WO2001047222A2

WO2001047222A2 - Transparent communication interception in a core transport network

Info

Publication number: WO2001047222A2
Application number: PCT/US2000/034860
Authority: WO
Inventors: Lee Davidson; Eric Valentine; Heino Hameleers; Frank Hundscheidt
Original assignee: Ericsson Inc.
Priority date: 1999-12-23
Filing date: 2000-12-21
Publication date: 2001-06-28
Also published as: AU3265601A; WO2001047222A3

Abstract

The present invention is a system and method for enabling a Legal Intercept Monitoring Center to monitor communication. The method comprises the steps of receiving a communication and then converting the communication into a format readable by a Legal Intercept Monitoring Center (LIC). The system intercepts a communication and forwards a copy of the communication to a Legal Intercept Monitoring Center (LIC) in a LIC readable format using an intercept transcoder and a payload copying device.

Description

TRANSPARENT COMMUNICATION INTERCEPTION IN A CORE TRANSPORT NETWORK

TECHNICAL FIELD OF THE INVENTION The present invention rates generally to intercepting communications in a telephone network, and more, specifically to transparently intercepting communication in a telephone network that has a core transport network that is not a circuit switched 64 kilobits per second (kbps) network

BACKGROUND OF THE INVENTION

As terrorists and white collar criminals become more technologically sophisticated, the ability of law enforcement to monitor communications is becoming increasingly more critical To monitor communication, government agencies, such as the Federal Bureau of Investigation (FBI), Central Intelligence Agency (CIA), and National Security Agency (NSA), for example, employ a variety of devices and methods to intercept the electronic communications of (or bug) parties to a conversation or written communication, such as e-mail Traditionally, wiretaps were the primary method of monitoring telephone communications However, wiretaps require special hardware, as well as the hard wiring of devices into the telephone lines used by the party to communicate More advanced telephone systems, such as the Public Land Mobile Network (PLMN) of mobile communication networks, employ devices such a Legal Intercept Monitoring Center (LIC) to intercept communications

Figure 1 (prior art) is a block diagram of a system used to intercept communication in a PLMN Although a PSTN is shown the telephone network could be any land based telephone system such as a Public Land Mobile Network (PLMN), or other telephone network for example In the mobile communications systems a mobile phone 10 communicates with a Base Station (BS) 20 across an air interface 22 The BS 22 then passes the communication onto a base station controller (BSC 30) across an Abis interface 24 as coded speech The BSC 30 has within it a transcoder which converts coded speech to pulse code modulated (PCM) signals such as those used by the G 711 standard The transcoder is otherwise known as a Transcoder Rate Adaptation unit (TRAU) The combination of a BS 20 and a BSC 30 is sometimes referred to as a base station subsystem or BSS The pulse code modulated signals are then carried across an A interface 34 to a Mobile Switching Center (MSC) having within it a Switching Matrix (SM) which is coupled to a Conference Bridge (CB) The SM 42 routes PCSN speech to a Public Switch Telephone Network

(PSTN) 50 as pulse code modulated signals across link 52 The SM 42 also routes PCM speech to the Legal Interface Monitoring Center (LIC) 46 The CB 44 makes a digital copy of the PCM signal so that the copied signal maybe sent to the LIC 46 independently of the signal which is sent across the PSTN 50 By copying the PCM signal in the CB 44 and sending duplicate copies of the PCM signal across the PSTN 50 and the LIC 46, transparency is provided to the monitoring

Perhaps the most important requirement for effective call monitoring is transparency Transparency is the property that the LIC 46 posses when neither party the conversation knows that his conversation is being monitored However, because devices exist that can detect some types of monitoring, special care must be provided to assure transparency in the LIC 46 Furthermore, if the parties to a conversation discover that their conversation is being monitored, they are likely to either reestablish conversation in a way that cannot be monitored or alter their discussions to reflect the knowledge of the monitoring Another issue in effective call monitoring across a telephone system is a monitoring of Tandem Free Operation Figure 2 (prior art) illustrates Tandem Free Operation between an originating mobile phone 10 and a receiving mobile phone 90 across a mobile communication network When establishing communication, the originating mobile phone 10 sends a communication to the base station 20 which forwards the communication as coded speech to the base station controller 30 (having the transcoder 32 therein) The transcoder 32 converts the coded speech of the originating mobile phone 10 to PCM speech and sends the PCM speech to the MSC 40 When the circuitry inside the MSC 40 detects that a call being received by the MSC 40 is a call to be monitored (tagged call), the MSC turns on the CB therein (not shown in Figure 2) so that copies of the PCM speech may be sent to LIC 46. ^■ -

