Lawful Interception via Key Management Service Mediator
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current lawful interception systems in communication networks are unable to decrypt encrypted messages due to the absence of intermediate components capable of deducing message encryption keys or private keys, limiting their ability to intercept communications between sender and receiver devices.
Innovation Solution
A lawful interception device that receives encrypted messages and message encryption key generation parameters from the communication network, along with composite decryption logic from an encryption device, to decrypt the messages for lawful interception purposes, using parameters such as random seed values and International Mobile Subscriber Identity (IMSI) for key generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If message encryption is implemented in communication networks, then communication security is improved, but lawful interception capability deteriorates
Solution Approach 1:
The patent introduces a Key Management Service (KMS) as an intermediary component in the communication network. The KMS generates message encryption keys and manages key distribution between sender and receiver devices. Crucially, the KMS also provides these keys to Lawful Interception Devices (LIDs) through secure interfaces, enabling lawful interception without compromising the end-to-end encryption between communicating parties. This intermediary approach allows dual functionality: maintaining communication security while enabling authorized interception.
Solution Approach 2:
The patent segments the encryption key management into separate functional components: key generation (performed by KMS), key usage (performed by sender and receiver devices), and key disclosure for interception (performed by LIDs). This segmentation allows the system to maintain strong encryption for legitimate communications while creating controlled access paths for lawful interception through the KMS-LID interface.
2Loss of information
If end-to-end encryption is used between sender and receiver devices, then message confidentiality is improved, but intermediate decryption capability deteriorates
Solution Approach 1:
The KMS acts as a mediator that generates encryption keys and distributes them to both the communicating parties and the LIDs. The key encryption mechanism uses the receiver's public key to encrypt the message encryption key, which is then transmitted through the KMS. The LID, having access to the receiver's private key through the KMS interface, can decrypt these encrypted keys and subsequently decrypt intercepted messages, preserving confidentiality for legitimate users while enabling interception capability.
Solution Approach 2:
The patent implements different decryption capabilities at different locations in the network. Sender and receiver devices have decryption capability for their own communications, while LIDs have decryption capability provided through the KMS interface. The message encryption key is encrypted with the receiver's public key for transmission through the network, but remains decryptable by the LID which has access to the corresponding private key through the KMS. This local differentiation of decryption capabilities maintains confidentiality where needed while enabling interception where authorized.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This disclosure relates generally to lawful interception of communication networks, and more particularly to a system and method for improved lawful interception of an encrypted message. The method may involve receiving a copy of the one or more encrypted messages; receiving one or more message encryption key generation parameters associated with the one or more encrypted messages from the communication network; receiving one or more composite decryption logics, from an encryption device (104), to decrypt the one or more encrypted messages; decrypting the one or more encrypted messages based on the one or more message encryption key generation parameters and the one or more composite decryption logics for the lawful interception.