RU2434343C2 - Lawful access; stored data handover enhanced architecture - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: invention relates to methods in a telecommunication system for providing access to data received in a centralised storage medium (DR-C) from interacting traffic nodes in the system. The centralised storage medium is part of a mediation and delivery function (MDF) which is associated with a law enforcement monitoring facility (LEMF). The method comprises the following steps: identifying in the mediation and delivery function (MDF), a configuration request which comprises filtering criteria specifying the type of data to be accessed; configuring in the mediation and delivery function (MDF), the requested filtering criteria; receiving data (Dl) from the system in the centralised storage medium; establishing that the received data match the filtering criteria; retaining the received data in the centralised storage medium and/or forwarding the data to the monitoring facility.

EFFECT: ensuring stability and reliability of the system.

23 cl, 5 dwg

Description

FIELD OF THE INVENTION

The present invention relates to methods in a telecommunication system designed to provide access to data received in a centralized storage medium from interacting traffic aggregation nodes in the system.

Description of the prior art

Thanks to data storage schemes, law enforcement authorities have the ability to request from electronic service providers to retain specific data for a particular person or people, while data retention schemes provide retention of information exchange data for all users of electronic services. At first glance, data preservation seems to be an attractive strategy choice option: the number of people for whom data will be held and processed for law enforcement is drastically reduced due to this choice opportunity, and therefore the associated costs for this industry will be negligible. In fact, data retention is a very useful tool for law enforcement agencies. Undoubtedly, in those cases in which the suspected person is identified or in which an investigation, for example, by an organized criminal group or a terrorist cell, is being developed, the requirements to preserve information exchange information are a necessary tool for establishing links between the suspected person and his contacts and partners. At the same time, the logical limitations of this approach, as can be easily explained, are that it is not possible to conduct research using data storage as a tool, returning back in time. Saving data is only useful from the moment the suspects were identified; data storage is necessary in many cases to actually identify these suspects. Saving data is not enough for law enforcement agencies to actually be able to investigate and decide on cases of terrorism and crime. To take this into account, a number of states have adopted national measures for the general preservation of data or have planned their adoption. Compared to data storage measures that are targeted at specific users and with respect to certain data, general data storage measures are aimed at requiring that operators (some or all) hold information exchange data for all users so that they can be used for law enforcement purposes when necessary and permitted.

A data collection system is generally disclosed in international patent application WO 00/05852. This international patent application discloses the collection and implementation of software that resides on multiple interconnected platforms in a single centralized storage environment. The increased need for the use of both information exchange information and data in the telecommunication system has increased overhead costs and costs for service providers and similarly for the activities of law enforcement agencies. Tracking can be used to provide information from users. The IMDU mediation listening and delivery module used to store data is prior art and is disclosed in the current legal listening standards (see 3GPP TS 33.108 and 3GPP TS 33.107 - Revision 6). The IMDU contains the LEMF enforcement function. LEMF is associated with three mediation functions, respectively, for ADMF, DF2, DF3, that is, the ADMF administration function and two delivery functions DF2 and DF3. Each of the administration and DF2 delivery functions is connected to the LEMF via standardized HI1 and HI2 transmission interfaces and is associated with a listening access point through the X1 and X2 interfaces. Messages sent from the LEMF to the ADMF via HI1 and from the ADMF to the network via the X1 interface contain distinctive features of the target to be monitored. The DF2 delivery function receives IRI listening information from the network via the X2 interface, and DF2 is used to distribute the IRI to the relevant law enforcement organizations via the HI2 interface. DF3 receives the contents of the exchange of information, that is, speech and data, and is connected to the LEMF via a standardized HI3 interface, and to the access point via the X3 interface. Typically, ADMF, DF2, and DF3 are part of a service provider's domain and are located separately from LEMF.

Many different types of stored information and data may be subject to legal inquiries and may require various legal instruments. For example, some basic information can be made publicly available by the subscriber or can be very intrusive, and detect personal behavior, and be subject to expectations of confidentiality. Such information and subscriber information exchange data is produced and transmitted through the network during the normal operation of the information exchange of telecommunication networks, but access to them from an external government agency is distributed through several different channels, which makes it difficult to search and restore the requested information. Timely production and analysis of subscriber information and information has become invaluable to service providers and government agencies for a variety of needs related to critical infrastructure protection and obtaining judicial evidence for law enforcement. The increasing need for such information and data and their increasing use likewise increase the difficulties and costs associated with service providers and law enforcement. The increasing need and utility of this information and data has increased the costs and costs of services from service providers and law enforcement agencies. At the other extreme, other information is not currently stored by the network of telecom operators, either because it is not significant for the purposes of billing, or because it requires further processing at the offices of the operators. In some other cases, even some of the information that is ordered by government agencies is not available (for example, the relationship based on the subscribers of several distinctive features of the services that the user can use). Examples of stored information and information exchange information in accordance with the prior art are attached at the end of the description part of this application. It should be noted that the attached reference structure is not necessarily limited to these cases, that is, the type of distinctive features provided in this solution depends on the national options and can be expanded by adding new network elements or new distinctive features in existing network elements. The architecture for delivering stored information from a legal enforcement service provider is disclosed in draft standards ETSI (European Telecommunications Standards Institute) DTR / LI-00020 V0.0.4 (2005-06).

