Lawful communication interception—intercepting communication associated information
View Patent ↗A method and apparatus are provided for extracting and reporting communication associated information of communications between a subject and an associate. This is achieved by populating an application identifier in the Network Layer 3, which the access networks examine in order to route the packets appropriately, and, thereby, allowing the access networks to isolate and extract the communication associated information. The access networks extract the call associated information and report the same to the Law Enforcement Agencies. Delivery to the LEAs of communication associated information may also be optimized.
1. A method of capturing communication associated information (CAI) of a communication between a subject and an associate, the method comprising the steps of:
intercepting the communication, the communication comprising at least one packet and each packet comprising CAI;
providing an application identifier (AID) in the at least one packet of the communication, the AID identifying the format of the CAI, wherein the AID is located in an optional field of Network Layer 3;
extracting in accordance with the AID the CAI from the at least one packet for reporting;
determining whether the extracted CAI is a new instance of the CAI;
reporting a first message to a Law Enforcement Agency (LEA) in response to a determination that the extracted CAI is the new instance of the CAI;
determining whether a predetermined amount of time has elapsed between packets of the at least one packet of the communication, the packets being identified by the CAI; and
reporting a second message to an LEA in response to a determination that the given amount of time has elapsed, wherein the second message represents a timeout indication.
2. The method of claim 1 , wherein the second message comprises at least one of a subject identifier, a time stamp indicating when the message was sent, the IP address of the subject, a packet direction indicator identifying whether the message was sent or received by the subject, the IP address of the associate, a first instance indicator identifying the new instance of the CAI, and a counter indicating the number of packets identified by the CAI seen since a last message.
3. The method of claim 1 , wherein the method further comprises the steps of:
determining whether a given number of packets of the at least one packet of the communication has been intercepted, the packets being identified by the CAI; and
reporting a third message in response to a determination that the given number of packets identified by the CAI has been intercepted.
4. The method of claim 3 , wherein the third message comprises at least one of a subject identifier, a time stamp indicating when the message was sent, the IP address of the subject, a packet direction indicator identifying whether the message was sent or received by the subject, the IP address of the associate, a first instance indicator identifying the new instance of the CAI, and a counter indicating the number of packets identified by the CAI seen since a last message.
5. The method of claim 1 , wherein the method further comprises the step of:
providing an AID-tag in the at least one packet of the communication, the AID-tag indicating the presence of the AID.
6. The method of claim 1 , wherein the method further comprises the steps of:
providing an AID-tag in the at least one packet of the communication, wherein the AID-tag indicates the presence of the AID, and wherein the AID-tag is located in the protocol field of the Network Layer 3.
7. The method of claim 1 , wherein the first message comprises at least one of a subject identifier, a time stamp indicating when the message was sent, the IP address of the subject, a packet direction indicator identifying whether the message was sent or received by the subject, the IP address of the associate, a first instance indicator identifying the new instance of the CAI, and a counter indicating the number of packets identified by the CAI seen since a last message.
8. A method of consolidating at least one packet of a communication between a subject and an associate, the method comprising the steps of:
receiving at least one packet of the communication, each packet comprising communication associated information (CAI);
providing an application identifier (AID) in the at least one packet of the communication, the AID identifying the format of the CAI, wherein the AID is located in an optional field of Network Layer 3;
extracting in accordance with the AID the CAI from the at least one packet for reporting;
determining whether a packet is a new instance of the CAI
reporting the CAI in response to a determination that the packet is a new instance of the CAI to an LEA;
determining whether a predetermined amount of time has elapsed between packets of the at least one packet;
reporting a timeout indication to an LEA in response to a determination that the predetermined amount of time has elapsed; and
reporting the CAI periodically to an LEA in response to a determination that the packet is a subsequent packet.
9. The method of claim 8 , wherein the step of determining whether a packet is a new instance of the CAI is performed by comparing the CAI with a previous CAI.
10. The method of claim 8 , wherein the step of determining whether a packet is a new instance CAI is performed by allowing a given amount of time to elapse since the receipt of the at least one packet.
11. The method of claim 8 , wherein the CAI report comprises at least one of a subject identifier, a time stamp indicating when the message was sent, the IP address of the subject, a packet direction indicator identifying whether the message was sent or received by the subject, an associate identifier, a first instance indicator identifying the new instance of the CAI, and a counter indicating the number of packets identified by the CAI seen since a last report.
12. An apparatus for providing access to communication associated information (CAI) of a communication between a subject and an associate, the apparatus comprising:
means for intercepting the communication, the communication comprising at least one packet and each packet comprising CAI;
means for providing an application identifier (AID) in the at least one packet of the communication, the AID identifying the format of the CAI, wherein the AID is located in an optional field of Network Layer 3;
means for extracting in accordance with the AID the CAI from the at least one packet for reporting;
means for determining whether the extracted CAI is a new instance of the CAI;
means for reporting to an LEA a first message in response to a determination that the extracted CAI is the new instance of the CAI;
means for determining whether a predetermined amount of time has elapsed between packets of the at least one packet of the communication, the packets being identified by the CAI; and
means for reporting to an LEA a second message in response to a determination that the given amount of time has elapsed, wherein the second message represents a timeout indication.
13. The apparatus of claim 12 , wherein the apparatus further comprises:
means for determining whether a given number of packets of the at least one packet of the communication has been intercepted, the packets being identified by the CAI; and
means for reporting an intermediate CAI message in response to a determination that the given number of packets of the at least one packet of the communication has been intercepted.
14. The apparatus of claim 12 , wherein the apparatus further comprises:
means providing an AID-tag in the at least one packet of the communication, the AID-tag indicating the presence of the AID.
15. The apparatus of claim 12 , wherein the apparatus further comprises:
means for providing an AID-tag in the at least one packet of the communication, wherein the AID-tag indicates the presence of the AID, and wherein the AID-tag is located in the protocol field of the Network Layer 3.
16. An apparatus for consolidating at least one packet of a communication between a subject and an associate, the apparatus comprising:
means for receiving at least one packet of the communication, each packet comprising communication associated information (CAI);
providing an application identifier (AID) in the at least one packet of the communication, the AID identifying the format of the CAI, wherein the AID is located in an optional field of Network Layer 3;
extracting in accordance with the AID the CAI from the at least one packet for reporting;
means for determining whether a packet is a new instance of CAI;
means for reporting to an LEA the CAI in response to a determination that the packet is the new instance of CAI;
means for determining whether a predetermined amount of time has elapsed between packets of the at least one packet;
means for reporting a timeout indication to an LEA in response to a determination that the predetermined amount of time has elapsed; and
means for reporting to an LEA the CAI periodically in response to a determination that the packet is a subsequent packet.
17. The apparatus of claim 16 , wherein the apparatus further comprises:
means for determining whether a given number of packets of the at least one packet of the communication has been intercepted, the packets being identified by the CAI; and
means for reporting an intermediate CAI message in response to a determination that the given number of packets of the at least one packet of the communication has been intercepted.
18. The apparatus of claim 16 , wherein the apparatus further comprises:
means providing an AID-tag in the at least one packet of the communication, the AID-tag indicating the presence of the AID.
19. The apparatus of claim 16 , wherein the apparatus further comprises:
means for providing an AID-tag in the at least one packet of the communication, wherein the AID-tag indicates the presence of the AID, and wherein the AID-tag is located in the protocol field of the Network Layer 3.