Patent Application
20120076303
The present application relates to lawful interception and, in particular, to devices and methods for gathering information regarding local breakout services.
Lawful interception (LI) is a mandated requirement in many countries or jurisdictions that requires a Telecommunications Service Provider (TSP) to have the ability to monitor communications over the TSP's networks. This ability can, for example, provide law enforcement agencies with access to communications believed to be made for illegal purposes.
With the increase in local gateway products that provide local breakout functionality, such a femtocells and home gateways, communications may take place within the local network that are not visible to the TSP. Additionally, some TSPS are moving services that would normally be captured by LI requirements, such as IPTV (Internet Protocol Television), local telephony, and remote diagnostics, into such local breakouts, where LI is not traditionally required.
In an example, a femtocell allows normal wireless service, such a licensed cellular provided by a TSP, to terminate in a home and be carried back to the TSP over a broadband connection. Any service the user uses while on the cellular network can be captured by the TSP if it terminates in the TSP core network. Services provided within the femtocell do not terminate in the TSP core network and likely will not be captured. Current femtocell architectures do not provide access to capture any information from peer to peer communications within the respective femtocell.
In another example, home gateways (HGs) can be fully encompassed into an ISP (Internet Service Provider). Examples include DSL HGs (Digital Subscriber Line HGs) and Cable Modem HGs. The TSP provides remote monitoring and assistance service through the HG for an integrated home network environment. However, monitoring of peer to peer communications in such a home network environment can be detected by the user. For example, the user may notice modem activity caused by the monitoring activity or the monitoring activity may trigger a charge that shows on the user's ISP bill.
In one aspect, there is provided a method for intercepting peer to peer communications within a local network that is separated from a core network by a gateway, the method comprising: receiving, at an intercept access point located on the gateway, a command to intercept communications to and from a subject device operating within the local network; configuring a controller on the gateway to direct all communications to and from the subject device through the gateway; obtaining data from the communications to and from the subject device as the communications pass through the gateway; and storing the data in a memory on the gateway inaccessible by the subject device.
In another aspect, there is provided a gateway connecting a local network and a service provider core network, communications within the local network being independent of the core network, the gateway comprising: a receiver for receiving data related to the communications of a subject device within the local network; a memory for storing the data; an output for forwarding the data to a third party; and a controller configured to: cause the communications to and from the subject device to pass through the gateway; obtain the data from the communications of the subject as the communications pass through the gateway; store the data in the memory; and cause the output to forward the data to the third party.
In another aspect, there is provided a method for intercepting peer to peer communications within a local network that is separated from a core network by a gateway, the method comprising: receiving, at an intercept access point located on the gateway, a command to intercept communications to and from a subject device operating within the local network; configuring a controller on the gateway to direct all communications to and from the subject device through the gateway; obtaining data from the communications to and from the subject device as the communications pass through the gateway; and storing the data in a memory on the gateway inaccessible by the subject device.
Like reference numerals are used in the drawings to denote like elements and features.
Embodiments of the present disclosure provide for a capability within a gateway to dynamically monitor communications and protocols to and from a targeted user in a local breakout. A gateway with this capability thus performs the function of an intercept access point (TAP). The IAP function on the gateway can be implemented using physical or logic points. In some embodiments, the IAP is a separate module within a gateway. In other embodiments, the IAP functionality is integrated into gateway components.
For the purposes of this disclosure, local breakout includes any network where peer to peer communications are enabled without connecting to a TSP core network, such as but not limited to, networks provided by HGs and femtocells.
In some embodiments, the IAP includes a firewall and a bridging circuit that route peer to peer communications within the local breakout through the IAP. In this manner, the IAP can monitor communications and pass on information with respect to the monitored communications to the TSP or in some cases, directly to a law enforcement agency (LEA). In some embodiments, the IAP stores a copy of the communication in a memory on the IAP. In other embodiments, the IAP stores statistics related to the monitored communications, such as but not limited to a summary of Internet Protocol (IP) addresses and ports used and protocols used. Other information related to statistics that may be stored for lawful intercept is outlined in the Cable Broadband Intercept Specification (CBIS), CM-SP-CBI2.0-103-090121 Jan. 21, 2009.
