# US 10,374,913 B2 · Data retention probes and related methods > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,374,913 B2 - Document ID: US10374913B2 - Status: Granted - Kind: B2 - Application number: 15/545,367 - Filed: 2016-01-26 - Published: 2017-12-28 - Granted: 2019-08-06 - Earliest claimed: 2015-01-26 - Assignees: Telesoft Technologies Ltd. - Applicants: Telesoft Technologies Ltd - Inventors: Matthew George; John Townsend; John Allen - Web page: https://patentgrep.com/patent/US10374913B2 ## CPC - H04L 61/2514: between local and global IP addresses - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/12: Network monitoring probes - H04L 63/306: {intercepting packet switched data communications, e.g. Web, Internet or IMS communications} - H04L 63/308: {retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content} - H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] - H04L 69/22: Parsing or analysis of headers - H04L 2101/618: Details of network addresses - H04L 2101/654: International mobile subscriber identity [IMSI] numbers - H04W 80/06: Transport layer protocols, e.g. TCP [Transport Control Protocol] over wireless {(transmission control protocol/Internet protocol [TCP/IP] or user datagram protocol [UDP] H04L69/16)} - H04W 88/16: Gateway arrangements - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A data retention probe for a packet-switched, mobile telecommunications network employs interfaces to connect to interfaces carrying traffic on a mobile network side of a gateway node and on a global internet side of the gateway node. A FPGA creates for each packet at least one fingerprint of one or more fields that are unchanged as part of the address translation performed by the gateway node and to create informative metadata for those packets. A processing unit: (1) receives from the FPGA the fingerprints and metadata and maintains flow records for each flow of packets seen on each side of the gateway node; and (2) compares the fingerprints and, where a match is found, determines those packets to be part of the same communication session and creates a record correlating internal IP address or a subscriber identifier to external IP address and port number. ## Claims ### Claim 1 A data retention probe for a packet-switched, mobile telecommunications network, the mobile network being arranged to forward packets between subscriber units and a gateway node, wherein the gateway node translates internal IP addresses used within the mobile network to global IP addresses and port numbers used outside the mobile network in the global internet, the probe comprising: a first interface arranged to connect to an interface carrying traffic on the mobile network side of the gateway node; a second interface arranged to connect to an interface carrying traffic on the global internet side of the gateway node; a FPGA arranged to process packets on the mobile network seen via the first interface and on the global internet side seen via the second interface to create for each packet at least one fingerprint of one or more fields in the packets that are unchanged as part of the address translation performed by the gateway node and to create metadata for those packets comprising addressing information for those packets; a processing unit in communication with the FPGA arranged to receive from the FPGA the fingerprints and metadata and to maintain flow records for each flow of packets seen on each side of the gateway node, the processing unit being further arranged to compare the fingerprints of said packets in the flow records for the mobile network and global internet respectively and, where a match is found, to determine those packets to be part of the same communication session, and, where packets are determined to be part of the same communication session, create a record correlating internal IP address or a subscriber identifier within the mobile network to external IP address and port number for those packets. ### Claim 2 (depends on 1) A data retention probe according to claim 1, wherein the FPGA is arranged to filter TCP session control events and passes these events to the processing unit together, and wherein the processing unit is arranged to maintain stateful flow records for packets seen on both sides of the gateway node. ### Claim 3 (depends on 1) A data retention probe according to claim 1, wherein the FPGA is arranged to create a fingerprint for the application data portions of said packets and passes the fingerprints to the processing unit which is arranged to store the fingerprint in the flow record for that flow and to compare the fingerprints in flow records for packets seen on each side of the gateway node to identify a match. ### Claim 4 (depends on 1) A data retention probe according to claim 1, wherein the FPGA is arranged to calculate a hash value on the 5-tuple of addressing information in the packets and wherein the processing unit is arranged to maintain flow records for packets seen on each side of the gateway node indexed by the 5-tuple hash. ### Claim 5 (depends on 4) A data retention probe according to claim 4, wherein the metadata includes the 5-tuple of addressing information in packets, wherein the processing unit is arranged to maintain flow records for packets seen on each side of the gateway node indexed by a non-unique 5-tuple hash and using the 5-tuple addressing information values to uniquely identify a flow record for that flow. ### Claim 6 (depends on 1) A data retention probe according to claim 1, wherein the FPGA is arranged to also calculate a hash value of destination addressing information in the packets which is also passed to the processing unit, the processing unit being arranged to store the destination hash in the flow records and to compare the destination hash in flow records for packets seen on each side of the gateway node to identify a match. ### Claim 7 (depends on 6) A data retention probe according to claim 6, wherein the fingerprints are grouped according to the destination hash in the flow records, such that, when identifying a match between the flow records seen on each side of the gateway node, the processing unit first identifies in the respective flow records a match between the destination