The draft standards do not provide a decision on how to collect all the requested information on the network and how to relate it. Even though this is not the main part of this invention, a detailed network structure with a centralized database is proposed in this document as a prerequisite for solving the identified problems.

In the synthesis, the identified deficiencies / problems of current standards are as follows:

1) organizations cannot control the type of information to be stored, that is, all information requested by standards is stored;

2) the current standard only foresees a simple way to provide on-demand stored data for organizations (request and delivery processes), while it can be effective for legitimate listening purposes to deliver stored information as soon as it becomes available.

SUMMARY OF THE INVENTION

The present invention relates to the problem of controlling the type of information to be stored in a centralized storage environment. An additional problem is that standards only foresee an easy way to provide stored data on demand, while they can be effective for legitimate listening purposes, to deliver stored information as soon as it becomes available.

These problems are solved in accordance with the invention by filtering data received in a centralized storage medium that is stored in a storage medium and / or is promoted to a law enforcement organization or similar authority.

Problem solving contains in more detail a method in a telecommunication system designed to provide access to data received in a centralized storage medium from interacting traffic aggregation nodes in the system. A centralized storage environment is part of the mediation and delivery function that is associated with the law enforcement organization. The method comprises the following steps.

- The configuration request, preferably received from the enforcement tool managed by the enforcement organization, is identified in the mediation and delivery functions. The request contains filtering criteria that determine the type of data to be further processed.

- The requested filtering criteria are configured in the mediation and delivery functions.

- Data that meets the requested filtering criteria is received from the system in a centralized storage environment.

- Received data is held in a centralized storage environment and / or redirected to a law enforcement organization.

Thus, the aim of the invention is to identify data that must be accessed for legal listening purposes. This and other goals are achieved using methods, devices, systems and industrial products.

An advantage associated with the invention is that the improved system architecture and transmission interfaces for the data retention functionality result in an added evaluation that allows you to manage the storage of any information on the network through an LI organization configuration.

Another advantage associated with the invention is that the combination of data retention architecture and legal listening results in the following.

1. The DR architecture can also be used for legitimate listening purposes, similar to automatically notifying the recipient associated with information as soon as it is stored for data retention purposes.

2. Similar interfaces, providing interfacing with the public land mobile network, can be used for both DR and LI.

Additional advantages associated with the invention are that collaborative data retention / legal listening solutions reduce opex costs and increase overall efficiency, while a flexible architecture can be used to fulfill any data retention requirements regarding stored subscriber information and information exchange and their support for organizations (not only request methods, but also delivery) upon receipt (without notice), and, in addition, similar interfaces that provide interfacing with organizations, can be used for data retention and legal listening.

Brief Description of the Drawings

FIG. 1 discloses data collection from a public land mobile network to a centralized storage device and a block diagram illustrating a network-based solution used to process data in accordance with the invention.

FIG. 2 discloses a signaling sequence diagram in accordance with the invention for filtering data to be further processed.

FIG. 3 discloses a signaling sequence diagram in accordance with the invention for subscribing to said data.

FIG. 4 shows a flowchart illustrating some of the main steps of the invention.

FIG. 5 discloses a block diagram illustrating a system in accordance with the invention.

Detailed Description of Embodiments

FIG. 1 discloses a public land mobile network (PLMN). In this example, PLMN contains TSP telecommunication providers, such as MSP: mobile service provider, ISP: Internet service provider, MMC: multimedia messaging center, USP: user and service profile database, HSS: home subscriber server, HLR: register home location, IMS: multimedia IP system, SGSN: GPRS service support node, ITO: IT operator database, MSC: mobile switching center, SCP: service control node, SDP: service data node. All of the above nodes are known and defined in various telecommunication standards. Telecommunication service providers TSPs in the course of their business operations usually acquire and store diverse information and subscriber information associated with their service providers. This information and data may be associated with service accounts, payments, access, assigned identifiers and use. The method of collecting and storing this information and data is determined by a combination of business practices, legal protection in case of disputes of subscribers, technical capabilities or requirements of the system and national and local legislation or regulation. Examples of information and information exchange information in accordance with the prior art that can be sent from a system to a data retention cluster are attached at the end of the description of this patent application. The MDF mediation and delivery function is associated with the PLMN network and the LEMF Enforcement Tracking Tool. According to the invention, the MDF contains a DR-C data holding cluster, which in this example contains three databases DB1, DB2 and DB3. The database cluster is illustrated under the assumption that it is as general as possible. When considering a large amount of data, it is most likely that the DR data hold implementation will anticipate a possible distributed database architecture with some kind of distribution (for example, DB1 during the most recent retention year, DB2 during earlier years, or DB1 for voice calls, DB2 for other data, etc.). DR-C provides registry functions to collect all possible data available in the PLMN for the cluster, when permitted by the telecommunications service. For example, DR-C will collect the MSISDN, IMSI, and IMEI provided by the MSC, and will register them as a reference to the same subject. Of course, updating the cluster depends on the policy governing notifications with the user, the communication session, or operator data, on network elements to the DB cluster (for example, notification can only be performed when the service is first accessed). The movement of data from the PLMN to the data retention cluster is schematically shown with shaded arrows in FIG. 1. Moving data is a prerequisite for this invention.

