GB2587801A

GB2587801A - Methods and systems for determining the parties to a mobile telephone call with a subscriber

Info

Publication number: GB2587801A
Application number: GB1913869.2A
Authority: GB
Inventors: John Meacham Matthew
Original assignee: BAE Systems PLC
Current assignee: BAE Systems PLC
Priority date: 2019-09-26
Filing date: 2019-09-26
Publication date: 2021-04-14
Also published as: GB201913869D0

Abstract

A method for determining the parties to a mobile telephone call with a subscriber. The subscriber is in communication with a visited mobile telecoms network, but is associated with a home mobile telecoms network other than the visited mobile telecoms network, and the visited mobile telecoms network establishes one or more connections between the subscriber and the home mobile telecoms network to enable the home mobile telecoms network to provide communication services to the subscriber. Connection identifier information for connections to home mobile telecoms networks established by the visited mobile telecoms network is determined, and a session map comprising the determined connection identifier information and corresponding subscriber identifier information for the subscribers for the connections is generated. Identifier information for connections to home mobile telecoms networks from communications data sent over the connections is determined, and the parties to a mobile telephone call are determined using the generated session map by determining an association between subscriber identifier information and connection identifier information for connections established for the subscriber.

Description

Methods and systems for determining the parties to a mobile telephone call with a subscriber

Field of the Invention

The present invention concerns methods and systems for determining the parties to a mobile telephone call with a subscriber. More particularly, but not exclusively, the invention concerns determining the parties to mobile telephone calls with inbound roamers on visited networks, where a connection to the inbound roamers home network is provided over LTE (4G) using S8HR.

Background of the Invention

Mobile telecoms operators provide network services to subscribers, i.e. users of cellular networks, such as voice, video and message services. A subscriber will have a home network known as their Home Public and Land Mobile Network (HPLMN) which belongs to the mobile telecoms operator with which they have subscribed, and through which they are billed etc. However, when travelling, for example, a subscriber may connect via a network provided by a different mobile telecoms operator. This is known as "roaming", the subscriber is known as an "inbound roamer", and the network of the other mobile telecom operator is known as the Visited Public and Land Mobile Network (VPLMN). The S8 Home Routing (S8HR) service provides a mechanism for providing Voice over IP over LTE (4G) (Voice over LTE VoLTE) from a VPLMN to the HPLMN of an inbound roamer, to enable the HPLMN to provide them with network services.

In many jurisdictions, mobile telecoms operators are required to determine certain data regarding the parties involved in calls that are made over their networks ("Lawful Interception"), to retain such information ("Data Retention"), and to provide it to law enforcement authorities (LEAs) on request. The use of S8HR to -2 -provide services to inbound roamers presents difficulties for VPLMNs, as the services are provided by the inbound roamer's HPMLN, with the VPLMN essentially only providing a tunnel between the inbound roamer and the HPLMN, meaning that the required data is not directly available to the VPLMN.

A variety of solutions to these difficulties have been proposed, in particular by the 3"d Generation Partnership Project (3GPP) standards body in their technical report "Study on providing for Lawful Interception (LI) in the S8 Home Routing (S8HR) architecture for Voice over LIE (VoLTE)" (3GPP TR 33.827 V14.0.0, published 2016-10-03). However, these solutions all require the networks components involved in the establishment of the S8 connections between the HPLMN and VPLMN (e.g. network switches and the like) provide an interface via which the required data can be obtained.

It would be desirable to be able to obtain the required data without requiring specially adapted network components. Alternatively and/or additionally, the present invention seeks to provide improved methods and systems for determining the target of communications with a subscriber.

Summary of the Invention

In accordance with a first aspect of the invention there is provided a method for determining the parties to a mobile telephone call with a subscriber, wherein the subscriber is in communication with a visited mobile telecoms network, wherein the subscriber is associated with a home mobile telecoms network other than the visited mobile telecoms network, and wherein the visited mobile telecoms network establishes one or more connections between the subscriber and the home mobile telecoms network to enable the home mobile telecoms network to provide communication services to the subscriber, the method comprising the steps of: determining connection identifier information for connections to home mobile telecoms networks established by the visited mobile telecoms network; -3 -generating a session map comprising the determined connection identifier information and corresponding subscriber identifier information for the subscribers for the connections; determining identifier information for connections to home mobile telecoms networks from communications data sent over the connections; and determining the parties to a mobile telephone call using the generated session map by determining an association between subscriber identifier information and connection identifier information for connections established for the subscriber.

