# US 11,310,669 B2 · Systems and methods for intercepting network traffic

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,310,669 B2
- Document ID: US11310669B2
- Status: Granted
- Kind: B2
- Application number: 16/546,186
- Filed: 2019-08-20
- Published: 2021-02-25
- Granted: 2022-04-19
- Earliest claimed: 2019-08-20
- Assignees: Verizon Patent and Licensing Inc.
- Applicants: Verizon Patent and Licensing Inc.
- Inventors: Amir Saghir; Sudhakar Reddy Patil; William W. Wong; Rakesh H. Chandwani
- Web page: https://patentgrep.com/patent/US11310669B2

## CPC

- H04W 12/80: Arrangements enabling lawful interception [LI]
- G06F 16/955: using information identifiers, e.g. uniform resource locators [URL]
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/302: {gathering intelligence information for situation awareness or reconnaissance}
- H04L 63/304: {intercepting circuit switched data communications (lawful interception of wireless network communications H04W12/02)}
- H04L 63/306: {intercepting packet switched data communications, e.g. Web, Internet or IMS communications}
- H04W 28/16: Central resource management; Negotiation of resources or communication parameters, e.g. negotiating bandwidth or QoS [Quality of Service]
- H04W 76/10: Connection setup
- H04W 76/11: Allocation or use of connection identifiers
- H04W 76/22: Manipulation of transport tunnels
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system described herein may provide a technique for intercepting user equipment (“UE”) traffic based on granular characteristics specified by a law enforcement agency (“LEA”) or other authorized requestor. The granular characteristics may indicated a content type, keywords, and/or other characteristics that the requestor may desire to intercept. Traffic attributes, which may be different from the granular characteristics, may be identified based on the granular characteristics. Network components suited to intercepting traffic having the identified attributes may be provisioned to intercept the traffic.

## Claims

### Claim 1

A device, comprising:
a non-transitory computer-readable medium storing a set of processor-executable instructions; and
one or more processors configured to execute the set of processor-executable instructions, wherein executing the set of processor-executable instructions causes the one or more processors to:
maintain correlation information indicating respective correlations between a plurality of keywords and a plurality of traffic attributes;
receive, from one or more requesting devices, a request to intercept target traffic, sent via a wireless network, associated with a particular user equipment (“UE”), the request including a particular set of keywords;
identify, based on the correlation information, a particular set of traffic attributes, of the plurality of traffic attributes, that are correlated to the particular set of keywords included in the request, wherein the particular set of traffic attributes includes a particular network slice;
select one or more network components, out of a plurality of network components of the wireless network, that handle traffic that meets the particular set of traffic attributes, wherein selecting the one or more network components includes selecting one or more network components associated with the particular network slice;
configure the selected one or more network components associated with the particular network slice to intercept target traffic, associated with the UE, that meets the particular set of traffic attributes; and
receive, from the one or more network components, the intercepted target traffic associated with the UE, wherein the intercepted target traffic has been intercepted by the one or more network components based on the particular set of traffic attributes, the intercepted target traffic being a subset of traffic associated with the UE.

### Claim 2 (depends on 1)

The device of claim 1,
wherein executing the processor-executable instructions to identify the one or more traffic attributes further causes the one or more processors to identify whether the particular set of keywords are associated with control plane traffic or with user plane traffic, and
wherein executing the processor-executable instructions to select the one or more network components includes:
selecting a first network component that handles control plane traffic when the particular set of keywords are associated with control plane traffic, and
selecting a second network component that handles user plane traffic when the particular set of keywords are associated with user plane traffic.

### Claim 3 (depends on 2)

The device of claim 2, wherein identifying the particular network component includes identifying a Session Management Function (“SMF”) of the wireless network when the particular set of keywords are associated with control plane traffic.

### Claim 4 (depends on 1)

The device of claim 1,
wherein executing the processor-executable instructions to identify the one or more traffic attributes further causes the one or more processors to identify that the particular set of keywords are associated with a particular Uniform Resource Identifier (“URI”) or Internet Protocol (“IP”) address, and
wherein executing the processor-executable instructions to configure the one or more network components includes configuring the one or more network components to intercept traffic associated with the particular URI or IP address.

### Claim 5 (depends on 1)

The device of claim 1, wherein the traffic associated with the UE includes a set of traffic associated with a particular application, wherein the target traffic includes traffic associated with the particular application, and wherein the target traffic is less than all of the traffic included in the set of traffic associated with the particular application.

### Claim 6

A method, comprising:
maintaining correlation information indicating respective correlations between a plurality of keywords and a plurality of traffic attributes;
receiving, by a device and from one or more requesting devices, a request to intercept target traffic, sent via a wireless network, associated with a particular user equipment (“UE”), the request including a particular set of keywords;
identifying, based on the correlation information, a particular set of traffic attributes, of the plurality of traffic attributes, that are correlated to the particular set of keywords included in the request, wherein the particular set of traffic attributes includes a particular network slice;
selecting, by the device, one or more network components, out of a plurality of network components of the wireless network, that handle traffic that meets the particular set of traffic attributes, wherein selecting the one or more network components includes selecting one or more network components associated with the particular network slice;
configuring, by the device, the selected one or more network components associated with the particular network slice to intercept target traffic, associated with the UE, that meets the particular set of traffic attributes; and
receiving, by the device and from the one or more network components, the intercepted target traffic associated with the UE, wherein the intercepted target traffic has been intercepted by the one or more network components based on the particular set of traffic attributes, the intercepted target traffic being a subset of traffic associated with the UE.