The stored information can in some cases be accessed by a TSP or law enforcement agency. In other cases, the stored information is forwarded periodically or during a scheduled transmission. To meet the requirements of regulations related to LI, in some embodiments, the interception must be transparent to the subject of the interception. Therefore, the storing, accessing, and forwarding are masked in some embodiments. A non-limiting example of masking is to send the stored information concurrently with a scheduled transmission so that there is no unexplained activity at the gateway. In some embodiments, the intercepted data is separated and transmitted in small portions, so that the volume of data transmitted at any one time is not abnormal. This will reduce the likelihood that the target of the interception would suspect that intercepted data is being transmitted to the TSP or LEA. In another non-limiting example, the gateway includes a memory where the information related to the interception is stored, the memory being accessible only by the LEA or an administrator of the TSP. In some embodiments, a software firewall is used. This permits the data to be stored randomly in the memory, which in turn makes reading the memory difficult without proper authentication or authorization. In other embodiments, special abilities are required to open a device to access the memory. For example, special equipment may be needed to monitor memory elements or to decode microcode running on the gateway.
In some embodiments, the memory comprises a cache memory inside a microprocessor chip which is protected by a software firewall and only accessible by the LEA or an administrator of the TSP. In some example gateways, chips are used that are FPGA (Field program Gate Arrays) that also have internal memory that are not accessible by the subject of the interception. In still other embodiments, a custom chip is built with the IAP function fully enclosed in the chip, including the memory. In this case, there is no requirement for external memory.
In some embodiments, an external memory is used. In such cases, a file system can be used to delete a file in a manner that it is still on the memory but is not visible to the user. Alternatively, a routine hides pieces of the data all over the memory chip. In some embodiments, data that is required for the proper operation of the gateway is stored openly on the gateway, while the data required for LI purposes is hidden.
The accessing of the gateway for the purposes of LI can be masked in a variety of manners. In some embodiments, the gateway needs to communicate with the ISP network in order to do ARP (Address Resolution Protocol), DHCP (Dynamic Host Configuration Protocol) and other functions and these communications can be used to mask the LI. In embodiments where the gateway is a public hot spot, the ISP side of the internet is not visible to the end users, which comprise the subject of the LI. In embodiments where the gateway an integrated cable modem/DSL/router/WIFI in a home or local system, the ISP side is also not seen by the user. For consumer products, such as DlinK™, a number of network activities happen in the background and these activities can be used to mask the LI activity. Non-limiting examples of such network activities include an operating system checking for and installing updates, a virus scanner operating and looking for updates, and external devices looking for updates. In the case of a femtocell, non-limiting examples of network activities include reporting of frequency measurements to minimize network interference (for example in Self Organizing Networks (SON)), and reporting of user registration. Additionally all regular traffic and signalling traffic for any handset connected to the femtocell will be sent back over a VPN (Virtual Private Network) link. Because a femtocell is usually a managed device, it is possible to count how much traffic is off loaded for peer to peer activity, to look at address headers to help in future service calls and to remote access the gateway and configure it for the end user if they any connection issues.
Additionally, in some embodiments, measures are taken to ensure that transmissions related to the interception are accounted for separately so that the subject of the interception is not invoiced for those transmissions or statistics related to the transmissions are not disclosed to the subject. For example, data packets related to the interception can include an identifier in the header that will trigger a server at the TSP to redirect them accordingly and to omit them from the total size of the data transmission when reporting or accounting to the subject. Data packets related to the intercept are identified in some embodiments by sending them to designated IP address created for intercept purposes. Alternatively, the data packets can be part of management services and included as a dump of data including counters. An embodiment of the gateway uses packet switching features within the gateway to identify and capture traffic on a packet by packet basis. Non-limiting examples of packet switching include store and forward packet switching, cut-through packet switching and fragment-free packet switching which are explained in section 3.4 of http://services.eng.uts.edu.au/˜kumbes/ra/Switching/Packet-Switching/packet.html. The applications or modules that implement the packet switching features are programmed to be capable of capturing communications required for an LI such that the capturing can be evoked when required. In some embodiments, all the packets are temporarily copied to a memory and then packets that are not related to LI are discarded or deleted. In some embodiments, a dynamic routine is used to classify the data captured or stored. The data can be classified according to, but not limited to, Internet Protocol (IP) addresses, destination addresses, protocols used, the content of the data, or combinations thereof. In some embodiments, the data is classified before storing the data in the memory on the gateway. In some embodiments, the data is classified by the TSP after it is retrieved or transmitted.