The LEMF Enforcement Tracking Tool is managed by a law enforcement organization. The general function of LEMF is briefly explained in the description of the technical field. For the purposes of this invention, a new ManF management function and a new acquisition function of legitimate LiAF listening are introduced in LEMF. The new configuration function ConF is introduced in the function of mediation and delivery of MDF. ConF is linked to DR-C in MDF and to ManF in LEMF. New NotF notification feature introduced in MDF. NotF is associated with DR-C in MDF and with LiAF in LEMF. A new HI transfer interface is located between the LEMF and the MDF. The purpose of the above-mentioned new objects will be further explained in the embodiments.

Now will be explained the first embodiment of the invention. In this embodiment, the filtering criteria are determined by the LEMF enforcement tool and sent to the MDF. In general, the criteria are the result of a search warrant or other authorization from the government or other authorized agency. In this example, criteria are sent from the LEMF, but can also be communicated by an intermediary, such as a human operator, who receives a command from an authorized source and then enters the criteria into the MDF. Filtering criteria determine which data to store and configure in a data retention cluster, for example, in the following form:

- type of information: for example, related to the network operator, related to the subscriber, related to the type of information exchange.

- Distinctive feature of the subscriber: for example, the list or ranges of addresses IMEI, IMSI, MSISDN, NAI, IP-addresses.

- A temporary window for collecting information.

- Duration of storage.

- Geographical location.

- Type of service: speech, video, interactive correspondence, connection of peer nodes.

- Any other filtering criteria.

FIG. 2 discloses a method in accordance with a first embodiment of the invention. The various objects LEMF, ManF, MDF, ConF, DR-C, DB1 and MSC in FIG. 2 correspond to objects that have already been shown in FIG. 1. The method according to the invention comprises the following steps.

- The data retention hold configuration request is sent 1A from the ManF management function in the LEMF enforcement tool to the ConF configuration function in the mediation and delivery function MDF. The configuration request in this example contains a retention request indicating that data that meets the configured filtering criteria should be stored in a centralized storage environment. A retention request may be presented in filter criteria, for example, "storage duration> 0". The query in this example contains the following filtering criteria.

- Type of information: related to the network operator AND related to the subscriber, And related to the type of information exchange. With an example of data records on CDR calls from MSC, the type of information exchange can be a voice signal, SMS

or data. So, if filtering criteria are designated as a voice signal, only CDRs related to the voice signal should be available.

- Distinctive feature of the subscriber: any IMEI, any IMSI, any MSISDN, any NAI, certain ranges of IP addresses. With this example, the MSC reports any one of the MSIDN, IMSI, or IMEI, so that any of the sub-entities is retained. In the case of nodes reporting an IP address, only the CDR corresponding to the IP addresses within this range should be available.

- A temporary window for collecting information: from 00:00 h 2005-12-01 to 00:00 h 2006-12-31, and this means that it should be available only from 00:00 h 2005-12-01 to 00:00 h 2006-12-31 CDR or any other information found within such a time period.

- Duration of storage: 3 years, and this means that after 3 years, the information must be deleted.

- Geographical locations: specified subordinate areas. Consider, for example, an MSC serving two states (states), where an organization can only be authorized in one state (state), so that information should be available only if the MSC records that the call was made by a cell within that state (state) .

- Type of service: any.

This is an example of a filter from one organization. The system will have access to certain data if they are requested by at least one organization (that is, if they are consistent with the criteria of at least one organization).

- A configuration request for storing data retention, including the accepted filtering criteria, which advance 1B from the configuration function ConF to the storage device 2 in the function of mediation and delivery of MDF, for example in DB1. A storage device may also be a memory space in a processor unit in an MDF.

- Call-related billing data is sent 3 from the mobile switching center MSC to the MDF.

- Received billing data is checked against stored filtering criteria received from the LEMF enforcement tool. In this example, the billing data meets all the criteria in the filtering criteria.

- The data retention hold configuration request stored in the MDF is checked. An indication that data satisfying the configured filtering criteria must be stored in a centralized storage environment is marked in the MDF, and the received billing data is stored / held 4 in the database DB1. Once the received information that matches the configured filtering criteria is held, the organization that sent the filtering criteria can at any time order data collection through the notification function and through the acquisition of legitimate listening function. The purchase order is sent to the MDF through the management function and configuration function. In an alternative embodiment, different organizations may send different filtering criteria to the MDF. Data that meets the stored criterion will then be sent at the request of the organization that identified this criterion.

