Methods and devices for detecting and correlating data packet flows in a lawful interception system

A mediation device in a Lawful Interception (LI) system for detecting and correlating copies of Session Initiation Protocol (SIP) and Real-time Transport Protocol (RTP) flows, respectively, belonging to a communication session of an intercepted user (a target), the session being established via an Internet Protocol Multimedia subsystem (IMS) having a well-known Access Point Name (APN), which session is intercepted in an IMS domain by an Interception Access Point (IMS/IAP) and in an Evolved Packet System (EPS) domain by an Interception Access Point (EPS/IAP), by which interception result in the generation of copies of the session's SIP and RTP flows comprising flow identity information defined by a set of identifiers (triplet) comprising Lawful Interception Identity, (LI-ID), and one of assigned IP user addresses IP_SIP or IP_RTP of the target, and identical content, the copies of SIP and RTP flows being received by the mediation device of a LI system, wherein the mediation device comprises:

• processing circuitry;
• memory containing instructions executable by the processing circuitry whereby the mediation device is operative to:
• determine a unique IMS Communication Identity Number (IMS CIN) and a corresponding correlation set of identifiers comprising Correlation Number of default Bearer (CN_def_B), Correlation Number of dedicated Bearer (CN_ded_B), and IMS Correlation Number (CN_IMS) for each intercepted communication session at Packet Data Protocol (PDP) context/Bearer set up and establishment event of the communication session via the IMS well-known APN;
• store each unique IMS CIN together with its correlation set for an intercepted communication session;
• correlate a SIP or RTP flow received from one domain to the same SIP or RTP flows of the same communication session received from the other domain by comparing the flow identity information of the received flow to the stored correlation sets for identifying a matching correlation set and its unique IMS CIN;
• and
• sending to a Law Enforcement Agency (LEA) requesting for LI of the target, the received SIP or RTP flow comprising the identified unique IMS CIN for a matching correlation set enabling the LEA to match SIP and RTP flows of the same communication session regardless of whether intercepted in an IMS domain or an EPS domain.

A non-transitory computer readable recording medium storing a computer program product for controlling a mediation device for detecting and correlating copies of Session Initiation Protocol (SIP) and Real-time Transport Protocol (RTP) flows, respectively, belonging to a communication session of an intercepted user (a target) the session being established via an Internet protocol Multimedia Subsystem (IMS) having a well-known Access Point Name (APN), which session is intercepted in an IMS domain by an Interception Access Point (IMS/IAP), and in an Evolved Packet System (EPS) domain by an Interception Access Point (EPS/IAP), by which interception result in the generation of copies of the session's SIP and RTP flows comprising flow identity information defined by a set of identifiers (triplet) comprising Lawful Interception Identity (LI-ID) and one of assigned IP user addresses IP_SIP or IP_RTP of the target, and identical content, the copies of SIP and RTP flows being received by a mediation function of a Lawful Interception (LI) system, the computer program product comprising software instructions which, when run on processing circuitry of the mediation device, causes the mediation device to:

• determine a unique IMS Communication Identity Number (IMS CIN) and a corresponding correlation set of identifiers comprising Correlation Number of default Bearer (CN_def_B), Correlation Number of dedicated Bearer (CN_ded_B), and IMS Correlation Number (CN_IMS) for each intercepted communication session at Packet Data Protocol (PDP) context/Bearer set up and establishment event of the communication session via the IMS well-known APN;
• store each unique IMS CIN together with its correlation set for an intercepted communication session;
• correlate a SIP or RTP flow received from one domain to the same SIP or RTP flows of the same communication session received from the other domain by comparing the flow identity information of the received flow to the stored correlation sets for identifying a matching correlation set and its unique IMS CIN;
• send, to a Law Enforcement Agency (LEA) requesting for LI of the target, the received SIP or RTP flow comprising the identified unique IMS CIN for a matching correlation set, enabling the LEA to match SIP and RTP flows of the same communication session regardless of whether intercepted in an IMS domain or an EPS domain.