Peer-to-peer communication session monitoring
View Patent ↗The present invention allows primary communication sessions that are established between two communication clients to be monitored, wherein such monitoring occurs without the knowledge of the communication clients. An intercept tunnel is created between an intercept server and an access concentration point, which supports at least one of the communication clients over an access network. The access concentration point and the intercept server will cooperate to allow the communication session to be established, wherein a portion of the communication session will be established over the intercept tunnel. A first communication session is established with the first communication client through the access concentration point, a portion of it provided via the intercept tunnel. A second communication session is established with the second communication client. The intercept server will essentially receive and forward traffic to and from the first and second communication clients over respective first and second communication sessions.
1. A method comprising:
providing a tunnel with a first access concentration point;
for a primary communication session between a first communication client and a second communication client:
establishing a first communication session with the first communication client via the first access concentration point on behalf of the second communication client, wherein at least a portion of a path for the first communication session is provided by the tunnel;
establishing a second communication session with the second communication client on behalf of the first communication client;
receiving packet traffic from either of the first or second communication clients via a corresponding one of the first and second communication sessions to obtain recovered packet traffic;
forwarding the recovered packet traffic toward a destination of either the first or second communication client via a corresponding one of the first or second communication sessions; and
effecting monitoring of the recovered packet traffic.
2. The method of claim 1 wherein effecting monitoring of the recovered packet traffic further comprises effecting monitoring of the recovered packet traffic such that at least a portion of content of the primary communication session can be monitored.
3. The method of claim 2 wherein effecting monitoring of the recovered packet traffic further comprises sending the recovered packet traffic to a monitoring entity where the content of the primary communication session is analyzed.
4. The method of claim 1 wherein receiving the packet traffic further comprises decrypting the packet traffic to obtain the recovered packet traffic, and forwarding the recovered packet traffic further comprises encrypting the recovered packet traffic prior to forwarding the recovered packet traffic toward the destination.
5. The method of claim 4 wherein establishing the first communication session further comprises exchanging first cryptography indicia with the first communication client to facilitate decrypting the packet traffic and encrypting the recovered packet traffic for the first communication session.
6. The method of claim 5 wherein establishing the second communication session further comprises exchanging second cryptography indicia with the second communication client to facilitate decrypting the packet traffic and encrypting the recovered packet traffic for the second communication session.
7. The method of claim 6 wherein the first cryptography indicia and the second cryptography indicia are different.
8. The method of claim 1 further comprising receiving from the first access concentration point via the tunnel a session initiation message to establish the primary communication session, wherein receipt of the session initiation message triggers establishment of the first and second communication sessions.
9. The method of claim 8 wherein the session initiation message is redirected over the tunnel upon the first access concentration point determining the primary communication session is a communication session to be monitored.
10. The method of claim 1 wherein the first access concentration point redirects primary communication sessions originating from a predefined source or address to be established via the tunnel for monitoring.
11. The method of claim 1 wherein the first access concentration point redirects primary communication sessions intended for a predefined destination or address to be established via the tunnel for monitoring.
12. The method of claim 1 wherein the first access concentration point redirects primary communication sessions that are peer-to-peer communication sessions to be established via the tunnel for monitoring.
13. The method of claim 1 wherein the primary communication session is intended to be a peer-to-peer communication session to be established via the tunnel for monitoring.
14. The method of claim 1 wherein the first and second communication clients are unaware that the primary communication session is being monitored.
15. An apparatus for intercepting communications comprising:
at least one packet communication interface; and
a control system associated with the at least one packet communication interface and adapted to:
provide a tunnel with a first access concentration point; and
for a primary communication session between a first communication client and a second communication client:
establish a first communication session with the first communication client via the first access concentration point on behalf of the second communication client, wherein at least a portion of a path for the first communication session is provided by the tunnel;
establish a second communication session with the second communication client on behalf of the first communication client;
receive packet traffic from either of the first or second communication client via a corresponding one of the first or second communication sessions to obtain recovered packet traffic;
forward the recovered packet traffic toward a destination of either the first or second communication clients via a corresponding one of the first or second communication sessions; and
effect monitoring of the recovered packet traffic.
16. The apparatus of claim 15 wherein to effect monitoring of the recovered packet traffic, the control system is further adapted to effect monitoring of the recovered packet traffic such that at least a portion of the content of the primary communication session can be monitored.
17. The apparatus of claim 16 wherein to effect monitoring of the recovered packet traffic, the control system is further adapted to send the recovered packet traffic to a monitoring entity where the content of the primary communication session is analyzed.
18. The apparatus of claim 16 wherein to receive the packet traffic the control system is further adapted to decrypt the packet traffic to obtain the recovered packet traffic, and to forward the recovered packet traffic the control system is further adapted to encrypt the recovered packet traffic prior to forwarding the recovered packet traffic toward the destination.
19. The apparatus of claim 18 wherein to establish the first communication session the control system is further adapted to exchange first cryptography indicia with the first communication client to facilitate decrypting the packet traffic and encrypting the recovered packet traffic for the first communication session.
20. The apparatus of claim 19 wherein to establish the second communication session the control system is further adapted to exchange second cryptography indicia with the second communication client to facilitate decrypting the packet traffic and encrypting the recovered packet traffic for the second communication session.
21. The apparatus of claim 20 wherein the first cryptography indicia and the second cryptography indicia are different.
22. The apparatus of claim 16 wherein the control system is further adapted to receive from the first access concentration point via the tunnel a session initiation message to establish the primary communication session, wherein receipt of the session initiation message triggers establishment of the first and second communication sessions.
23. The apparatus of claim 22 wherein the session initiation message is redirected over the tunnel upon the first access concentration point determining the primary communication session is a communication session to be monitored.
24. The apparatus of claim 16 wherein the first access concentration point redirects primary communication sessions originating from a predefined source or address to be established via the tunnel for monitoring.
25. The apparatus of claim 16 wherein the first access concentration point redirects primary communication sessions intended for a predefined destination or address to be established via the tunnel for monitoring.
26. The apparatus of claim 16 wherein the first access concentration point redirects primary communication sessions that are peer-to-peer communication sessions to be established via the tunnel for monitoring.
27. The apparatus of claim 16 wherein the primary communication session is intended to be a peer-to-peer communication session to be established via the tunnel for monitoring.
28. The apparatus of claim 16 wherein the first and second communication clients are unaware that the primary communication session is being monitored.