FIG. 3 discloses a method in accordance with a second embodiment of the invention. In this embodiment, the filtering criteria sent from the LEMF enforcement tool determines what information the system wants to subscribe to from the system, and possibly also hold. The various objects LEMF, ManF, LiAF, MDF, NotF, ConF, DR-C, DB1 and MSC in FIG. 3 correspond to objects that have already been disclosed in FIG. 1. The method in accordance with the invention comprises the following steps.

- The data retention retention configuration request is sent 11A from the ManF management function in the LEMF enforcement tool (managed by the organization) to the ConF configuration function in the mediation and MDF delivery function. The configuration request in this example contains the same filtering criteria as in the first embodiment. The request also contains a requirement, a so-called subscriber request, to subscribe to data that meets these criteria.

- The configuration request to save data hold was redirected 11B from the configuration function ConF in the cluster hold data DR-C.

- The accepted filtering criteria are stored 12 in the mediation and delivery functions of the MDF, for example in DB1.

- The data of the MMS multimedia messaging service in this example is sent 13 from the mobile switching center MSC to the DR-C.

- Received MMS data is checked in the MDF against stored filtering criteria received from the LEMF enforcement tool.

- The data meets the filtering criteria.

- The data retention hold configuration request stored in the MDF is checked. An indication that data meeting the configured filtering criteria must be signed by LEMF is detected in the MDF, and the received MMS data is redirected 15 to LEMF without saving through the NotF notification function and through the LiAf legal acquisition function.

Request 11A, sent by the organization from the ManF administration function in LEMF to the ConF configuration function, may also contain a desire to hold data. In this case, data that meets the stored criteria will not only be redirected, but also stored in the database in the DR-C cluster. If the organization requested “notification only” through the so-called notification request in 11A, then only an indication is declared for the LEMF, except for a notification that includes information related to the addressee, that is, data matching the filter is advanced. For example, it is also possible to give access to the specified data in the system to users with certain rights (or with roles associated with various authorizing functions). Users with these rights (or with a role that allows these functions) must set the filtering criteria used to retain information. Other users must order a request for information. The first may be, for example, the Minister of Justice (since the filtering criteria for the information held is dependent on federal law). The second can be used when accessing the system by a specific client in law enforcement organizations. This authorization check can be performed as a mediation and delivery function after receiving a configuration request or purchase order.

FIG. 4 discloses a flowchart illustrating some important steps. The process flow chart should be read in conjunction with the previously shown drawings. The process flow diagram contains the following steps.

- The data retention retention configuration request is sent from the ManF management function to the MDF mediation and delivery function. Block 101 discloses this step in FIG. four.

- Accepted filtering criteria are stored in the mediation and delivery functions of MDF. Block 102 discloses this step in FIG. four.

- Data is sent from the MSC Mobile Switching Center to the DR-C data holding cluster. Block 103 discloses this step in FIG. four.

- Data is checked against stored filtering criteria received from the LEMF enforcement tool. The data meets the filtering criteria, and the received data is manipulated in accordance with the configuration request. Block 104 discloses this step in FIG. four.

A system that can be used to put the invention into practice is shown schematically in FIG. 5. The set of flowcharts corresponds to the set of flowcharts disclosed in FIG. 1. The PROC processor, in the mediation and delivery function of the MDF, manipulates data management from the public land mobile network PLMN and configuration request information received from the LEMF. The processor manipulates the storage of received data from PLMN in a centralized storage environment DB1 - DB3, as well as the storage of accepted filtering criteria and potentially additional requests from LEMF. The storage device may be, for example, a memory space in a processor. The processor also controls the comparison of filtering criteria and PLMN data. The MDF is associated with a PLMN network and at least one LEMF enforcement tool. The ManF requesting function in the LEMF enforcement tool is connected to the ConF receiving function in the MDF mediation and delivery function, and this pair of functions is used for the request processes. The NotF response function in the mediation and delivery functions is connected to the LiAF acquisition function in the enforcement tool, and this pair of functions is used for delivery processes. The HI transmission interface is located between the requesting function and the receiving function and between the response function and the acquisition function. The listed objects are shown in the drawing as separate elements. However, in actual implementations of the invention, they may be inseparable components of other electronic devices, such as a digital computer. Thus, the steps described above can be implemented in software that can be embodied in an industrial product including a program storage medium. The program storage medium includes a data signal embodied on one or more carrier waves, computer disks (magnetic or optical (e.g., CD or DVD, or both), non-volatile memory, magnetic tape, system memory, and a computer hard drive.

The invention is not limited to the embodiments described above and shown in the drawings, but may vary within the scope of the appended claims. The systems and methods of the present invention can be implemented on any of the 3rd Generation Partnership Projects (3GPP), the European Telecommunications Standards Institute (ETSI), the US National Institute for Standardization (ANSI) or other standard telecommunications network architecture consistent with the law on Telecommunications Assistance to Law Enforcement Agencies (CALEA), which is a United States law requiring telephone network architectures to be designed to provide s possibility of authorized electronic eavesdropping.

Of course, the invention is not limited to the embodiments described above and shown in the drawings, but may vary within the scope of the appended claims.

Examples of stored data elements that can be sent from nodes in the system to a centralized data retention cluster.