By generating a session map for subscribers that are using the visited mobile telecoms network to connect with their home mobile telecoms network, i.e. inbound roamers, a map of connections established for inbound roamers can be generated. The communications data sent over the connections can then be used to determine identifier information for the connections, i.e. information that can be used to identify the parties to a call. This can be done by monitoring the network traffic that establishes and maintains the connections, and that is sent over the connections, without any specially adapted network components being required.

Preferably, the one or more connections between the subscribers and their home mobile telecoms networks are established using the 58 connections. In this case, the parties to the mobile telephone can be determined by evaluating the VolP control signalling.

Advantageously, the method further comprises the step of filtering network traffic to select only connection control traffic, and wherein connection identifier information is determined from the filtered network traffic. Where the S8HR protocol is used, GTP bearer traffic can be filtered on specific parameters to select only control plane traffic, such as destination port.

Advantageously, the method further comprises the step of filtering network traffic to select only VolP traffic, and wherein connection identifier information is determined from the filtered network traffic. This can be determined using the QC! of the GTP bearer, where a QCI of 5 indicates IMS services, i.e. VolP services. -4 -

Advantageously, the method further comprises the steps of: identifying VolP traffic associated with a target to be monitored; and identifying media service traffic corresponding to the identified VolP traffic. In this way, only media service traffic that actually relates to a target that an LEA wishes to monitor needs to be captured an analysed, rather than all media service traffic. Advantageously, the media service traffic is stored in a buffer. This allows VolP service traffic and media service traffic to be correlated where SIP links are established out of order, RTP links are established prior to corresponding SIP links, or the like.

Where traffic associated with a target to be monitored is identified, for example where an LEA has provided such target information, preferably the LEA notification and appropriate identifier information is send to the LEA.

The method may further comprise the step of generating a data record comprising the determined identifier information. In this case, the data record may be stored in a database. This can provide required data retention.

In accordance with a second embodiment of the invention there is provided an intercept device comprising: a processor; memory; wherein the intercept device is arranged to communicate with a visited mobile telecoms network to perform any of the methods described above.

In accordance with a third embodiment of the invention there is provided a computer program product arranged, when executed on a computing device, to perform any of the methods described above.

In accordance with a fourth embodiment of the invention there is provided a computer program product arranged, when executed on a computing device, to provide the intercept device described above. -5 -

It will of course be appreciated that features described in relation to one aspect of the present invention may be incorporated into other aspects of the present invention. For example, the method of the invention may incorporate any of the features described with reference to the apparatus of the invention and vice versa.

Description of the Drawings

Embodiments of the present invention will now be described by way of example only with reference to the accompanying schematic drawings of which: Figure 1 is a schematic diagram of a mobile telecoms network system in accordance with an embodiment of the invention; Figure 2 is a flowchart showing the overall operation of the system of Figure 1; Figure 3 is a flowchart showing the operation of the system of Figure 1 when analysing VolP traffic; and Figure 4 is a flowchart showing the operation of the system of Figure 1 when analysing media traffic.

Detailed Description

A mobile telecoms network system for determining network communications data in accordance with an embodiment of the invention is now described, with reference to Figure 1. The system 1 comprises a VPLMN 2, to which an inbound roamer 3 is connected so as to use network services. The VPLMN 2 is in communication with the HPLMN 4 of the inbound roamer 3, allowing the HPLMN 4 to provide the required network services to the inbound roamer 3 using the 58 connection. In the present example, the inbound roamer 3 is communicating with a subscribers, which is connected to the HPLMN 4 of the inbound roamer 3. It will be appreciated that various different types of communication could be established, for -6 -other inbound roamers or indeed for the inbound roamer 3, such as multiple audio telephone call, video telephone calls, Internet data connections and the like.

An intercept device 11 is in communication with the VPLMN 2. The operation of the intercept device 11 is described in detail below, but amongst other things it is able to monitor the 58 connection between the VPLMN 2 and the HPLMN 4, and has access to all GPRS Tunnelling Protocol (GTP) traffic making up those links. The intercept device 11 is in communication with an LEA 12, to which it provides determined network communications data when requested.