hashes, and then identifies a match between fingerprints associated with the matching destination hashes. ### Claim 8 (depends on 1) A data retention probe according to claim 1, wherein the processing unit is arranged to determine packets to be part of the same communication session only when said packets with matching application data fingerprint and/or destination hash are seen on the mobile network and global internet respectively within a predetermined time period. ### Claim 9 (depends on 1) A data retention probe according to claim 1, wherein multiple packets are matched within the time period to determine the packets belong to the same flow. ### Claim 10 (depends on 4) A data retention probe according to claim 4, comprising plural processing units each arranged to match a subset of flow records for one side of the gateway node with flow records on the other side of the gateway node, wherein the FPGA load balances between the plural processing units according to the 5-tuple hash value. ### Claim 11 (depends on 1) A data retention probe according to claim 1, wherein the FPGA is arranged to identify tunnel control packets on the mobile network and to calculate a hash of one or more fields in a tunnelled packet, the fields including at least the tunnel identifier, and to pass the hash to the processing unit together with metadata identifying the subscriber, the processing unit arranged to store a record of tunnels correlated to subscriber identifier indexed by said hash value, the FPGA being further arranged to calculate a hash of said fields in session control packets and/or user data packets seen on the mobile network and to pass the hashes to the processing unit, and if a match is found, the processing unit is arranged to lookup the subscriber identifier in the record using the received hash value for that flow and to store the subscriber identifier in the flow record. ### Claim 12 A method of carrying out data retention for a packet-switched, mobile telecommunications network, the mobile network being arranged to forward packets between subscriber units and a gateway node, wherein the gateway node translates internal IP addresses used within the mobile network to global IP addresses and port numbers used outside the mobile network in the global internet, the method comprising: connecting to the mobile network side of the gateway node and connecting to the global internet side of the gateway node; processing with a FPGA packets on the mobile network seen via the first interface and on the global internet side seen via the second interface to create for each packet at least one fingerprint of one or more fields in the packets that are unchanged as part of the address translation performed by the gateway node and to create metadata for those packets comprising addressing information for those packets; receiving at a processing unit from the FPGA the fingerprints and metadata and maintaining flow records with the processing unit for each flow of packets seen on each side of the gateway node; comparing with the processing unit the fingerprints of said packets in the flow records for the mobile network and global internet respectively and, where a match is found, determining those packets to be part of the same communication session; and, where packets are determined to be part of the same communication session, creating a record correlating internal IP address or a subscriber identifier within the mobile network to external IP address and port number for those packets. ### Claim 13 (depends on 12) A method according to claim 12, wherein the FPGA filters TCP session control events and passes these events to the processing unit, and wherein the processing unit stores stateful flow records for packets seen on each side of the gateway node. ### Claim 14 (depends on 12) A method according to claim 12, wherein the FPGA creates a fingerprint for the application data portions of said packets and passes the fingerprints to the processing unit which stores the fingerprints in the flow record for that flow and compares the fingerprints in flow records for packets seen on each side of the gateway node to identify a match. ### Claim 15 (depends on 12) A method according to claim 12, wherein the FPGA calculates a hash value on the 5-tuple of addressing information in the packets and wherein the processing unit maintains flow records for packets seen on each side of the gateway node indexed by the 5-tuple hash. ### Claim 16 (depends on 15) A method according to claim 15, wherein the metadata includes the 5-tuple of addressing information in packets, wherein the processing unit maintains flow records for packets seen on each side of the gateway node indexed by a non-unique 5-tuple hash and using the 5-tuple addressing information values to uniquely identify a flow record for that flow. ### Claim 17 (depends on 12) A method according to claim 12, wherein the FPGA calculates a hash value of destination addressing information in the packets comprising destination port, destination IP address and protocol which is also passed to the processing unit, the processing unit storing the destination hash in the flow records and comparing the destination hash in flow records for packets seen on each side of the gateway node to identify a match. ### Claim 18 (depends on 17) A method according to claim 17, wherein the fingerprints are grouped according to the destination hash in the flow records, such that, when identifying a match between the flow records seen on each side of the gateway node, the processing unit first identifies in the respective flow records a match between the destination hashes, and then identifies a match between fingerprints associated with the matching destination hashes. ### Claim 19 (depends on 12) A method according to claim 12, wherein the processing unit determines packets to be part of the same communication session only when said packets with matching application data and/or destination hash are seen on the mobile network and global internet respectively within a predetermined time period. ### Claim 20 (depends on 12) A method according to claim 12, wherein multiple packets are matched within the time period to determine the packets belong to the same flow.