Association Stored Data Item Description Network Element / DB records
supplier provider name DB DR configuration data supplier address DB DR configuration data identifier
network provider DB DR configuration data regulatory identifier
supplier DB DR configuration data other vendor identifiers DB DR configuration data law enforcement identifier
supplier DB DR configuration data vendor contact name DB DR configuration data supplier contact address DB DR configuration data

subscriber records subscriber name IT operator DB subscriber status active, former, indefinite, roaming, pre-paid, temporary IT operator DB subscriber account creation timestamp IT operator DB subscriber account support event IT operator DB subscriber account support event timestamp IT operator DB subscriber account support event description IT operator DB subscriber address IT operator DB contact name IT operator DB contact address of subscriber IT operator DB Subscriber Account ID IT operator DB subscriber's date of birth IT operator DB type of distinguishing features of the subscriber e.g. social security number, rights IT operator DB Caller ID IT operator DB subscriber payment account type e.g. credit card, bank IT operator DB subscriber payment institution identifier IT operator DB name of subscriber payment institution IT operator DB subscriber payment institution address IT operator DB Caller ID IT operator DB subscriber payment account name IT operator DB subscriber payment account address IT operator DB subscriber billing deadline IT operator DB other caller id IT operator DB subscriber intermediary name where there is an intermediary IT operator DB subscriber intermediary address IT operator DB subscriber intermediary account identifier for the subscriber IT operator DB name of the subscriber's billed party IT operator DB subscriber billing address IT operator DB Subscriber billing identifier IT operator DB subscriber’s previous invoice address IT operator DB subscriber location address IT operator DB subscriber temporary access location telephone box, hot spot, flight identifier IT operator DB subscriber temporary access timestamp IT operator DB Subscriber Object Identifier (OID) when the subscriber is an object IT operator DB additional subscriber identifiers for example, the number of seats allocated in an airplane or train IT operator DB

records of identifiers of communication sessions in the network telephone number
E.164 network communications includes data of telephone number, fax, dialing, ENUM ISP NAS, Fixed Network, Messaging Servers Location Routing Network Number (LRN) CS, GPRS Nodes mobile subscriber's ISDN network (MSISDN) GPRS, CS nodes, messaging servers network international mobile subscriber identifier (IMSI) GPRS, CS nodes, messaging servers City Park Member Network Identifier (UFMI) Internet protocol address Internet network domain name fully qualified domain name network identifier (FQDN) ENUM network universal resource identifier (URI) Network File Transfer Protocol (FTP) identifier Session Initiation Network Protocol (SIP) identifier H.323 network identifier Secure Hypertext Transfer Protocol Identifier (HTTPS) password to access a network session

service equipment records supplier and model of service equipment DCR physical serial number of service equipment DCR International Mobile Equipment Identity (IMEI) of service equipment DCR, EIR Electronic product number or serial number (EPN, ESN) of service equipment Mobile Equipment Identifier (MEID) of service equipment 56-bit Mobile Equipment Identifier used for new terminals as an alternative to 32-bit ESN pseudo-ESN (pESN) service equipment pseudo-ESN 0x80 as its 'Manufacturer Code', followed by 24 least significant SHA-1 hash bits of 56 MEID bits, is used when MEID is not implemented in the system Mobile Equipment Identification Number (MIN) of service equipment network transmission medium access control (MAC) identifier of service equipment ISP NAS digital certificate of service equipment

connection records Location Routing Number (LRN) Number Mobility Switching Node (e. SCP) jurisdiction information parameter (JIP) Number Mobility Switching Node (e. SCP) mobile subscriber number (MDN) Number Mobility Switching Node (e. SCP) Dialed SOA E.164 (DN) Number Mobility Switching Node (e. SCP) received SOA subscriber connection request timestamp Number Mobility Switching Node (e. SCP) SOA subscriber connection request transmitted to the timestamp of the national system with mobility databases Number Mobility Switching Node (e. SCP)

detailed phone usage records telephone identifier CDR phone Bgw Phone CDR Account ID Bgw source (switch, subscriber database, archive) CDR phone Bgw display IMSI / MSISDN / IMEI CDR phone Bgw CDR Record Mobile Stored Phone
or dynamically recorded
registration Bgw beginning of temporary
CDR call marks
phone Bgw Phone CDR Call Timestamp End Bgw duration
call CDR phone Bgw type of call CDR phone (incoming, outgoing, conference, relay, unidirectional) Bgw physical / networked / networked
subscriber line number
(CLI) called telephone CDR number Bgw type of CLI called
telephone CDR numbers (physical, represented, assigned by the network) Bgw dial id
My Phone Call Number (DNI) Bgw international mobile subscriber identifier (IMSI) of the called CDR phone number Bgw international mobile station equipment identification number (IMEI) of the called CDR number
phone Bgw City Park Member Identifier (UFMI) of the called CDR phone number Bgw conferencing / exchange / reject number of called CDR phone number Bgw telephone CDR end-user device identification numbers Bgw IMEI type (physical, represented, assigned by the network) of the telephone CDR Bgw location data at the beginning and / or end of a call (latitude / longitude or others) of the phone’s CDR Bgw geographic location of the end-user device CDR phone Bgw cellular site data while calling a CDR phone Bgw cell phone site location CDR phone Bgw IMSI global headers and the Digital Network Unified Mobile Station Services (MSISDN) global headers of equipment that supports communication with the subscriber, or about the subscriber Bgw