Likewise, the original PCM speech is sent across the PSTN 50 received by a receiving MSC 60. The speech is then passed along to a receiving PSC 70 that through a receiving transcoder 72 therein, converts the PCM speech signal received from the PSTN 50 into coded speech, which is then sent to the BS 80 Next, the receiving BS 80 establishes communication with the receiving mobile phone 90 across an air interface

As long as PCM speech is sent between the BSC 30 and the receiving BSC 70, the LIC 46 may monitor either or both conversations However, in Tandem Free Operation, the originating mobile phone 10 and the receiving mobile phone 90 take over control of the communication by enabling an originating transcoder in the originating mobile phone 10 and a receiving transcoder in the receiving mobile phone 90 to negotiate between themselves and turn each other on and off effectively so that coded speech (CODEC) will travel directly between the originating mobile phone 90 and a destination terminal device. Ideally, the communication between an originating mobile phone transcoder and a receiving mobile phone transcoder simplifies communication and allows devices along a user plain to devote themselves to other functions Unfortunately, Legal Intercept Monitoring Centers do not have the ability to translate all communications protocols and standards. For example, CODEC cannot be processed by LICs Furthermore, even if they did have the ability to translate CODEC, it would be impractical to interpret CODEC without knowing how it was encoded in the first place So, even if a copy of the CODEC coded speech were made, the LIC would be unable to interpret the received CODEC

Thus, as more advanced standards for mobile phone communication are developed, the transmission of communications using these standards is incompatible with law enforcements' desire to monitor some communications Furthermore, the additional challenge of being able to monitor new standards is magnified by the necessity for monitoring systems to remain transparent Therefore, there exists the need for systems and methods capable of transparently monitoring communications across telephone networks SUMMARY OF THE INVENTION

The present invention achieves technical advantages as a system and method of transparently monitoring communication in a communication network. The system, which is generally comprised of an intercept transcoder and a payload- copying device, produces a digital duplicate of a speech payload (LP packet, ATM cell, or encoded speech) without disturbing the original payload. The system could be bi-directional, or uni-directional, and may be distributed throughout the network. The method generally comprises the steps of identifying a communication as a tagged communication, creating a copy of the tagged communication, and sending a LIC compatible copy of the tag communication to a LIC. Accordingly, the present invention is able to transparently monitor communications in a communications network including third generation (3G) systems, including systems which incorporate Tandem Free Operations.

In one embodiment, the present invention is a method for enabling a Legal Intercept Monitoring Center to monitor communication. The method comprises the steps of receiving a communication and then converting the communication into a format readable by a Legal Intercept Monitoring Center (LIC).

In another aspect, the present invention is a method for enabling a Legal Intercept Monitoring Center to monitor communication. The method comprises the steps of first receiving a communication in a Mobile Switching Center (MSC), where the communication arriving as a payload stream. Next, the method identifies the communication as a tagged communication and identifies the format of the communication. Then, the method creates a copy of the communication and sends a copy of the communication to a Legal Intercept Monitoring Center (LIC). In yet another embodiment, the invention is a system for intercepting a communication and forwarding a copy of the communication to a Legal Intercept Monitoring Center (LIC) in a LIC readable format. The system comprises an intercept transcoder and a payload copying device. BRIEF DESCRIPTION OF THE DRAWINGS

Various aspects of the invention, including alternative embodiments, can be understood and interpreted by reference to the following Detailed Description of a Preferred Embodiment, which can be better understood by reference to the drawings, in which:

Figure 1 (prior art) is a block diagram of a system used to intercept communication in a PLMN;

