# US 10,320,851 B2 · Methods and devices for detecting and correlating data packet flows in a lawful interception system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,320,851 B2
- Document ID: US10320851B2
- Status: Granted
- Kind: B2
- Application number: 15/752,726
- Filed: 2015-08-27
- Published: 2018-08-23
- Granted: 2019-06-11
- Earliest claimed: 2015-08-27
- Assignees: Telefonaktiebolaget LM Ericsson (publ)
- Applicants: Telefonaktiebolaget LM Ericsson (publ)
- Inventors: Andrea Senatore; Francesco Toro; Elvira Villani
- Web page: https://patentgrep.com/patent/US10320851B2

## CPC

- H04L 63/306: {intercepting packet switched data communications, e.g. Web, Internet or IMS communications}
- H04L 65/1016: IP multimedia subsystem [IMS]
- H04L 65/1104: Session initiation protocol [SIP]
- H04L 65/65: Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]
- H04M 3/2281: {Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls}
- H04W 12/80: Arrangements enabling lawful interception [LI]
- H04L 2463/121: Timestamp
- H04M 2207/185: wireless packet-switched
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

The following disclosure relates a method and mediation device (100) in a Lawful Interception (LI) system for detecting and correlating copies of SIP and RTP flows, from different domains EPS or IMS, said method comprising to determine a unique IMS Communication Identity Number, IMS CIN, and a corresponding correlation set of identifiers, storing each unique IMS CIN together with its correlation set for an intercepted communication session, correlating a SIP or RTP flow received from one domain to the same SIP or RTP flows of the same communication session received from the other domain by comparing the flow identity information of the received flow to the stored correlation sets for identifying a matching correlation set and its unique IMS CIN and sending to a LEA requesting for LI of the target said received SIP or RTP flow comprising said identified unique IMS CIN for a matching correlation set.

## Claims

### Claim 1

A method for detecting and correlating copies of Session Initiation Protocol (SIP) and Real-time Transport Protocol (RTP) flows, respectively, belonging to a communication session of an intercepted user (a target) the session being established via an Internet protocol Multimedia Subsystem (IMS) having a well-known Access Point Name (APN), which session is intercepted in an IMS domain by an Interception Access Point (IMS/IAP), and in an Evolved Packet System (EPSP) domain by an Interception Access Point (EPS/IAP), by which interception result in the generation of copies of the session's SIP and RTP flows comprising flow identity information defined by a set of identifiers (triplet) comprising Lawful Interception Identity (LI-ID) and one of assigned IP user addresses IP_SIP or IP_RTP of the target, and identical content, the copies of SIP and RTP flows being received by a mediation function of a Lawful Interception (LI) system, the method comprising:
determining a unique IMS Communication Identity Number (IMS CIN) and a corresponding correlation set of identifiers comprising Correlation Number of default Bearer (CN_def_B), Correlation Number of dedicated Bearer (CN_ded_B) and IMS Correlation Number (CN_IMS) for each intercepted communication session at Packet Data Protocol (PDP) context/Bearer set up and establishment event of the communication session via the IMS well-known APN;
storing each unique IMS CIN together with its correlation set for an intercepted communication session;
correlating a SIP or RTP flow received from one domain to the same SIP or RTP flows of the same communication session received from the other domain by comparing the flow identity information of the received flow to the stored correlation sets for identifying a matching correlation set and its unique IMS CIN;
sending, to a Law Enforcement Agency (LEA) requesting for LI of the target, the received SIP or RTP flow comprising the identified unique IMS CIN for a matching correlation set, enabling the LEA to match SIP and RTP flows of the same communication session regardless of whether intercepted in an IMS domain or an EPS domain.

### Claim 2 (depends on 1)

The method of claim 1, wherein the method comprises, at the PDP context/Bearer set up and communication session establishment event of a target:
receiving a default Bearer activation signaling from the EPS/IAP;
collecting identifiers LI-ID, CN_def_B, and IP_SIP constituting a first triplet of flow identity information from the default Bearer activation signaling;
storing the identifiers LI-ID, CN_def_B, and IP_SIP as identifiers in a correlation set for the communication session;
generating an IP Communication Identity Number (IP CIN) for the communication session;
sending a report of the Default Bearer Activation signaling comprising the IP CIN over HI2 to a LEA requesting for LI of the target.

### Claim 3 (depends on 2)

The method of claim 2, wherein the method comprises, at the PDP context/Bearer set up and communication session establishment event of a target:
receiving a dedicated Bearer activation signaling from the EPS/IAP;
collecting identifiers LI-ID, CN_ded_B, and IP_RTP constituting a second triplet from the dedicated Bearer activation signaling;
comparing LI-ID of the second triplet with LI-ID the stored first triplet;
storing the identifiers LI-ID, CN_ded_B, and IP_RTP as identifiers in the correlation set for the communication session, if the received LI-ID matches stored identifiers LI-ID in the first triplet;
sending a report of the Dedicated Bearer Activation signaling comprising the IP CIN over HI2 to a LEA requesting for LI of the target.

