Deciphering internet protocol (IP) security in an IP multimedia subsystem (IMS) using a monitoring system

1. A method, comprising:

performing, by a telecommunications monitoring system:

identifying a Security Association (SA) between a User Equipment (UE) and a Proxy Call Session Control Function (P-CSCF) of an Internet Protocol (IP) Multimedia Subsystem (IMS) over a Gm interface during a registration procedure wherein identifying the SA includes identifying a first SA pair and a second SA pair, wherein the first SA pair includes: (a) a UE client SPI value and UE IP address and (b) a UE server SPI value and UE IP address, and wherein the second SA pair includes (a) a P-CSCF client SPI value and P-CSCF IP address and (b) a P-CSCF server SPI value and P-CSCF IP address;

correlating the SA with a ciphering key (CK) exchanged between the P-CSCF and a Serving CSCF (S-CSCF) of the IMS over an Mw interface during the registration procedure; and

storing an indication of the correlated SA and CK in a deciphering record.

2. The method of claim 1 , wherein the SA includes a security parameter index (SPI) and a destination IP address.

3. The method of claim 1 , wherein correlating the SA with the CK includes matching a user identity from a message exchanged between the UE and the P-CSCF during the registration procedure against another message exchanged between the P-CSCF and the S-CSCF during the registration procedure.

4. The method of claim 3 , wherein the user identity is an IP Multimedia Private Identity (IMPI) value.

5. The method of claim 1 , further comprising storing, in the deciphering record, an indication of a security algorithm type to be used in subsequent communications between the UE and the IMS.

6. The method of claim 1 , further comprising:

performing, by the telecommunications monitoring system:

after the registration procedure, receiving a ciphered packet exchanged

between the UE and the P-CSCF over the Gm interface;

ascertaining an SA associated with the ciphered packet;

identifying a CK corresponding to the ascertained SA in the deciphering record; and

deciphering the ciphered packet, at least in part, using the identified CK.

7. The method of claim 6 , wherein ascertaining the SA includes ascertaining at least one of: (a) a UE client SPI value and UE IP address, (b) a UE server SPI value and UE IP address, (c) a P-CSCF client SPI value and P-CSCF IP address, and (d) a P-CSCF server SPI value and P-CSCF IP address.

8. The method of claim 6 , wherein the ciphered packet follows an Encapsulating Security Payload (ESP) protocol.

9. The method of claim 8 , wherein the ciphered packet is transmitted in Transport Mode.

10. A telecommunications monitoring system, comprising:

a processor; and

a memory coupled to the processor, the memory configured to store program instructions executable by the processor to cause the telecommunications monitoring system to:

identify a Security Association (SA) between a User Equipment (UE) and a Proxy Call Session Control Function (P-CSCF) of an Internet Protocol (IP) Multimedia Subsystem (IMS) over a Gm interface during an authentication procedure;

correlate the SA with a ciphering key (CK) exchanged between the P-CSCF and a Serving CSCF (S-CSCF) of the IMS over an Mw interface during the authentication procedure wherein to correlate the SA with the CK, the program instructions are further executable by the processor to cause the telecommunications monitoring system to match a user identity from a message exchanged between the UE and the P-CSCF during the authentication procedure against another message exchanged between the P-CSCF and the S-CSCF during the authentication procedure;

store an indication of the correlated SA and CK in a deciphering record;

receive a ciphered packet exchanged between the UE and the P-CSCF after the authentication procedure, the ciphered packet following an Encapsulating Security Payload (ESP) protocol in Transport Mode;

ascertain an SA associated with the ciphered packet;

identify a CK corresponding to the ascertained SA in the deciphering record;

and decipher the ciphered packet, at least in part, using the identified CK.

11. The telecommunications monitoring system of claim 10 , wherein the SA includes a security parameter index (SPI) and a destination IP address.

12. The telecommunications monitoring system of claim 11 , wherein the SA includes a first SA pair and a second SA pair, wherein the first SA pair includes: (a) a UE client SPI value and UE IP address and (b) a UE server SPI value and UE IP address, and wherein the second SA pair includes (a) a P-CSCF client SPI value and P-CSCF IP address and (b) a P-CSCF server SPI value and P-CSCF IP address.

13. The telecommunications monitoring system of claim 10 , wherein the user identity is an IP Multimedia Private Identity (IMPI) value.

14. A tangible computer-readable storage medium having program instructions stored thereon that, upon execution by a processor within a computer system, cause the computer system to:

identify a Security Association (SA) between a User Equipment (UE) and a Proxy Call Session Control Function (P-CSCF) of an Internet Protocol (IP) Multimedia Subsystem (IMS) over a Gm interface during an authentication procedure;

correlate the SA with a ciphering key (CK) exchanged between the P-CSCF and a Serving CSCF (S-CSCF) of the IMS over an Mw interface during the authentication procedure wherein to correlate the SA with the CK, the program instructions are further executable by the processor to cause the computer system to match a user identity from a message exchanged between the UE and the P-CSCF during the authentication procedure against another message exchanged between the P-CSCF and the S-CSCF during the authentication procedure;

store an indication of the correlated SA and CK in a deciphering record;

receive a ciphered packet exchanged between the UE and the P-CSCF after the authentication procedure, the ciphered packet following an Encapsulating Security Payload (ESP) protocol in Transport Mode;

ascertain an SA associated with the ciphered packet;

identify a CK corresponding to the ascertained SA in the deciphering record; and

decipher the ciphered packet, at least in part, using the identified CK.

15. The tangible computer-readable storage medium of claim 14 , wherein the SA includes a security parameter index (SPI) and a destination IP address.

16. The tangible computer-readable storage medium of claim 14 , wherein the SA includes a first SA pair and a second SA pair, wherein the first SA pair includes: (a) a UE client SPI value and UE IP address and (b) a UE server SPI value and UE IP address, and wherein the second SA pair includes (a) a P-CSCF client SPI value and P-CSCF IP address and (b) a P-CSCF server SPI value and P-CSCF IP address.

17. The tangible computer-readable storage medium of claim 14 , wherein the user identity is an IP Multimedia Private Identity (IMPI) value.