Figure 2 (prior art) illustrates Tandem Free Operation between an originating mobile phone and a receiving mobile phone across a mobile communication network; Figure 3 is a communications monitoring system configured according to the teaching of the present invention;

Figure 4 is a block diagram of a monitoring algorithm;

Figure 5 is a block diagram of a third generation of a PLMN configured to monitor communications according to the present invention; and Figure 6 is a block diagram of a third generation mobile communication system, which uses the present invention.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

The present invention is able to transparently monitor communications in a communications network including third generation (3G) systems which incorporate Tandem Free Operations. The system generally uses an intercept transcoder and a payload-copying device to produce a digital duplicate of a speech payload (from an IP packet, an ATM cell, or encoded speech) without disturbing the original payload. The system can be configured to be bi-directional or uni-directional. The system can be located in and distributed throughout the network. The method generally comprises the steps of identifying a communication as a tagged communication, creating a copy of the tagged communication, and sending a Legal Intercept Center (LIC) compatible copy of the tag communication to a LIC.

Figure 3 is a communications monitoring system 100 configured according to the teaching of the present invention. Although the following discussion is aimed at packet based transfers, such as occur across an Internet Protocol (IP), it should be understood that the following discussion relates equally to any type of communication transfer occurring across a non-PCM communication system, such as Asynchronous Transfer Mode (ATM), for example Furthermore, although shown primarily located in a Media Gateway (MGW) 102, it should be understood that the communication monitoring system 100 can be distributed throughout a communications network Thus, the communications monitoring system 100 may be located in (or distributed throughout) a Base Station (BS), a Base Station Controller (BSC), a Legal Intercept Monitoring Center (LIC), or other part of the communication network

The MGW 102 comprises a Packet Assembler/De- Assembler (PAD) 110 The PAD 1 10 accepts communications in the form of packets or cells and, as the name implies, assembles or de-assembles the packets to be compatible with a first transcoder 120 shown in Figure 3 as TRAU-A The first transcoder 120 provides for the conversion between the protocol used by the device connected to the PAD 110, such as a Base Station Controller 1 12, and the protocol of a communications network 180 A second transcoder, called the intercept transcoder, 170 is connected to the output of the system through a Conference Bridge (CB) 160 and switching matrix 130 into a standard Pulse Code Modulated (PCM) over Synchronous Transfer Mode (STM) link to the LIC 140 The intercept transcoder 170 is configured to exhibit the same behavior as any other transcoder, including the first transcoder 120, used in a communication

For example, the intercept transcoder 170 is to follow the same procedures as are used for Tandem Free Operation as discussed below However, the mode of the intercept transcoder 170 will be the "inverse" of the mode used by the first transcoder 120 For example, when the first transcoder 120 negotiates and uses coded speech (CODEC), the intercept transcoder 170 will transcode (or negotiate) the CODEC to PCM Likewise, when the first transcoder 120 produces PCM the intercept transcoder 170 detects this fact, and since the LIC 140 is able to interpret PCM, the intercept transcoder 170 does not reinterpret the PCM, but rather forwards the PCM onto the LIC 140 The switching matrix 130 controls the placement of a packet on the link connecting the MGW 102 to the communications network 180 (which is shown as an IP network), as well as the sending of a copied packet across a PCM link to the LIC 140 The LIC 140 controls the identification of communications to be monitored, and records communications sent to it by the media gateway 102 According, the Legal Intercept Center 140 may have a system operator who identifies users or other parties as sources to be monitored, instructs the MGW 102 to intercept communications by these users (thus "tagging" the communications), and then receives these tagged communications so that they may be monitored Furthermore, the Legal Intercept Monitoπng Center 140 may identify key words in data communications, such as the title of e-mails, so that various e-mails may be stored and monitored LICs may be enabled to translate information received in the form of UMCS advanced variable rate (AYR), GSM full, enhanced full rate (EFR), or half rate FR, ERF, HR, or other interfaced compressed speech forms carried in IP packets or ATM cells An intercept block (IT) 150 is shown comprising the conference bridge 160 that is coupled to the intercept transcoder 170, as well as the first transcoder 120 and the switching matrix 130 The conference bridge 160 makes a digital copy of the tagged communication being monitored However, the copy of the communication must be in PCM to be readable by the LIC 140 Accordingly, the intercept transcoder 170 operates to convert communications received from the PAD 110, when necessary, to PCM