The intercept device 11 generates a session map 13, and stores appropriate network communications data in a data retention store 14, both as described below.

To enable this, the intercept device 11 comprises a buffer 11a, and is in communication with a SIP decoder 15 and an RTP decoder 16. It will be appreciated that the SIP decoder 15 and an RTP decoder 16 are well-known standard components used in mobile telecoms networks, though the invention is equally applicable where other, non-standard elements providing the same required functionality are used.

The operation of the mobile telecoms network system 1 is now described with reference to the flowchart of Figure 2. Initially, the LEA 12 sends target information to the intercept device 11, i.e. information about targets that it wants to be monitored. The target information may include IMEls (handset identification numbers), IMSIs (SIM card identification numbers) and/or MSISDNs (telephone numbers in International format), for example.

In order to identify any targets that the LEA 12 wants to be monitored, the intercept device 11 filters GTP traffic over 58 connections between the VPLMN 2 and HPLMN 3 to select only control plane traffic, i.e. traffic relating to the establishment and maintenance of the GTP bearers (communications links) that provide the 58 connections (step 101). (In certain embodiments, the destination port number of the GTP traffic is used for filtering.) From the control plane traffic the session map 13 is generated. The session map 13 includes user equipment (UE) identifiers (i.e. identifiers for the devices connecting to the VPLMN), location information and GTP -7 -bearer attributes (step 102) for the users that have established the S8 connections, as is available from the control plane traffic. The UE identifiers may include IMEls, IMSIs and/or MSISDNs, as well as various other available identifiers. The GTP bearer attributes will include tunnel endpoint IDs (TEIDs), by which the GTP bearers established by the control place traffic can be identified.

As discussed in more detail below, the GTP bearers established by the control plane traffic are then analysed, and the session map is used to identify any targets that the LEA 12 wants to monitor (step 104). Any appropriate target information is then sent to the LEA 12 (step 105). The target information may include parties to a call in which the target participated, and may include the actual audio content of the call. In alternative embodiments, a Call Data Record (CDR) may be generated containing details of the call involving the target, e.g. the start and finish time of the call, identifier information for all parties involved and so on, and stored in the data retention store 14 to satisfy data retention requirements.

The analysis of the GTP bearers established by the control plane traffic (in step 104) is now described in more detail. As mentioned above, control plane traffic is traffic relating to the establishment and maintenance of the GTP bearers. Each GTP bearer will have a TEID by which it is identified, and a corresponding Quality-of-Service Class Identifier (QC!) that identifies the type of traffic it carries. A first type of GTP bearer that is established as part of a roaming telephone call is a GTP IP Multimedia Subsystem (IMS) bearer, which carries Voice-over-IP (VolP) signalling (SIP) services. GTP IMS bearers can be identified as the GTP bearers with (ICI = 5. A second type of GTP bearer that is established as part of a roaming telephone call is a GTP media bearer, which carries media services, i.e. voice and video data. GTP media bearers can be identified as the GTP bearers with QC! = 1 or 2, which correspond to voice and video data respectively. Other types of GTP bearer may be established, but are not relevant for the embodiment presently being described.

The analysis of the GTP IMS bearers is now described with reference to Figure 3. First, the relevant GTP bearers, i.e. those with QC! = 5, are selected (step 201). The -8 -SIP traffic carried by the GTP bearer is extracted (step 202), and sent to the SIP decoder 15 (step 203). The SIP decoder 15 extracts the SIP header information (step 204), which will include MSISDNs, SIP TEL and SIP URI information for the SIP link and the like.

The header information is then checked against the session map (step 205)..

Identifier information from the session map or the SIP headers is then checked against the target information from the LEA 12 (step 206), and where there are any matches, as discussed above appropriate data for the target is sent to the LEA 12 (step 207). This data may include the port and IP for the GTP bearer and SIP session information, for reasons discussed below.

The analysis of the GTP media bearers is now described with reference to Figure 4. Each GTP media bearer will correspond to a GTP IMS bearer, and essentially contains the content of a VolP call set up by the GTP IMS bearer, e.g. the actual audio for a VolP call. GTP media traffic may be temporarily stored in the buffer 11 of the intercept device 11, as this helps prevent the required GTP media traffic not being available where SIP links are established out of order, RTP links are established prior to corresponding SIP links, or the like.

