Preventing illicit communications
View Patent ↗The present invention inspects packets to identify session initiation messages associated with select applications. A session initiation message may be any message used to initiate a communication session with another communication client. Once a session initiation message from a select application is identified, the intended communication session may be identified, monitored, prevented, or otherwise processed in a predefined manner. These select applications may be illicit applications from which communication sessions are actually or potentially unlawful or otherwise improper. The illicit communication sessions that the present invention seeks to control may be used for voice communications as well as for transferring data and facilitating application collaboration, such as is used in video conferencing or file sharing. The session initiation messages need not be received directly from the originating communication client for inspection. Packet inspections may take place at any location, such as aggregation points throughout the packet networks.
1. A packet inspection system comprising:
a) at least one packet-based communication interface;
b) a control system associated with the at least one packet-based communication interface and adapted to:
i) determine at least one select application to be monitored, wherein the at least one select application is potentially an illicit application from which communication sessions are actually or potentially unlawful or improper;
ii) monitor packets being routed;
iii) identify select ones of the packets representing session initiation messages associated with the at least one select application; and
iv) process the select ones of the packets according to defined criteria.
2. The packet inspection system of claim 1 wherein the defined criteria dictate that the select ones of the packets are dropped and the control system is further adapted to drop the select ones of the packets.
3. The packet inspection system of claim 1 wherein the defined criteria dictate that the select ones of the packets are routed toward their destination and the control system is further adapted to route the select ones of the packets.
4. The packet inspection system of claim 3 wherein the control system is further adapted to send reporting messages to a reporting service when the select ones of the packets are identified.
5. The packet inspection system of claim 1 wherein the control system is further adapted to send reporting messages to a reporting service when the select ones of the packets are identified.
6. The packet inspection system of claim 1 wherein the defined criteria dictate that the select ones of the packets are routed to a proxy for further processing and the control system is further adapted to route the select ones of the packets to the proxy.
7. The packet inspection system of claim 6 further comprising the proxy, which is adapted to route the select ones of the packets toward their destination such that traffic in resultant communication sessions can be monitored.
8. The packet inspection system of claim 1 wherein the control system is further adapted to monitor traffic in communication sessions associated with the session initiation messages.
9. The packet inspection system of claim 1 wherein the session initiation messages are intended to initiate packet-based communication sessions between at least two communication clients over a packet network through which the packets are routed.
10. The packet inspection system of claim 1 wherein the session initiation messages are session initiation protocol messages.
11. The packet inspection system of claim 10 wherein the session initiation protocol messages are invite messages.
12. The packet inspection system of claim 1 wherein the packet inspection system is a border gateway router.
13. The packet inspection system of claim 12 wherein the border gateway router is a national gateway router.
14. The packet inspection system of claim 12 wherein the border gateway router is an international gateway router.
15. The packet inspection system of claim 12 wherein the border gateway router is an enterprise gateway router.
16. The packet inspection system of claim 1 wherein the packet inspection system is a firewall.
17. The packet inspection system of claim 1 wherein the control system is further adapted to periodically receive information and update the defined criteria based on the information.
18. The packet inspection system of claim 1 wherein the at least one select application is an illicit application.
19. The packet inspection system of claim 1 wherein a session initiation message is configured to initiate a communication session for voice communications.
20. The packet inspection system of claim 1 wherein a session initiation message is configured to initiate a communication session for at least one of the group consisting of audio, video, and data communications.
21. A method for packet inspection comprising:
a) determining at least one select application to be monitored, wherein the at least one select application is potentially an illicit application from which communication sessions are actually or potentially unlawful or improper;
b) at a router, monitoring packets being routed;
c) at the router, identifying select ones of the packets representing session initiation messages associated with the at least one select application; and
d) processing, via the router, the select ones of the packets according to defined criteria.
22. The method of claim 21 wherein the defined criteria dictate that the select ones of the packets are dropped and further comprising dropping the select ones of the packets.
23. The method of claim 21 wherein the defined criteria dictate that the select ones of the packets are routed toward their destination and further comprising routing the select ones of the packets.
24. The method of claim 23 further comprising sending reporting messages to a reporting service when the select ones of the packets are identified.
25. The method of claim 21 further comprising sending reporting messages to a reporting service when the select ones of the packets are identified.
26. The method of claim 21 wherein the defined criteria dictate that the select ones of the packets are routed to a proxy for further processing and further comprising routing the select ones of the packets to the proxy.
27. The method of claim 26 wherein the proxy is adapted to route the select ones of the packets toward their destination such that traffic in resultant communication sessions can be monitored.
28. The method of claim 21 further comprising monitoring communication sessions associated with the session initiation messages.
29. The method of claim 21 wherein the session initiation messages are intended to initiate packet-based communication sessions between at least two communication clients over a packet network through which the packets are routed.
30. The method of claim 21 wherein the session initiation messages are session initiation protocol messages.
31. The method of claim 30 wherein the session initiation protocol messages are invite messages.
32. The method of claim 21 wherein the router is a border gateway router.
33. The method of claim 32 wherein the border gateway router is a national gateway router.
34. The method of claim 32 wherein the border gateway router is an international gateway router.
35. The method of claim 32 wherein the border gateway router is an enterprise gateway router.
36. The method of claim 21 wherein the router is provided in a firewall.
37. The method of claim 21 further comprising periodically receiving information and updating the defined criteria based on the information.
38. The method of claim 21 wherein the at least one select application is an illicit application.
39. The method of claim 21 wherein a session initiation message is configured to initiate a communication session for voice communications.
40. The method of claim 21 wherein a session initiation message is configured to initiate a communication session for at least one of the group consisting of audio, video, and data communications.
41. The packet inspection system of claim 1 wherein the control system is further adapted to determine the at least one select application to be monitored based on whether the at least one select application can be used for a communication session carrying traffic encrypted using illegal encryption technology.
42. The method of claim 21 wherein determining the at least one select application to be monitored is based on whether the at least one select application can be used for a communication session carrying traffic encrypted using illegal encryption technology.