A conversion between one communications format to a second communication format is called a mode conversion, and the state of a transcoder making that conversion is called the "mode" of the transcoder For example, the first transcoder would be said to be in a first mode when it converts coded speech into PCM Likewise, the first transcoder 120 could be said to be in a second mode when it converts coded speech into IP packets The first transcoder 120 will have other modes representative of changing coded speech into alternative formats, as well as other modes representative of changing received packets or other data into coded speech For example, the first transcoder 120 could be said to have a third mode that converts IP packets into CODEC The intercept transcoder 170, in every case but one, mirrors the function of the first transcoder 120. For example, when the first transcoder 120 is in the second mode and converts coded speech into IP packets, the intercept transcoder 170 will convert the IP packets into PCM so the conference bridge 160 may copy the packet in PCM, which is readable by the LIC 140 The copied packet is then sent in PCM to the LIC 140. Likewise, when the first transcoder 120 is operating in the third mode by receiving an IP packet and converting it into CODEC, the intercept transcoder receives the IP packet and converts it into PCM Then, a copy of the original IP packet is made by the conference bridge 160 and sent to the LIC 140 in PCM In any event, the functionality of the intercept transcoder 170 will produce PCM messages readable by the LIC 140, or, in other networks using other LICs, a signal in a communications format compatible with that network's LIC

A method of practicing the present invention can be illustrated as an algorithm for monitoring a communication. Figure 4 is a block diagram of a monitoring algorithm 400. First, in a detect tag step 410, the monitoring algorithm 400 detects a packet which has been tagged by a system operator as belonging to a communication that is to be monitored The tag indicates that authority has been given to an agency to monitor and track the communication either at the source terminal device or a destination terminal device, and that the system operator has designated for monitoring the communications originating from that terminal device

Next, in a first identify format query 420, the packet is checked to see if it is part of a PCM data stream. If in the first identify format query 420 it is determined that the speech stream is PCM, then an intercept transcoder will not be activated and the PCM will be directly copied by a conference bridge and relayed to a Legal Intercept Monitoring Center as in the prior art, in a copy PCM step 430 However, if the speech stream is found to be in a format other than PCM in the identify format query 420, then the monitoring algorithm 400 proceeds to a select coded speech query 440 In the select coded speech query 440, the monitoring algorithm 400 selects the type of coded speech conversion which is needed by the first transcoder so that the operation of the first transcoder can be mirrored by the intercept transcoder For example, if a conversion between CODEC and Internet Protocol (IP) is needed, then the monitoring algorithm 400 proceeds to a select IP-CODEC step 450, which places the first transcoder in a first mode which converts CODEC to IP, and places the intercept transcoder in a first mode which converts IP to PCM Likewise, if the select CODEC query 440 determines that Asynchronous Transfer Mode (ATM) conversion is needed then the monitoring algorithm 400 proceeds to a select ATM-CODEC step 460. In the ATM-CODEC step 460 the first transcoder is places in a second mode which converts CODEC to an ATM, and the intercept transcoder is placed in a second mode which converts ATM into PCM

Furthermore, if the select CODEC query 440 determines that another communication protocol transfer is needed can the monitoring algorithm 400 proceed to a select protocol to CODEC 470 which places the first transcoder in another mode which converts the CODEC into the proper protocol for communication to a communication network, and places the intercept transcoder in another mode which converts the signals compatible with the communication network into PCM. Following the select steps 450, 460, 470 the monitoring algorithm 400 proceeds to a send PCM step 480 where copied packets of the original communication are sent to the LIC The send PCM step 480 continues as long as the communication continues

It should be understood that multiple copies of the monitoring algorithm 400 may be running simultaneously to monitor a single communication which may be trying to jump between communication protocols to avoid detection and monitoring When the monitoring algorithm 400 detects that the communication has terminated, the send PCM step 480 terminates and the monitoring algorithm 400 returns to a monitored communication step 405