### Claim 7 (depends on 6)

The method of claim 6,
wherein identifying the one or more traffic attributes further includes identifying whether the particular set of keywords are associated with control plane traffic or with user plane traffic, and
wherein selecting the one or more network components includes:
selecting a first network component that handles control plane traffic when the particular set of keywords are associated with control plane traffic, and
selecting a second network component that handles user plane traffic when the particular set of keywords are associated with user plane traffic.

### Claim 8 (depends on 7)

The method of claim 7, wherein identifying the particular network component includes identifying a Session Management Function (“SMF”) of the wireless network when the particular set of keywords are associated with control plane traffic.

### Claim 9 (depends on 6)

The method of claim 6,
wherein identifying the one or more traffic attributes further includes identifying that the particular set of keywords are associated with a particular Uniform Resource Identifier (“URI”) or Internet Protocol (“IP”) address, and
wherein configuring the one or more network components includes configuring the one or more network components to intercept traffic associated with the particular URI or IP address.

### Claim 10 (depends on 6)

The method of claim 6, wherein the traffic associated with the UE includes a set of traffic associated with a particular application,
wherein the target traffic includes traffic associated with the particular application, and wherein the target traffic is less than all of the traffic included in the set of traffic associated with the particular application.

### Claim 11

A non-transitory computer-readable medium, storing a plurality of processor-executable instructions, which, when executed by one or more processors, causes the one or more processors to:
maintain correlation information indicating respective correlations between a plurality of keywords and a plurality of traffic attributes;
receive, from one or more requesting devices, a request to intercept target traffic, sent via a wireless network, associated with a particular user equipment (“UE”), the request including a particular set of keywords;
identify, based on the correlation information, a particular set of traffic attributes, of the plurality of traffic attributes, that are correlated to the particular set of keywords included in the request, wherein the particular set of traffic attributes includes a particular network slice;
select one or more network components, out of plurality of network components of the wireless network, that handle traffic that meets the particular set of traffic attributes, wherein selecting the one or more network components includes selecting one or more network components associated with the particular network slice;
configure the selected one or more network components associated with the particular network slice to intercept target traffic, associated with the UE, that meets the particular set of traffic attributes; and
receive, from the one or more network components, the intercepted target traffic associated with the UE, wherein the intercepted target traffic has been intercepted by the one or more network components based on the particular set of traffic attributes, the intercepted target traffic being a subset of traffic associated with the UE.

### Claim 12 (depends on 11)

The non-transitory computer-readable medium of claim 11,
wherein the processor-executable instructions, to identify the one or more traffic attributes, further include processor-executable instructions to identify whether the particular set of keywords are associated with control plane traffic or with user plane traffic, and
wherein the processor-executable instructions, to select the one or more network components, further include processor-executable instructions to:
select a first network component that handles control plane traffic when the particular set of keywords are associated with control plane traffic, and
select a second network component that handles user plane traffic when the particular set of keywords are associated with user plane traffic.

### Claim 13 (depends on 12)

The non-transitory computer-readable medium of claim 12, wherein identifying the particular network component includes identifying a Session Management Function (“SMF”) of the wireless network when the particular set of keywords are associated with control plane traffic.

### Claim 14 (depends on 11)

The non-transitory computer-readable medium of claim 11,
wherein the processor-executable instructions, to identify the one or more traffic attributes, further include processor-executable instructions to identify that the particular set of keywords are associated with a particular Identifier (“URI”) or Internet Protocol (“IP”) address, and
wherein the processor-executable instructions, to configure the one or more network components, further include processor-executable instructions to configure the one or more network components to intercept traffic associated with the particular URI or IP address.

### Claim 15 (depends on 11)

The non-transitory computer-readable medium of claim 11, wherein the correlation information indicates a correlation between one or more keywords of the particular set of keywords and a network slice identifier associated with the particular network slice.

### Claim 16 (depends on 12)

The non-transitory computer-readable medium of claim 12, wherein identifying the particular network component includes identifying a User Plane Function (“UPF”) of the wireless network when the particular set of keywords are associated with user plane traffic.

### Claim 17 (depends on 1)

The device of claim 1, wherein the correlation information indicates a correlation between one or more keywords of the particular set of keywords and a network slice identifier associated with the particular network slice.

### Claim 18 (depends on 2)

The device of claim 2, wherein identifying the particular network component includes identifying a User Plane Function (“UPF”) of the wireless network when the particular set of keywords are associated with user plane traffic.

### Claim 19 (depends on 6)

The method of claim 6, wherein the correlation information indicates a correlation between one or more keywords of the particular set of keywords and a network slice identifier associated with the particular network slice.