second message (120) comprises an identifier that corresponds to the target IMEI, and if so, initiate (308) monitoring of the first session.

The present disclosure enables lawful interception management (LIM) server integration with a centralized data layer (CDL) server and a converge telephony application server (CTAS). An X1 provisioning request from the LIM server is entertained at the CDL server and the LIM server determines details of the CDL server for target provisioning using an X1 interface. Further, an X2 interface is used by the CTAS to send data to the LIM server. If target is provisioned for interception, the CDL server will transfer X2 records towards LIM server, otherwise the CDL server will discard the data.

The present disclosure provides a system (110) and a method for centralized lawful interception in a network. The system (110) is a cost effective and centralized solution that helps in streamlining of LI provisioning to a single network function (NF) or a cluster of NFs efficiently, as all the provisioning requests will be handled and limited to a centralized lawful interception function (CLIF) (112) only and will not be extended to NFs. All procedures pertaining to the provisioning and interception will be offloaded to the CLIF (112) and application.

Method for decryption of end-to-end encrypted messages, wherein said messages are encrypted through user plane data encryption.

A method for managing data delivery flow performed by an Element of Lawful Interception, ELI, device, (106, 108) the method comprising: receiving (206, 212), from a Lawful Interception, LI, Administration Function, LI- ADMF, device (104), an activate task message or a modify task message comprising a truncable indicator that indicates that data delivery of intercepted data to a Law Enforcement Monitoring Facility, LEMF, device (114) associated with a task is to be truncated upon occurrence of a network condition; determining (302, 402) that the network condition has occurred at the ELI device (106, 108) or at another ELI device (106, 108) associated with the task; and delivering (306, 408) truncated intercepted data towards the LEMF device, wherein the truncated intercepted data further comprises an indicator that the truncated intercepted data is truncated Other methods preformed by an ELI device, network nodes, a computer program and a carrier are also disclosed.

A method, apparatus, and computer program for receiving an application session establishment request comprising an authentication and key management for applications, AKMA, Key Identifier, A-KID; producing an application key request (Naanf_AKMA_ApplicationKey_Get_request) comprising information elements AKMA Key Identifier A-KID; an application function identifier, AF_ID; and an application encryption key indication (Nnef_AKMA_AF_Encryption_Key_Indication); and sending the produced application key request (Naanf_AKMA_ApplicationKey_Get_request) to a home AKMA anchor function, hAAnF, or to a network exposure function, NEF, for enabling lawful interception in the VPLMN.

A lawful interception provisioning function, LIPF (113) and a system information retrieval function, SIRF (114), communicate with each other via the X1 and X2 protocols. The LIPF (113) obtains, from the SIRF (114), information pertaining to a network function, NF(107), which is an instance of a virtual network function, VNF, in a telecommunication 5network (100), where said information is unrelated to any LI target and any task associated with a point of interception, POI (135), in the NF (107).

A lawful interception device (22) receives Internet Protocol (IP) Multimedia Subsystem (IMS) messages (18) that are messages of a procedure (13) for transporting a certain Short Message (SM) (14) from an origin device (12-O) to a destination device (12-D) via one or more IMS networks (10O) and that are intercepted as part of a lawful interception service. The IMS messages (18) include at least a submit message (18S) that transports the certain SM (14) from the origin device (12-O) to a Short Message Service (SMS) service center (16), and a deliver message (18D) that transports the certain SM (14) from the SMS service center (16) to the destination device (12-D). The lawful interception device (22) sends intercept-related information (IRI) (26) over a handover interface (28) from the device (24) towards a law enforcement device (24). The IRI (26) comprises information related to interception of the IMS messages (18), including correlation information (30) correlating the IMS messages (18) together as relating to the same SM (14).

A request associated with a destination to which a point of interception, POI, (135) is to transmit intercepted data via an X2 / X3 interface during lawful interception, LI, is received from an administrative function, ADMF (108), via an X1 interface. The request comprises an identifier of the destination and version information that specifies at least one version of a transmission protocol to use by the POI for transmission of intercepted data to the identified destination. The POI determines whether or not the POI is able to transmit intercepted data via the X2 / X3 interface using a version of the protocol that is equal to one of the versions in the received version information. The received version information is compared with version information available in the POI. A response is transmitted via the X1 interface that indicates if the POI is able to transmit intercepted data via the X2 / X3 interface.

A communication system and method for identifying a threatening and / or illegal call includes (1) a telephony network, (2) a first user device in communication with the telephony network, wherein the first user device is assigned to a first user who is an organization member, (3) a second user device in communication with the telephony network, wherein the second user device is assigned to a second user who is not an organization member, (4) a communications server in communication with at least the first user device, (5) a natural language processor (NLP) in communication with the communications server; and (6) a threatening language database in communication with the communications server and / or the NLP. The NLP is configured to monitor language used by the second user during a communication with first user to identify threatening language by comparing the language used by the second user to the threatening language in the threatening language database.

A lawful interception administrative function, LI ADMF, (108) in a telecommunication network (100) obtains from a quantum key distribution network, QKDN, (10) a quantum key and a key stream identifier, KSID, associated with the quantum key. The LI ADMF (108) transmits the KSID associated with the quantum key to an LI entity (107, 136) in the telecommunication network (100). The LI entity (107, 136) then obtains, from the QKDN (10), a quantum key associated with the KSID transmitted by the LI ADMF (108). Such a procedure provides a secure exchange of quantum keys to enable encryption of sensitive data within messages exchanged by LI entities in the telecommunication network (100).