Methods, systems, and computer readable media for distributing monitored network traffic

1. A method for distributing monitored network traffic, the method comprising:

at a monitoring node load balancer implemented using at least one processor:

monitoring S1-MME traffic and S6a traffic in a core network of a telecommunications network, wherein monitoring the S1-MME traffic and S6a traffic comprises building a table with a record for each subscriber of a plurality of subscribers attaching to the telecommunications network, and wherein building the table comprises correlating, in each record, a first subscriber identifier extracted from an attachment request in the S1-MME traffic with a second subscriber identifier extracted from an attachment response in the S1-MME traffic;

decrypting encrypted S1-MME traffic using information extracted from the S6a traffic, including extracting, from at least one encrypted message, a respective second subscriber identifier from the encrypted message; and

load balancing between a plurality of monitoring nodes using the decrypted S1-MME traffic, wherein load balancing comprises distributing tapped traffic from the core network across the plurality of monitoring nodes using the first and second subscriber identifiers, and wherein distributing the tapped traffic includes distributing the encrypted S1-MME traffic by selecting a respective monitoring node for the encrypted message by accessing the respective record for the respective second subscriber identifier in the table.

2. The method of claim 1 , wherein the first subscriber identifier is an international mobile subscriber identity (IMSI) and the second subscriber identifier is a globally unique temporary UE identity (GUTI).

3. The method of claim 1 , wherein building the table comprises storing an encryption key extracted from the S6a traffic.

4. The method of claim 3 , wherein the encryption key comprises a Key Access Security Management Entries (KASME)key.

5. The method of claim 3 , wherein decrypting the encrypted S1-MME traffic comprises locating, for an encrypted message, a corresponding encryption key using a key identifier for the encrypted message and decrypting the encrypted message using the encryption key.

6. A system for distributed monitored network traffic, the system comprising:

at least one processor; and

a monitoring node load balancer implemented using the at least one processor;

wherein the monitoring node load balancer is configured for:

monitoring S1-MME traffic and S6a traffic in a core network of a telecommunications network, wherein monitoring the S1-MME traffic and S6a traffic comprises building a table with a record for each subscriber of a plurality of subscribers attaching to the telecommunications network, and wherein building the table comprises correlating, in each record, a first subscriber identifier extracted from an attachment request in the S1-MME traffic with a second subscriber identifier extracted from an attachment response in the S1-MME traffic;

decrypting encrypted S1-MME traffic using information extracted from the S6a traffic, including extracting, from at least one encrypted message, a respective second subscriber identifier from the encrypted message; and

load balancing between a plurality of monitoring nodes using the decrypted S1-MME traffic, wherein load balancing comprises distributing tapped traffic from the core network across the plurality of monitoring nodes using the first and second subscriber identifiers, and wherein distributing the tapped traffic includes distributing the encrypted S1-MME traffic by selecting a respective monitoring node for the encrypted message by accessing the respective record for the respective second subscriber identifier in the table.

7. The system of claim 6 , wherein the first subscriber identifier is an international mobile subscriber identity (IMSI) and the second subscriber identifier is a globally unique temporary UE identity (GUTI).

8. The system of claim 6 , wherein building the table comprises storing an encryption key extracted from the S6a traffic.

9. The system of claim 8 , wherein the encryption key comprises a Key Access Security Management Entries (KASME) key.

10. The system of claim 8 , wherein decrypting the encrypted S1-MME traffic comprises locating, for an encrypted message, a corresponding encryption key using a key identifier for the encrypted message and decrypting the encrypted message using the encryption key.

11. One or more non-transitory computer readable mediums storing instructions for at least one processor that, when executed by the at least one processor, cause the at least one processor to perform operations comprising:

monitoring S1-MME traffic and S6a traffic in a core network of a telecommunications network, wherein monitoring the S1-MME traffic and S6a traffic comprises building a table with a record for each subscriber of a plurality of subscribers attaching to the telecommunications network, and wherein building the table comprises correlating, in each record, a first subscriber identifier extracted from an attachment request in the S1-MME traffic with a second subscriber identifier extracted from an attachment response in the S1-MME traffic;

decrypting encrypted S1-MME traffic using information extracted from the S6a traffic, including extracting, from at least one encrypted message, a respective second subscriber identifier from the encrypted message; and

load balancing between a plurality of monitoring nodes using the decrypted S1-MME traffic, wherein load balancing comprises distributing tapped traffic from the core network across the plurality of monitoring nodes using the first and second subscriber identifiers, and wherein distributing the tapped traffic includes distributing the encrypted S1-MME traffic by selecting a respective monitoring node for the encrypted message by accessing the respective record for the respective second subscriber identifier in the table.