Additions to GPRS and 3G call detail records 3G GSM triple encryption key sets Auc five five encryption key sets Auc any other 3G encryption key provider keys Auc 3G CDR [Converted and borrowed ETSI ASN.1 module "TS32215-Data Types {itu-t 0 identified-organization 4 etsi 0 mobileDomain 0 umts-Operation-Maintenance3 ts-32-215 215 informationMode | 0 asn1 Module 2"], including Bgw 3G CDR connection start timestamp Bgw international mobile subscriber identifier (IMSI) 3G CDR Bgw assigned IP address 3G CDR Bgw communication data with 3G CDR mobile objects exchanged with foreign operators Bgw

Detailed message records of the Short Message Service (SMS), Advanced Messaging Service (EMS), and Multimedia Messaging Service (MMS) Timestamp of the sent MSD message Message Service Provider (e.g. SMS-C, MMC) Delivered MSD Message Timestamp Message Service Provider (e.g. SMS-C, MMC) Timestamp of the received MSD message Message Service Provider (e.g. SMS-C, MMC) Calling Number MSD Message Service Provider (e.g. SMS-C, MMC) IMEI Caller ID MSD Message Service Provider (e.g. SMS-C, MMC) Called MSD Number Message Service Provider (e.g. SMS-C, MMC) IMEI of the called MSD number Message Service Provider (e.g. SMS-C, MMC) MSD location data when messages are sent and received (latitude / longitude or grid) Message Service Provider (e.g. SMS-C, MMC)

Current Instant Messaging Service (IMS) Records IM username Message Service Provider (e.g. SMS-C, MMC) IM user password Message Service Provider (e.g. SMS-C, MMC)

Availability and availability of management services Geological correlations
time for devices, applications, subscribers Message Service Provider (Presence Server) Availability Algorithms Message Service Provider (Presence Server) Associated identifiers for example, the number of actually allocated seats in an airplane or train Message Service Provider (Presence Server) Partner Lists Message Service Provider (Presence Server) Availability Messages

Detailed email system usage records E-mail address Email server Internet Message Access Protocol (IMAP) Identifier Email server Email Post Protocol Identifier (POP) Email server Email Server to Server Protocol SMTP, X.400, others Email server Email Server-User Client Protocol SMTP / POP, IMAP, HTTP, SSL, SSH, others Email server Email Server Type vendor MX server, backup MX or remote MX Email server Outgoing Rejected Email Server Location Email server Location of the e-mail server for incoming reflected messages Email server Available SNMP Email Server Data Email server Email Subscriber Account Username Email server Email Subscriber Account Privileges Email server Email Subscriber Account Management Protocol e.g. http Email server Email Subscriber Account Management URI Email server Digital Email Subscriber Account User Certificate Email server Email Subscriber Account Auto Reply Email server Timestamp of the start of an email server subscriber access session Email server Time stamp of the end of the email server subscriber access session if there was a communication session Email server Email server subscriber IP address used for access Email server Email Server Subscriber Access Protection Protocol Email server Email server subscriber account user digital certificate Email server Email client user client application used for access Email server Feature Type Email Server Subscriber Management Account Email server

Detailed Email Records E-mail server subscriber account attribute timestamp Email server Email Actions sent, retrieved, received, automatically forwarded Email server email server timestamp Email server Email Sender IP Address Email server DNS FQDM or X.400 domain name of the sender of the message or redirector Email server Email address or IP address of the redirector host or other network address Email server Email account username Email server Email ID Email server Email Envelope Timestamp Email server Email address "in" including all related types, e.g. cc, bcc, fcc, lcc Email server Return to Email Envelope Address Email server Email Out of Address Email server Email Size Email server Indicators of information associated with an email message Email server Digital Email Envelope Certificate if signed or encrypted Email server Forwarded Email Email Address Email server Forwarded Email Sender IP Address Email server Forwarded Email Timestamp Email server Iterate email messages for message headers or used content rewriting tables Email server Changes to email messages for message headers or retention times for content in rewriting tables Email server

Directory Entries directory mobile device number (MDN) IT operator DB Lightweight Directory Service Protocol (LDAP) directory identifier IT operator DB X.500 directory identifier IT operator DB directory IRIS identifier IT operator DB directory pointer identifier IT operator DB another directory IT operator DB

