CN1691601A - A system and method realizing legal snooping - Google Patents

Abstract

The invention discloses a system for realizing legal interception. The system includes: legal enforcement monitoring equipment LEMF, a plurality of interception gateways and interception control network elements ICEs, and each interception gateway is connected with LEMF and ICEs, wherein, LEMF is from the plurality of Select the monitoring gateway that works normally among the monitoring gateways to send a monitoring management message containing the monitored user ID. After receiving the message, ICEs will monitor the object according to the monitored user ID and report the communication network events of the monitored object through the monitoring gateway. to LEMF, and report the communication content of the monitored object to LEMF through the monitoring gateway. At the same time, the invention also discloses a method for realizing legal interception. The invention introduces the concept of multi-ADMF distribution control, improves the reliability and performance of the legal interception network, and simultaneously increases the flexibility of the legal interception network networking.

Description

A system and method for realizing lawful interception

technical field

The invention relates to the monitoring technology in the mobile communication system, in particular to a system and method for realizing legal monitoring.

Background technique

The monitoring function is a function that most national security departments in the world require communication operators to provide. It mainly monitors voice communication of certain specific users when national security or laws are involved. In Universal Mobile Telecommunications System (UMTS), such as Wideband Code Division Multiple Access (WCDMA), Code Division Multiple Access (CDMA), and Next Generation Network (NGN), core network equipment needs to provide the function of lawful interception.

As shown in FIG. 1 , the prior art network structure for implementing lawful interception in the UMTS system includes: Law Enforcement Monitoring Unit (LEMF), Interception Gateway and Interception Control Elements (ICEs). Wherein, the listening gateway includes an administrative function (ADMF), a second forwarding function entity (DF2) and a third forwarding function entity (DF3). The interface between the operator's core network equipment and the monitoring gateway is the X interface, and the interface between the operator's monitoring gateway and the LEMF is the HI interface. The protocol mainly defines the HI interface initially, but the X interface is implemented independently by the operator. In detail, ADMF and ICEs are connected through X11, ADMF and DF2 are connected through X12, ADMF and DF3 are connected through X13, DF2 and ICEs are connected through X2, and DF3 and ICEs are connected through X3 is connected. The LEMF is connected to the ADMF through the HI1 interface, the HI2 interface and the HI3 interface respectively. Logically, the HI1 interface, HI2 interface, and HI3 interface are independent. HI1 (switching interface port 1) is responsible for transmitting interception management information between LEMF and network operators, such as activating and deactivating a listening object, etc.; HI2 (switching interface port 2) will communicate events that occur in the monitored object in the network , such as attachment, PDP context activation and other information reported to the LEMF. HI3 (handover interface port 3) reports the communication content of the monitored object to the LEMF.

Based on the network structure shown in Figure 1, the process of implementing monitoring in the prior art is as follows:

LEMF sends the monitoring management message containing the monitoring object identifier to ADMF through the HI1 interface. Here, the monitoring objects include IMSI and MSISDN, etc.; after receiving the monitoring management message, ADMF forwards it to ICEs through the X2 interface; ICEs receives the message Finally, monitor the user according to the monitoring object identification, and report the network events of the monitored object to DF2 through the X2 interface, and DF2 then report to each LEMF through the HI2 interface; and ICEs will communicate the content of the monitored object through the X3 interface Report to DF3, and DF3 then reports the communication content of the intercepted object to each LEMF.

It can be seen from the above process that the interception gateway is responsible for converting the HI interface into the WeiX interface. Through the interception gateway, the operator's network and the interception center network can shield each other's network details. For LEMF, it only needs to interact with the monitoring gateway, and does not need to care about the communication network structure of the operator. For ICE, the monitoring gateway can also function to shield LEMFs, making multiple LEMFs monitored transparent to the operator's communication network.

The existing interception network is centralized controlled by one ADMF, and one ADMF performs legal interception management. All LEMFs activate and deactivate the interception target through the same ADMF, and the interception network structure is simple. However, reliability does have serious problems. For example, when LEMF fails, the entire monitoring network will be paralyzed. Moreover, if the number of LEMF and standby monitoring objects increases, ADMF will also become a performance bottleneck of the network.