Other systems exist that are able to utilize the present invention Figure 5 is a block diagram of a third generation of a PLMN 500 configured to monitor communications according to the present invention. In Figure 5 an originating mobile phone 510 communicates across an air interface with a first base station 520. The first BS 520 sends communications and voice information across a user plain illustrated by a solid line connecting the first base station 520 with a second base station 530 as well as a media gateway 540 located across a core transport network 550 A destination mobile station 520 receives communications from the second base station 530 across the air interface In a control plain, illustrated by dashed lines, the first base station 520 sends and receives control channel signals with a base station controller 560 as well as the mobile switching center 570 The mobile switching center 570 monitors communications, and when the mobile switching center 570 detects a tagged communication it will order the first base station 520 to send a copy of the original packets across the core transport network 550 and to the media gateway 540 The media gateway 540 contains within it an intercept transcoder 545 for converting communications from the format used to communicate between the originating cell phone 510 and the destination cell phone 550 into PCM signals which are receivable by the LIC 580

Since, in Figure 5, communications are shown between two mobile phones operating within base stations commonly connected to a signal core transport network 550, it is possible for the originating mobile phone 510 to communicate with the destination mobile phone 550 in an enhanced full rate coded speech (EFR) mode In EFR there is no payload in the media gateway leading to the core network Accordingly, identification of the tagged communication via the control plane is needed in the MSC 570 to effectively monitor the communication

Figure 6 is a block diagram of a third generation (3G) mobile communication system 600 that uses the present invention In Figure 6, a source terminal, the first mobile phone 610, communicates across an air interface with a first base station 620 which uses a first Radio Network Controller (RNC) to access a core transport network 675 Communications between the first mobile phone 610 and a destination terminal, the second mobile phone 660, travel in a user plain from the core transport network 675 to a second RNC 640, which sends the communication on to a second BS 650 The second BS 650 communicates with the second mobile station 660 across an air interface Likewise, in a control plane, illustrated by dashed lines 665, the RNCs 630, 640 communicate and are under the control of a Universal Mobile Switching Center (UMSC) In this configuration, the 3G mobile communications system 600 may recognize a tagged communication in either the RNC 630, the second RNC 640, or via a control channel signal arriving at the UMSC 670 If the tagged communication is identified in either the first RNC or the second RNC 640, the first RNC 630 or the second RNC 640 will notify the UMSC of the tagged communication Then, the UMSC 670 will alert a media gateway 680 having an appropriate intercept block 685 therein that a tagged communication has been detected and that PCM conversion may be necessary

If it is determined that PCM conversion is necessary, then either the first RNC 630 or the second RNC 640 may send the packet to the MGW 680 for conversion to PCM by the IT 685, which then sends the PCM information to a LIC 690 In figure 6, the communications originating from the first mobile station 610 (originating communications) that have been tagged are shown to travel across a user plain as a solid line using adaptive multi-rate coding (AMR), which is a form of encoding commonly used in GSM Alternatively, if a control channel signal is used, the UMSC 670 orders the IT in either of the RNCs 630, 640 to make a copy of the data of the tagged communication and send that data to the MGW 680 where the intercept transcoder 685 is located

If a communication is handled without the use of a MGW (MGW absent operation), for example, in the case of a mobile phone to mobile phone call which occurs between a first base station and a second base station in a PLMN network with IP transport, either base station can make a copy of a payload and sends the payload to the intercept transcoder This enables monitoring across international boundaries Alternatively, each base station may be ordered to make a copy of the payload in only the incoming or outgoing direction In either case, the payload is sent to the intercept transcoder To accomplish this, the intercept transcoder is configured according to the transcoding negotiated with the first transcoder at call establishment, since the absence of MGW use is likewise detected at call establishment Accordingly, the base stations are configured by the MSC server or UMSC server (also called the call control server) to perform thiε function at call establishment. In case the call has been established using a MGW, the intercept transcoder is connected to the payload duplicating device, which is either located within the MGW or connected to it (which, in the above figures, is the CB).