In use, embodiments of the present enclosure provide for lawful intercept of communications within a local network. Referring to
Examples of a gateway 100 include, but are not limited to, a home gateway and a femtocell. An exemplary femtocell 200, on which embodiments of the present disclosure may be implemented, will be described with reference to
An exemplary home gateway 300, on which embodiments of the present disclosure may be implemented, will be described with reference to
Now referring to
The receiver 410 is for receiving data related to the communications of a subject device within the local network. The data can be received over any form of communications link, such as but not limited to a cellular link, a wireless or wired LAN interface, and a wireless or wired IP interface. The memory 420 is for storing the data. In some embodiments, access to the memory is restricted to authorised entities. In some embodiments, the memory is not visible to the subject device. The memory 420, in some embodiments, is any non-volatile, tangible memory, including but not limited to shift registers.
The output 440 is for forwarding the data to a third party, such as a TSP administrator or a LEA. The output can be a broadband interface, an IP interface of any sort, or any other interface for communicating with the core network.
The controller 440 is configured to: cause the communications to and from the subject device to pass through the IAP 400; obtain the data from the communications to and from the subject device as the communications pass through the IAP 400; store the data in the memory 420; and cause the output 430 to forward the data to the third party. In some embodiments, the controller 440 is a separate processor. In other embodiments, the controller 440 is a functionality operating on a processor on the gateway. In some embodiments, the controller 440 is configured to cause the output 430 to forward the data concurrently with a scheduled transmission of other data. In some embodiments, the controller 440 is configured to apportion the data for output over a series of transmissions. In some embodiments, the controller 440 is configured to limit the amount of data that is output to a threshold maximum. In some embodiments, the controller 440 is configured to encrypt the data that is stored. In some embodiments, the controller 440 is configured to encrypt the data that is forwarded to the third party.
In some embodiments, the IAP 400 further comprises at least one of a firewall and a bridging circuit for redirecting the communications to and from the subject device through the IAP.
The IAP 400 is for implementation on a gateway.
Referring now to
In some embodiments, the gateway 600 is a femto cell. In other embodiments, the gateway 600 is a home gateway or a residential gateway.
In some embodiments, the output 600 forwards the data over a broadband connection.
In some embodiments, the controller 640 uses packet switching features to identify and capture the data.
In some embodiments, the gateway 600 also includes an indicator that provides an indication of activity on the gateway. The indicator is configured to only indicate activity unrelated to the data obtained from the communications to and from the subject device. For example, the forwarding of the data to the third party would not cause the indicator to show any activity. In a non-limiting example, the indicator is an LED (Light Emitting Diode) that flashes when data not related to LI is being received at or output from the gateway 600.
Referring now to
In
Copies of packets with any IP address in the to or from headers for the target peer are copied into the IAP 710.
Referring now to
Referring to
In some embodiments, the method further comprises encrypting the data. This can involve encrypting the data before it is stored or encrypting the data before it is forwarded.
Embodiments disclosed herein allow for dynamic monitoring of ISP connections. In addition, intercepted traffic can be delivered covertly using a secure link to the TSP under conditions that the target of the interception would not suspect. The dynamic nature of the solutions disclosed herein allows the devices to evolve with changing requirements or changing regulations. It also allows for the devices to be customized for each client or jurisdiction.
It is to be understood that the actions of the methods are not limited to the order in which they are described are can be performed in any feasible order.
The various embodiments presented above are merely examples and are in no way meant to limit the scope of this disclosure. Variations of the innovations described herein will be apparent to persons of ordinary skill in the art, such variations being within the intended scope of the present application. In particular, features from one or more of the above-described embodiments may be selected to create alternative embodiments comprised of a sub-combination of features which may not be explicitly described above. In addition, features from one or more of the above-described embodiments may be selected and combined to create alternative embodiments comprised of a combination of features which may not be explicitly described above. Features suitable for such combinations and sub-combinations would be readily apparent to persons skilled in the art upon review of the present application as a whole. The subject matter described herein and in the recited claims intends to cover and embrace all suitable changes in technology.