Contents of the invention

In view of this, the object of the present invention is to provide a system for realizing lawful interception, so as to improve the reliability of network operation.

Another object of the present invention is to provide a method for realizing lawful interception, which can improve the reliability of network operation.

In order to achieve the above-mentioned first purpose, the present invention provides a system for realizing lawful interception, the system includes:

Law enforcement monitoring equipment LEMF, a plurality of monitoring gateways and monitoring control network elements ICEs, each monitoring gateway is connected to LEMF and ICEs, wherein,

LEMF selects a monitoring gateway that works normally from the plurality of monitoring gateways to send a monitoring management message containing the monitored user ID. Report to the LEMF through the monitoring gateway, and report the communication content of the monitored object to the LEMF through the monitoring gateway.

The plurality of listening gateways includes:

More than one ADMF for receiving the monitoring management message issued by LEMF;

At least one second forwarding function entity DF2 for forwarding communication network events, at least one third forwarding function entity DF3 for forwarding communication content, wherein each ADMF corresponds to one or more DF2 and DF3.

In order to achieve the above-mentioned second purpose, the present invention provides a method for realizing lawful interception, the method comprising:

A. LEMF selects a working monitoring gateway from a plurality of monitoring gateways as the current monitoring gateway;

B. Send a monitoring management message containing the monitored user ID to ICEs through the current monitoring gateway;

After receiving the message, C. ICEs monitors the monitored object according to the monitored user ID, and reports the communication network event and communication content of the monitored object to LEMF through the monitoring gateway.

To set the priority of multiple monitoring gateways, step A includes:

A1. LEMF judges whether the listening gateway with the highest priority is working normally. If yes, take the listening gateway as the current listening gateway and execute step B. Otherwise, select the listening gateway with the next priority as the listening gateway with the highest priority and return to step A1.

The plurality of listening gateways includes:

More than one ADMF, at least one second forwarding function entity DF2, at least one third forwarding function entity DF3, wherein each ADMF corresponds to one or more DF2 and DF3,

The monitoring management message containing the monitored user ID described in step B is sent by the ADMF to the ICEs;

The communication network event of the monitored object described in step C is reported by DF2 to LEMF;

The communication content described in step C is reported to LEMF through DF3.

Whether the monitoring gateway works normally is determined through handshake communication.

The present invention introduces a plurality of monitoring gateways in the monitoring network, and each monitoring gateway includes an ADMF, at least one DF2 and at least one DF3 device. In specific applications, different network configurations can be flexibly made according to different national conditions. For example, different authorities use a set of independent ADMF and DF equipment within the scope of national laws to prevent mutual interference. LEMF utilizes the monitoring gateways that are working normally to forward monitoring management messages. When a monitoring gateway fails, it can use other monitoring gateways to implement legal monitoring, thereby improving network reliability. Moreover, the present invention can apply multiple DF2 and DF3 devices to forward communication network events and communication content of monitored objects, thereby improving network performance and increasing network capacity.

Description of drawings

FIG. 1 is a schematic diagram of a network structure of lawful interception in the prior art;

Fig. 2 is the schematic diagram of the network structure that the present invention realizes lawful interception;

Fig. 3 is a schematic flow chart for realizing the method of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings.

The invention introduces a plurality of ADMFs into the lawful interception network for distributed control.

Referring to Fig. 2, the network structure of lawful interception of the present invention includes: LEMF, a plurality of interception gateways and ICEs. Among them, a plurality of listening gateways include: more than one ADMF, at least one DF2, and at least one DF3, and each listening gateway includes one ADMF, one or more DF2, and DF3, and the relationship between each ADMF and DF equipment can be Binding, or cross-connection with DF devices in other monitoring gateways, the specific situation can be determined according to different networking requirements.

Based on the above-mentioned network structure of the present invention and referring to shown in Figure 3, the method for the present invention to realize lawful interception is as follows:

Step 300: Set the monitoring gateway priority.