Security Application Records PKI public key identifier AAA key passwords AAA

Detailed records of the use of the Internet access system Changes to email messages for message headers or retained content-related information ISP NAS Internet Access System Access Type call by number, hot spot, always on ISP NAS Internet Access System Connection Protocol ISP NAS Internet Access System Timestamp ISP NAS timestamp disconnecting Internet access system ISP NAS Authentication Username for Internet Access System ISP NAS Internet Access System Password ISP NAS Internet Access System Authentication Certificate ISP NAS Assigned Internet Access System Access IP ISP NAS Internet Access System Connection Speed ISP NAS Caller Line Identifier (CLI) for Internet Access System ISP NAS The dialed number of the terminal server of the Internet access system provider ISP NAS ADSL Endpoint Internet Access System ISP NAS MAC address of the Internet access system ISP NAS IPSEC or other tunnels of the Internet access system ISP NAS Authentication username secure tunnel Internet access system ISP NAS Secure Internet Tunnel Entry Timestamp ISP NAS

Detailed records of an Internet service system Internet access secure tunnel IP address connecting to the tunnel ISP NAS Type of service on the Internet WWW, FTP, DNS, LDAP ISP NAS Type of access to Internet services supplier, customer, collective use, agent ISP NAS Internet Service Access Mediation Module Configuration in use, fixed, configurable by the end user ISP NAS Internet Service Access Ports ISP NAS Resource Record of Internet Services ISP NAS Allow NAPTR Online Services if the resource record is NAPTR ISP NAS

Detailed records of use of services on the Internet Identifier for access protection or automatic data redirection ISP NAS Type of use of services on the Internet WWW, FTP, DNS, LDAP, Whois, Rwhois, SIP, H.323 ISP NAS Internet service usage timestamp ISP NAS Internet Use IP Address ISP NAS Title Reverse Resolution DNS Use of Internet Services ISP NAS Internet service request input ISP NAS Digital certificate of use of Internet services ISP NAS Internet Service Return Information Includes downloads, information returned ISP NAS Downloadable Online Service Usage Information Records, reply messages, or downloads ISP NAS Change of sign of using services on the Internet ISP NAS Internet Reverse Connection IP Address ISP NAS

Roaming system and detail records Internet service reverse data transmitted to the visitor’s site (for example, cookies) Hss Detail access roaming timestamp roaming record HLR / HSS Requested IMSI details of roaming detail records Hlr IMSI returned data for roaming detail records Hlr Requested MSISDN details for roaming details Hlr

Prepaid service system Requested MSISDN details for roaming details IN, BGW The way to activate prepaid services IN, BGW Timestamp for activation of prepaid services IN, BGW

Detailed Call Records for Prepaid Services Means of activating prepaid services IN, BGW Timestamp of the start of a prepaid service call IN, BGW Prepaid Services Call End Timestamp IN, BGW Type of service call prepaid services IN, BGW Identification of a user calling prepaid services IN, BGW Associated prepaid service call number IN, BGW

Billing Records Billing Account Name Bgw Billing Account ID Bgw Billing Approval Date Timestamp Bgw Timestamp for the start of the billing period Bgw Billing Period End Timestamp Bgw Billing Line Element Bgw Access to billing and other charges Bgw Total Billing Amount Bgw Billing Image File Identifier Bgw

Payment Records Payment Accept Timestamp Bgw Billing Recommendation Bgw Payment Amount Received Bgw Type of Means of Payment Bgw Subscriber payment institution identifier Bgw Name of subscriber payment institution Bgw Subscriber payment institution address Bgw Subscriber Payment Account Id Bgw Subscriber billing account name Bgw Subscriber payment account address Bgw

Management Information Base Records [specification mechanism needed] (data elements accessible through a communications network management structure. See IETF STD 58, RFC3410) OSS

Collateral system and details Location of the prepaid service call Retention regarding data with which it is associated Data needed to interpret other information exchange data For example, correspondence between cell mast identifiers and their location

Stored content (including sound mail, email, and SMS) Dialing conversion as supported by IN networks Message Service Provider (e.g. SMS-C, MMC) Type of information stored sound mail, email and SMS Message Service Provider (e.g. SMS-C, MMC) Stored Content, Availability of Stored Messages Message Service Provider (e.g. SMS-C, MMC) Stored Content Access Location Message Service Provider (e.g. SMS-C, MMC) Stored Content Access Code Message Service Provider (e.g. SMS-C, MMC) Duration of storing messages that are stored in stored content

Judicial Information Duration after access Stored in DB DR module Timestamp Offset The measured offset of the generated timestamp values during the same hour when the accumulated NTPQ value was determined relative to the public NTP of the primary or secondary server Stored in DB DR module

Claims (13)