### Claim 4 (depends on 3)

The method of claim 3, wherein the determining comprises:
receiving a SIP flow for the first time after the communication session establishment event is finalized;
collecting identifiers LI-ID, CN_IMS, IP_SIP constituting a third triplet from the SIP flow;
comparing LI-ID and IP_SIP of the third triplet with LI-ID and IP_SIP of the stored first triplet;
storing the identifiers LI-ID, CN_IMS, and IP_SIP as identifiers in the correlation set for the communication session, if the comparison result is a match of LI-ID and IP_SIP with corresponding identifiers in the first triplet;
generating a unique IMS Communication Identity Number (IMS CIN) for identifying the correlation set of identifiers comprising CN_def_B, CN_ded_B, and CN_IMS of the communication session.

### Claim 5 (depends on 1)

The method of claim 1, wherein the correlating comprises:
comparing the flow identity information of the received flow to the stored correlation sets for identifying a matching correlation set and its unique IMS CIN;
identifying a matching correlation set comprising flow identity information of identifiers of the received flow;
inserting the unique IMS Communication Identity Number (IMS CIN) of a matching correlation set into a generated report of the received flow to be sent to the requesting LEA.

### Claim 6 (depends on 5)

The method of claim 5, wherein the correlating further comprises:
detecting if the triplet of identifiers is missing in the correlation set of the communication session;
inserting the missing triplet of identifiers of the flow into the correlation set of identifiers.

### Claim 7 (depends on 1)

The method of claim 1, wherein a complete correlation set comprises values of the identifiers CN_def_B, CN_ded_B, CN_IMS, IP_SIP, IP_RTP, and LI-ID.

### Claim 8 (depends on 7)

The method of claim 7, wherein the identifiers are constituting triplets of three identifiers, each triplet enabling identification whether the received flow is received from an EPS/IAP or IMS/IAP.

### Claim 9 (depends on 1)

The method of claim 1, wherein the identifier values of IP_SIP and IP_RTP both are the IP address of the assigned user, and the values are equal for a communication session.

### Claim 10 (depends on 9)

The method of claim 9, further comprising:
identifying a timestamp regarding a start time of the communication session; and
identifying a timestamp regarding a stop time of the communication session.

### Claim 11 (depends on 10)

The method according to claim 10, further comprising sending, to the LEA, the identified timestamps regarding the start and stop of a communication session.

### Claim 12

A mediation device in a Lawful Interception (LI) system for detecting and correlating copies of Session Initiation Protocol (SIP) and Real-time Transport Protocol (RTP) flows, respectively, belonging to a communication session of an intercepted user (a target), the session being established via an Internet Protocol Multimedia subsystem (IMS) having a well-known Access Point Name (APN), which session is intercepted in an IMS domain by an Interception Access Point (IMS/IAP) and in an Evolved Packet System (EPS) domain by an Interception Access Point (EPS/IAP), by which interception result in the generation of copies of the session's SIP and RTP flows comprising flow identity information defined by a set of identifiers (triplet) comprising Lawful Interception Identity, (LI-ID), and one of assigned IP user addresses IP_SIP or IP_RTP of the target, and identical content, the copies of SIP and RTP flows being received by the mediation device of a LI system, wherein the mediation device comprises:
processing circuitry;
memory containing instructions executable by the processing circuitry whereby the mediation device is operative to:
determine a unique IMS Communication Identity Number (IMS CIN) and a corresponding correlation set of identifiers comprising Correlation Number of default Bearer (CN_def_B), Correlation Number of dedicated Bearer (CN_ded_B), and IMS Correlation Number (CN_IMS) for each intercepted communication session at Packet Data Protocol (PDP) context/Bearer set up and establishment event of the communication session via the IMS well-known APN;
store each unique IMS CIN together with its correlation set for an intercepted communication session;
correlate a SIP or RTP flow received from one domain to the same SIP or RTP flows of the same communication session received from the other domain by comparing the flow identity information of the received flow to the stored correlation sets for identifying a matching correlation set and its unique IMS CIN; and
sending to a Law Enforcement Agency (LEA) requesting for LI of the target, the received SIP or RTP flow comprising the identified unique IMS CIN for a matching correlation set enabling the LEA to match SIP and RTP flows of the same communication session regardless of whether intercepted in an IMS domain or an EPS domain.

### Claim 13 (depends on 12)

The mediation device of claim 12, wherein the instructions are such that the mediation device is operative to, at the PDP context/Bearer set up and communication session establishment event of a target:
receive a default Bearer activation signaling from the EPS/IAP;
collect identifiers LI-ID, CN_def_B, and IP_SIP constituting a first triplet of flow identity information from the default Bearer activation signaling;
store the identifiers LI-ID, CN_def_B, and IP_SIP as identifiers in a correlation set for the communication session;
generate an IP Communication Identity Number (IP CIN) for the communication session;
send a report of the Default Bearer Activation signaling comprising the IP CIN over HI2 to a LEA requesting for LI of the target.