Step 301: LEMF judges whether the monitoring gateway with the highest priority is working normally, and if so, takes the monitoring gateway as the current monitoring gateway, and executes step 302, otherwise, LEMF selects the monitoring gateway at the next level as the monitoring gateway with the highest priority, and returns Step 301. Here, whether the monitoring gateway works normally can be determined through handshake communication.

Step 302: LEMF sends a monitoring management message containing the monitored object identifier, DF2 and DF3 addresses to the ADMF in the current monitoring gateway through the HI1 interface. After receiving the monitoring management message, the ADMF forwards it to ICEs through the X2 interface. Here, since each monitoring gateway includes an ADMF, and one or more DF2 and DF3, when ADMF sends a monitoring management message to activate the target to be monitored, it must carry the addresses of DF2 and DF3.

Step 303: After receiving the message, ICEs records which ADMF the monitored object comes from, and monitors the monitored user according to the monitored user ID, and then passes the network event of the monitored object through X2 according to the DF2 and DF3 addresses. The interface is reported to DF2 in the monitoring gateway, and the DF2 reports it to each LEMF through the HI2 interface; and, ICEs report the communication content of the monitored object to DF3 in the monitoring gateway through the X3 interface, and the DF3 will be The communication content of the listening object is reported to each LEMF.

Therefore, when the LEMF needs to monitor, the monitoring operation can be sent to any ADMF of a normal monitoring gateway for processing. Moreover, when the ADMF in a monitoring gateway fails, the LEMF can switch the monitoring task to another monitoring gateway that operates well to continue monitoring. In addition, multiple DF devices are introduced into the network to expand the performance of the monitoring network and improve the networking flexibility of the network. Since each ADMF is independent, if multiple ADMFs activate the same listening object, ICEs must be reported separately.

In a word, the above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (6)

1. A system for realizing legal interception, characterized in that the system comprises: Law enforcement monitoring equipment LEMF, a plurality of monitoring gateways and monitoring control network elements ICEs, each monitoring gateway is connected to LEMF and ICEs, wherein, LEMF selects a monitoring gateway that works normally from the plurality of monitoring gateways to send a monitoring management message containing the monitored user ID. Report to the LEMF through the monitoring gateway, and report the communication content of the monitored object to the LEMF through the monitoring gateway. 2. The system according to claim 1, wherein the plurality of monitoring gateways include: More than one ADMF for receiving the monitoring management message issued by LEMF; At least one second forwarding function entity DF2 for forwarding communication network events, at least one third forwarding function entity DF3 for forwarding communication content, wherein each ADMF corresponds to one or more DF2 and DF3. 3. A method for implementing legal interception by applying the system according to claim 1, characterized in that the method comprises the following steps: A. LEMF selects a working monitoring gateway from a plurality of monitoring gateways as the current monitoring gateway; B. Send a monitoring management message containing the monitored user ID to ICEs through the current monitoring gateway; After receiving the message, C. ICEs monitors the monitored object according to the monitored user ID, and reports the communication network event and communication content of the monitored object to LEMF through the monitoring gateway. 4. The method according to claim 3, characterized in that, setting the priorities of a plurality of listening gateways, step A includes: A1. LEMF judges whether the listening gateway with the highest priority is working normally. If yes, take the listening gateway as the current listening gateway and execute step B. Otherwise, select the listening gateway with the next priority as the listening gateway with the highest priority and return to step A1. 5. The method according to claim 3, wherein the plurality of listening gateways include: More than one ADMF, at least one second forwarding function entity DF2, at least one third forwarding function entity DF3, wherein each ADMF corresponds to one or more DF2 and DF3, The monitoring management message containing the monitored user ID described in step B is sent by the ADMF to the ICEs; The communication network event of the monitored object described in step C is reported by DF2 to LEMF; The communication content described in step C is reported to LEMF through DF3. 6. The method according to claim 4, characterized in that whether the monitoring gateway works normally is determined through handshake communication.