Similar to MGW absent operation, for Tandem Free Operation calls using RNC in UMTS networks, the implementation is for the RNCs to send copies of the speech to the intercept transcoder. The transmission takes place over either an I_u interface or a separate monitoring payload interface. In this configuration, the intercept transcoder has been transfigured according to the parameters negotiated during call establishment to mirror the first transcoder.

By these means, if the transcoding mode changes during the call, the intercept transcoder, which is connected to the device performing the digital copying, changes modes according to the same rules as the other transcoders to maintain the mirroring function. In band signaling or out of band signaling may trigger these modes to change. The output of the intercept transcoder is then routed to the LIC. This output, accordingly, is always PCM unless the LIC is operating to recognize other communications formats.

If the network supports rate or CODEC rate initiation after call establishment, the intercept transcoder is informed by one of the control nodes (RNC or MSC server) of the change using either the same network signaling its use to negotiate the change, or device control protocol such as H.248. Alternatively, the controlled node (BTS or MGW) informs the intercept transcoder using a similar protocol.

While the invention has been described in conjunction with preferred embodiments, it should be understood that modifications will become apparent to those of ordinary skill in the art and that such modifications are therein to be included within the scope of the invention and the following claims.

Claims

WHAT IS CLAIMED IS:

1 A method for enabling a Legal Intercept Monitoring Center (LIC) to monitor communications, comprising the steps of receiving a communication at a media gateway (MGW), and converting the communication into a format readable by a Legal Intercept

Monitoring Center (LIC)

2 The method of Claim 1 further comprising the steps of monitoring a payload stream comprising communications for a tagged communication, and identifying a communication in the payload stream as a tagged communication

3 The method of Claim 1 further comprising the step of identifying the communication format

4 The method of Claim 1 wherein the communication format readable by the LIC is 64 kbps Pulse Code Modulated (PCM) speech

5 The method of Claim 1 wherein the step of converting the received communication converts the communication from Asynchronous Transfer Mode (ATM) cells to 64 kbps pulse code modulated speech

6 The method of Claim 1 wherein the step of converting the communication from Internet Protocol Packet 164 kbps pulse code modulated speech to a format readable by the LIC

7 The method of Claim 1 wherein the step of converting the communication from coded speech to 64 kbts pulse code modulated speech

8 The method of Claim 1 further comprising the step of copying the communication in an intercept transcoder

9 The method of Claim 1 further comprising the step of sending a copy of the communication to the LIC

10 A method for enabling a Legal Intercept Monitoring Center to monitor communication, comprising the steps of receiving a communication in a Control Node (CN), the communication arriving at a payload stream, identify the communication as a tagged communication, identifying the format of the communication, creating a copy of the communication, and sending a copy to a Legal Intercept Monitoring Center (LIC)

11 The method of Claim 10 further comprising the step of forwarding the communication to a destination

12 The method of Claim 10 further comprising the step of converting the communication from Asynchronous Transfer Mode (ATM) to 64 kbts pulse code modulated speech

13 The method of Claim 10 further comprising the step of converting the communication from Internet Protocol (IP) to 64kbts pulse code modulated speech

14 The method of Claim 10 further comprising the step of converting the communication from coded speech to 64 kbts pulse code modulated speech

15 The method of Claim 10 wherein the step of creating a copy of the communication produces, in an Intercept transcoder, an intercept mode that mirrors a first mode in a first transcoder

16. The method of Claim 10 wherein the payload stream is not disturbed.

17. A system for intercepting a communication and forwarding a copy of the communication to a Legal Intercept Monitoring Center (LIC) in a LIC readable format, comprising: an intercept transcoder; and a payload copying device.

18. The system of Claim 17 wherein the intercept transcoder is maintained in a base station.

19. The system of Claim 17 wherein the payload copying device is a conference bridge.

20. The system of Claim 17 wherein the payload copying device copies only the payload in the incoming direction.

21. The system of Claim 17 wherein the payload copying device copies only the payload in the outgoing direction.

22. The system of Claim 17 wherein the intercept transcoder operates in an intercept mode that mirrors a mode in a first transcoder co-located in a media gateway.