In contrast to the situation for GTP IMS bearers, rather than all GTP bearers with QC! 1 or 2 being selected, only GTP media bearers corresponding to a GTP IMS bearer that matched with a target that the LEA 12 wanted to monitor are analysed (step 301). This is because the media content is only required if the call is to be monitored. The relevant GTP media bearers can be identified, as the session map 13 will contain their TEIDs as obtained from the control plane traffic.

The RTP traffic carried by the GTP bearer is then extracted (step 302), and sent to the RTP decoder 16 (step 303). The RTP decoder 16 extracts the RTP header information (step 304), and sends relevant data from this, along with the RTP payload (e.g. the actual audio of a telephone call), to the LEA 12 (step 305).

As with the GTP IMS bearers, this data may include the port and IP for the GTP bearer and RTP header information. The reason for this is that it allows the LEA 12 to match the SIP control messages with the corresponding RTP Media messages -9 -using the corresponding port and IP information. The reason this may be necessary is that an 58 connection established by the inbound roamer 3 can include several separate calls, for example where a second call is made while a first call is on hold.

While the present invention has been described and illustrated with reference to particular embodiments, it will be appreciated by those of ordinary skill in the art that the invention lends itself to many different variations not specifically illustrated herein. In particular, it will be appreciated that in other embodiments the data collected by the sensor devices could be analysed and acted upon by the data analysis system in various different ways additionally and/or alternatively to those discussed above. It will also be appreciated that in other embodiments, various different configurations of the system of sensor devices and data analysis system could be provided, and still be in accordance with the invention.

Where in the foregoing description, integers or elements are mentioned which have known, obvious or foreseeable equivalents, then such equivalents are herein incorporated as if individually set forth. Reference should be made to the claims for determining the true scope of the present invention, which should be construed so as to encompass any such equivalents. It will also be appreciated by the reader that integers or features of the invention that are described as preferable, advantageous, convenient or the like are optional and do not limit the scope of the independent claims. Moreover, it is to be understood that such optional integers or features, whilst of possible benefit in some embodiments of the invention, may not be desirable, and may therefore be absent, in other embodiments.

Claims

-10 -Claims 1. A method for determining the parties to a mobile telephone call with a subscriber, wherein the subscriber is in communication with a visited mobile telecoms network, wherein the subscriber is associated with a home mobile telecoms network other than the visited mobile telecoms network, and wherein the visited mobile telecoms network establishes one or more connections between the subscriber and the home mobile telecoms network to enable the home mobile telecoms network to provide communication services to the subscriber, the method comprising the steps of: determining connection identifier information for connections to home mobile telecoms networks established by the visited mobile telecoms network; generating a session map comprising the determined connection identifier information and corresponding subscriber identifier information for the subscribers for the connections; determining identifier information for connections to home mobile telecoms networks from communications data sent over the connections; and determining the parties to a mobile telephone call using the generated session map by determining an association between subscriber identifier information and connection identifier information for connections established for the subscriber.
2. A method as claimed in claim 1, wherein the one or more connections between the subscribers and their home mobile telecoms networks are established using 58 connections.
3. A method as claimed in claim 1 or 2, further comprising the step of filtering network traffic to select only connection control traffic, and wherein connection identifier information is determined from the filtered network traffic.
4. A method as claimed in any preceding claim, further comprising the step of filtering network traffic to select only VolP traffic, and wherein connection identifier information is determined from the filtered network traffic.
5. A method as claimed in claim 4, further comprising the steps of: identifying VolP traffic associated with a target to be monitored; and identifying media service traffic corresponding to the identified VolP traffic.
6. A method as claimed in claim 5, further comprising the step of storing media service traffic in a buffer.
7. A method as claimed in any preceding claim, further comprising the step of generating a data record comprising the subscriber identifier information and target identifier information.
8. A method as claimed in claim 7, further comprising the step of storing the data record in a database.
9. An intercept device comprising: a processor; memory; wherein the intercept device is arranged to communicate with a visited mobile telecoms network to perform any of the methods of claims 1 to 8.
10. A computer program product arranged, when executed on a computing device, to perform any of the methods of claims 1 to 8.
11. A computer program product arranged, when executed on a computing device, to provide the intercept device of claim 9.