1. A method in a telecommunication system for providing access to data received in a centralized storage medium (DR-C) from interacting traffic aggregation nodes in a system, characterized in that the centralized storage medium is part of the mediation and delivery (MDF) function, which is associated with a monitoring tool owned by a law enforcement agency (LEMF), the method comprising the following steps, in which:
- identify, in the mediation and delivery function (MDF), a configuration request that contains filtering criteria that determine the type of data to be accessed,
configure, in the mediation and delivery function (MDF), the requested filtering criteria,
- receive data (D1) from the system in a centralized storage environment,
- establish that the received data meets the filtering criteria,
- Hold received data in a centralized storage environment. 2. The method in a telecommunication system for providing access to data received in a centralized storage medium according to claim 1, wherein the configuration request further comprises a retention request indicating that data satisfying the configured filtering criteria should be stored in a centralized storage medium. 3. A method in a telecommunication system for providing access to data received in a centralized storage medium according to claim 1 or 2, wherein the configuration request is received from a monitoring tool owned by a law enforcement agency (LEMF), and wherein the request further comprises a subscription request indicating that data that meets the configured filtering criteria must be redirected to a monitoring tool owned by a law enforcement agency. 4. The method in a telecommunication system for providing access to data received in a centralized storage medium according to claim 3, wherein the subscription request further comprises a notification request indicating that only a notification regarding data satisfying the configured filtering criteria should be redirected to the monitoring tool owned by law enforcement (LEMF). 5. A method in a telecommunication system for providing access to data received in a centralized storage medium according to claim 2, wherein the configuration request is received from a monitoring tool owned by a law enforcement agency (LEMF), the method comprising the following additional steps, in which:
- accept, in a mediation and delivery function (MDF), from a monitoring tool owned by a law enforcement agency, an acquisition order to acquire held data (D1),
- redirect data (D1) from the mediation and delivery function (MDF) to a monitoring tool owned by a law enforcement agency. 6. The method in a telecommunication system for providing access to data received in a centralized storage medium according to claim 5, wherein the verification of access rights is performed in the mediation and delivery (MDF) function after receiving a configuration request or purchase order. 7. A device in a telecommunication system for providing access to data received in a centralized storage medium (DR-C) from interacting traffic aggregation nodes in a system, characterized in that the centralized storage medium is part of the mediation and delivery (MDF) function, which is associated with a law enforcement monitoring tool (LEMF), the device comprising
- means of identification, in the function of mediation and delivery (MDF), of a configuration request that contains filtering criteria that determine the type of data to be accessed, configuration means, in the function of mediation and delivery (MDF), of requested filtering criteria,
- means for receiving data (D1) from the system into a centralized storage medium,
- a means of establishing that the received data meets the filtering criteria,
- a means of retaining received data in a centralized storage environment. 8. A device in a telecommunication system for providing access to data received in a centralized storage medium according to claim 7, wherein the configuration request is received from a monitoring tool owned by a law enforcement agency (LEMF), the device further comprising:
a means of receiving, in a mediation and delivery function (MDF), from a monitoring tool owned by a law enforcement agency, an acquisition order to acquire held data (D1),
a means of redirecting data (D1) from the mediation and delivery function (MDF) to a monitoring tool owned by a law enforcement agency. 9. A device in a telecommunication system for providing access to data received in a centralized storage medium according to claim 7 or 8, the device further comprising:
a requesting function (ManF) in a law enforcement monitoring tool (LEMF) connected to a receiving function (ConF) in a mediation and delivery function (MDF), where this pair of functions is used to process requests,
response function (NotF), in the mediation and delivery function, connected to the acquisition function (LiAF) in a monitoring tool owned by a law enforcement agency, where this pair of functions is used to process the delivery. 10. The device in a telecommunication system for providing access to data received in a centralized storage medium according to claim 9, wherein the device further comprises a transmission interface (HI) between the requesting function and the receiving function and between the response function and the acquisition function. 11. A device in a telecommunication system for providing access to data received in a centralized storage medium according to claim 7 or 8, the device comprising means for verifying access rights in the mediation and delivery (MDF) functions after receiving a configuration request or purchase order. 12. A system in a telecommunication system for providing access to data received in a centralized storage medium (DR-C) from interacting traffic aggregation nodes in a system, characterized in that the centralized storage medium is part of the mediation and delivery (MDF) function, which is associated with a monitoring tool owned by a law enforcement agency (LEMF), and the system is characterized by the presence of:
- a monitoring tool owned by a law enforcement agency (LEMF) capable of sending a configuration request,
- a mediation and delivery function (MDF) capable of receiving a request,
- a mediation and delivery function (MDF) capable of storing information received in the request (MDF),
- a mediation and delivery function (MDF) capable of receiving data (D1) from the system,
- a mediation and delivery function (MDF) capable of comparing received data with stored filtering criteria,
- a mediation and delivery function (MDF) capable of holding received data (D1) in a centralized storage environment and / or redirecting data to a monitoring tool owned by a law enforcement agency. 13. An industrial product containing a program storage memory containing machine-readable program code for providing access to data received in a centralized storage medium (DR-C) from interacting traffic aggregation nodes in a system, characterized in that the centralized storage medium is part of the function mediation and delivery (MDF), which is associated with a monitoring tool owned by a law enforcement agency (LEMF), the machine-readable program code in an industrial product containing:
- a machine-readable program code identifying, in the mediation and delivery function (MDF), a configuration request that contains filtering criteria that determine the type of data to be accessed,
- machine-readable program code for storing, in the mediation and delivery function (MDF), the requested filtering criteria,
- machine-readable program code for receiving data (D1) from the system into a centralized storage medium,
machine-readable code to determine that the data meets configured filtering criteria,
- machine-readable program code for holding received data (D1) in a centralized environment for storing and / or redirecting data to a monitoring tool owned by a law enforcement agency.

Images