### Claim 14 (depends on 13)

The mediation device of claim 13, wherein the instructions are such that the mediation device is operative to, at the PDP context/Bearer set up and communication session establishment event of a target:
receive a dedicated Bearer activation signaling from the EPS/IAP;
collect identifiers LI-ID, CN_ded_B, and IP_RTP constituting a second triplet from the dedicated Bearer activation signaling;
compare LI-ID of the second triplet with LI-ID in the stored first triplet;
store the identifiers LI-ID, CN_ded_B, and IP_RTP as identifiers in the correlation set for the communication session, if the received LI-ID matches stored identifiers LI-ID in the first triplet;
send a report of the Dedicated Bearer Activation signaling comprising the IP CIN over HI2 to a LEA requesting for LI of the target.

### Claim 15 (depends on 14)

The mediation device of claim 14, wherein the instructions are such that the mediation device is operative to:
receive a SIP flow for the first time after the communication session establishment event is finalized;
collect identifiers LI-ID, CN_IMS, IP_SIP constituting a third triplet from the SIP flow;
compare LI-ID and IP_SIP of the third triplet with LI-ID and IP_SIP in the stored first triplet;
store the identifiers LI-ID, CN_IMS, and IP_SIP as identifiers in the correlation set for the communication session, if the comparison result is a match of LI-ID and IP_SIP with corresponding identifiers in the first triplet;
generate a unique IMS CIN for identifying the correlation set of identifiers comprising CN_def_B, CN_ded_B, and CN_IMS of the communication session.

### Claim 16 (depends on 12)

The mediation device of claim 12, wherein the instructions are such that the mediation device is operative to:
compare the flow identity information of the received flow to the stored correlation sets for identifying a matching correlation set and its unique IMS CIN;
Identify a matching correlation set comprising flow identity information of identifiers of the received flow;
Insert the unique IMS CIN of a matching correlation set into a generated report of the received flow to be sent to the requesting LEA.

### Claim 17 (depends on 16)

The mediation device of claim 16, wherein the instructions are such that the mediation device is operative to:
detect if the triplet of identifiers is missing in the correlation set of the communication session;
insert the missing triplet of identifiers of the flow into the correlation set of identifiers.

### Claim 18 (depends on 12)

The mediation device of claim 12, wherein a complete correlation set comprises values of the identifiers CN_def_B, CN_ded_B, CN_IMS, IP_SIP, IP_RTP, and LI-ID.

### Claim 19 (depends on 18)

The mediation device of claim 18, wherein the identifiers are constituting triplets of three identifiers, each triplet enabling identification whether the received flow is received from an EPS/IAP or IMS/IAP.

### Claim 20 (depends on 12)

The mediation device of claim 12, wherein the identifier values of IP_SIP and IP_RTP both are the IP address of the assigned user, and the values are equal for a communication session.

### Claim 21 (depends on 12)

The mediation device of claim 12, wherein the instructions are such that the mediation device is operative to:
identify a timestamp regarding the start time of the communication session; and
identify a timestamp regarding the stop time of the communication session.

### Claim 22 (depends on 21)

The mediation device of claim 21, wherein the instructions are such that the mediation device is operative to send, to the LEA, the identified timestamps regarding the start and stop of a communication session.

### Claim 23

A non-transitory computer readable recording medium storing a computer program product for controlling a mediation device for detecting and correlating copies of Session Initiation Protocol (SIP) and Real-time Transport Protocol (RTP) flows, respectively, belonging to a communication session of an intercepted user (a target) the session being established via an Internet protocol Multimedia Subsystem (IMS) having a well-known Access Point Name (APN), which session is intercepted in an IMS domain by an Interception Access Point (IMS/IAP), and in an Evolved Packet System (EPS) domain by an Interception Access Point (EPS/IAP), by which interception result in the generation of copies of the session's SIP and RTP flows comprising flow identity information defined by a set of identifiers (triplet) comprising Lawful Interception Identity (LI-ID) and one of assigned IP user addresses IP_SIP or IP_RTP of the target, and identical content, the copies of SIP and RTP flows being received by a mediation function of a Lawful Interception (LI) system, the computer program product comprising software instructions which, when run on processing circuitry of the mediation device, causes the mediation device to:
determine a unique IMS Communication Identity Number (IMS CIN) and a corresponding correlation set of identifiers comprising Correlation Number of default Bearer (CN_def_B), Correlation Number of dedicated Bearer (CN_ded_B), and IMS Correlation Number (CN_IMS) for each intercepted communication session at Packet Data Protocol (PDP) context/Bearer set up and establishment event of the communication session via the IMS well-known APN;
store each unique IMS CIN together with its correlation set for an intercepted communication session;
correlate a SIP or RTP flow received from one domain to the same SIP or RTP flows of the same communication session received from the other domain by comparing the flow identity information of the received flow to the stored correlation sets for identifying a matching correlation set and its unique IMS CIN;
send, to a Law Enforcement Agency (LEA) requesting for LI of the target, the received SIP or RTP flow comprising the identified unique IMS CIN for a matching correlation set, enabling the LEA to match SIP and RTP flows of the same communication session regardless of whether intercepted in an IMS domain or an EPS domain.