Methods and apparatus for automatically securing communications between a mediation device and a law enforcement device
Methods and apparatus for automatically securing communications between a mediation device (MD) and a law enforcement device, such as an agent's terminal, to which intercepted communications, e.g., traffic, is sent are described. Based on a desired intercept request to be implemented, a Lawful Interception (LI) administration (admin) device (LID) identifies at least a first mediation device (MD) which will be involved in implementing the intercept request. The LID then proceeds to enable the use of a private certificate authority to automatically generate and provision the MD and a law enforcement device with certificates and private keys via an automated process. Each of the MD and law enforcement device automatically obtain a security certificate and corresponding private key. The security certificates and corresponding private keys are then used, in an automated manner, to establish a mutual TLS connection between the MD and the law enforcement device.
1 . A method of supporting lawful intercept, the method comprising:
operating a mediation device (MD) to obtain a security token from a lawful intercept certificate authority (LICA);
operating the MD to send the security token to a law enforcement device;
operating the law enforcement device to receive the security token from the MD;
operating the law enforcement device to send a request for a security certificate and a private key to the LICA, said request including the security token; and
operating the law enforcement device to establish a secure connection with the MD, operating the law enforcement device to establish a secure connection with the MD including using keys for mutual authentication, said keys for mutual authentication including the private key corresponding to the law enforcement device that is supplied by the LICA in response to the request from the law enforcement device.
2 . The method of claim 1 , wherein said security certificate is received by the law enforcement device via a communications channel which is different from a connection used to: i) support intercept related control signals between the MD and the law enforcement device and ii) deliver intercepted traffic from the MD to the law enforcement device.
3 . The method of claim 1 , wherein the law enforcement device further receives from the MD an IP address to be used for requesting the security certificate.
4 . The method of claim 3 , further comprising:
operating the MD to perform an authentication operation with a lawful intercept secrets engine (LISE) in which said LICA is located, said authentication operation being a successful authentication operation; and
sending the security token from the LICA to the MD following said successful authentication operation.
5 . The method of claim 3 , further comprising:
operating the law enforcement device to receive intercepted traffic from the MD via the secure connection; and
operating the law enforcement device to recover intercepted traffic by using the private key from the LICA to decrypt intercepted traffic communicated via the secure connection.
6 . The method of claim 5 , further comprising:
operating the MD to request the security token, to be used by the law enforcement device to obtain a certificate, from a lawful intercept secrets engine (LISE) as part of obtaining the security token from the LICA.
7 . The method of claim 6 , further comprising:
operating the MD to receive a MD username and a password from a legal intercept administrative device (LID) to be used to authenticate to the LISE when requesting the security token which can be used for certificate creation requests.
8 . The method of claim 7 , further comprising:
operating the MD to receive a MD security certificate and a corresponding MD private key from the LICA.
9 . The method of claim 7 , further comprising:
operating the MD to automatically request the MD security certificate and the corresponding MD private key from the LICA following being provisioned with the MD username and the password that can be used by the MD to authenticate to the LISE.
10 . The method of claim 9 , further comprising:
operating the MD to automatically request, using the MD username and the password, the security token from the LISE to be used to obtain the MD security certificate and the corresponding MD private key.
11 . The method of claim 10 , wherein the MD communicates the security token to the LISE when requesting the MD security certificate.
12 . A communications system supporting lawful intercept, the communications system comprising:
a mediation device (MD) including a MD processor configured to control the MD to obtain a security token from a lawful intercept certificate authority (LICA) and send the security token to a law enforcement device;
the law enforcement device, said law enforcement device including a first processor configured to control the law enforcement device to:
receive the security token from the MD;
send a request for a security certificate and a private key to the LICA, said request including the security token; and
establish a secure connection with the MD using keys for mutual authentication, said keys including the private key corresponding to the law enforcement device that is supplied by the LICA in response to the request from the law enforcement device.
13 . The communications system of claim 12 , wherein said security certificate is received by the law enforcement device via a communications channel which is different from a connection used to: i) support intercept related control signals between the MD and law enforcement device and ii) deliver intercepted traffic from the MD to the law enforcement device.
14 . The communications system of claim 12 , wherein said first processor in the law enforcement device is further configured to control the law enforcement device to:
receive from the MD an IP address to be used for requesting the security certificate.
15 . The communications system of claim 14 , wherein said received information from the MD further includes the security token to be used to authenticate to the LICA when requesting the security certificate.
16 . The communications system of claim 14 , wherein the first processor is further configured to control the law enforcement device to:
receive intercepted traffic from the MD via the secure connection; and
recover intercepted traffic by using the private key from the LICA to decrypt intercepted traffic communicated via the secure connection.
17 . The communications system of claim 16 , wherein the MD processor is further configured to control the MD to: request the security token, to be used by the law enforcement device to obtain the security certificate, as part of obtaining the security token from the LICA.
18 . The communications system of claim 17 , wherein said MD processor is further configured to control the MD to:
receive a MD username and a password from a legal intercept administrative device (LID) to be used to authenticate to a lawful intercept secrets engine (LISE) when requesting the security token which can be used for certificate creation requests.
19 . The communications system of claim 18 , wherein said MD processor is further configured to control the MD to:
receive a MD security certificate and a corresponding MD private key from the LICA.
20 . The communications system of claim 19 , wherein said MD processor is further configured to control the MD to:
automatically request the MD security certificate and the corresponding MD private key from the LICA following being provisioned with the MD username and the password that can be used by the MD to authenticate to the LISE.