WO2008011819A1

WO2008011819A1 - Method and device for transmitting legal intercepting information

Info

Publication number: WO2008011819A1
Application number: PCT/CN2007/070216
Authority: WO
Inventors: Bo Zheng; Youzhu Shi
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2006-07-18
Filing date: 2007-07-02
Publication date: 2008-01-31
Also published as: CN101110715A; CN100512161C

Abstract

A method and device for transmitting legal intercepting information. The method includes: a network functional entity concerning the intercepting object session receives the related intercepting object messages with the intercepting information; the network functional entity intercepts the intercepted object according to the received intercepting information, and reports the Intercept Related Information (IRI) and/or Content of Communication (CC) to a law enforcement agency. The device is configured in the network functional entity concerning the intercepting object session, and includes the following modules: an intercepting information parsing module for parsing the intercepting information from the related intercepting object messages received by the network functional entity, and sending the intercepting information to an intercepting module; an intercepting module for intercepting the intercepted object according to the intercepting information to acquire the IRI and/or CC; a reporting module for reporting the IRI and/or CC acquired by the intercepting module.

Description

Method and device for transmitting legal monitoring information

The present invention relates to the field of lawful interception, and in particular, to a method and apparatus for transmitting legal interception information. Background of the invention

Lawful interception is a law enforcement act that the law enforcement agencies approve the public communication business according to relevant national laws and public communication network industry specifications with the approval of relevant authorized authorities.

In order to implement lawful interception in the IP Multimedia Subsystem (IMS) network, the 3GPP TS33.107 standard defines a lawful interception model for the IMS network. Referring specifically to Figure 1, the model includes: Judicial Execution Monitoring Equipment (LEMF, Law Enforcement Monitoring Facility ), the administrative function of ADMF (Administration Function) entity, the DF, Delivery Function entity, the Serving-Call Session Control Function (S-CSCF) entity and/or Proxy-Call Session Control Function (P-CSCF) entity. Among them, LEMF, ADMF and DF are located on the law enforcement side, and S-CSCF and P-CSCF are located in the IMS network as the interception control unit in the IMS network.

In a specific service implementation, when performing monitoring in the IMS network, the ADMF carries various interception data on the law enforcement agency side in the interception indication, and sends the S-CSCF and/or P- in the IMS network through the X1_1 interface. CSCF, when the call session signaling message related to the interception object passes through the S-CSCF and/or the P-CSCF, the S-CSCF and/or the P-CSCF listen to the interception object according to the interception data carried in the interception indication, and The acquired Intercept Related Information (IRI) is reported to the DF on the law enforcement side through the X2 interface. The interception indication may include: a listener object activation indication, a listener object query The indication and the interception object attribute modification indication, etc.; the interception data may include the identifier of the interception object, and the like.

In this scheme for implementing lawful interception, since the S-CSCF and/or the P-CSCF cannot learn supplementary service events other than basic session messages, such as value-added services provided by an application server (AS, Application Server), S- The CSCF and/or the P-CSCF cannot report the supplementary service event of the interception object to the DF. Therefore, the law enforcement agency side cannot monitor the supplementary service event of the interception object in the IMS network.

In response to this problem, the European Telecommunications Standards Institute (ETSI)'s Telecommunication and Internet converged Services and Protocols for Advanced Networking study the latest contributions of LI, Lawful Interception. 10tTD077al DTS-07013, the functional entity that defines the reporting of the IRI may further include an AS connected to the ADMF and the DF. In this case, the ADMF can carry the interception data in the interception indication and directly send it to the AS through the Xl_l interface. Since the AS is responsible for processing supplementary services such as value-added services, the AS can report the IRI related to the supplementary service event according to the interception data. To the DF, it can solve the problem that the law enforcement agency side cannot monitor the supplementary service event of the interception object in the IMS network.

As can be seen from the above description, the current mode of implementing lawful interception is summarized as follows: ADMF sends the interception data to the network function entity that can report the IRI. When the message related to the interception object passes through these network function entities, the network function entity monitors according to the network function entity. The data listens to the interception object and reports the IRL to the DF. Since the interception object may sign up to use a variety of different services, these different services may be provided by different ASs. In order for these ASs to obtain the interception data of the interception object through the 1_1 interface, ADMF These ASs need to be managed, configured, and maintained with information about these ASs. When the information of the subscription object subscription service changes, the ADMF needs to perform synchronous update processing to enable the corresponding AS to obtain or delete the corresponding monitoring data, which greatly increases the workload of the ADMF management and maintenance on the law enforcement agency side. Summary of the invention

In view of this, the embodiment of the present invention provides a method for transmitting legal interception information, which can reduce the workload of the ADMF to manage and maintain the network functional entity. The method includes the following steps: The network function entity participating in the interception object session receives a message related to the interception object carrying the interception information;

The network function entity monitors the interception object according to the received interception information, and reports the interception related information IRI and/or the communication content CC to the law enforcement agency side.

An embodiment of the present invention further provides an apparatus for transmitting legal interception information, where the apparatus is disposed in a network function entity participating in a listening object session, and includes the following modules:

a monitoring information parsing module, configured to parse out the interception information from the message related to the interception object received by the network function entity, and send the interception information to the monitoring module;

a monitoring module, configured to monitor the monitoring object according to the monitoring information, to generate an IRI and/or CC;

The reporting module is configured to report the IRI and/or CC generated by the monitoring module.

As can be seen from the above technical solution, the method for transmitting legal interception information provided by the embodiment of the present invention, because the interception information is carried in the message related to the interception object, and the interception information is transmitted to the participating listener session by sending a message related to the interception object. The network function entity is monitored by the network function entity according to the interception information, and reports the IRI and/or CC to the DF, so the workload of the ADMF management and maintenance of these network function entities can be reduced. BRIEF DESCRIPTION OF THE DRAWINGS

1 is a schematic diagram of a lawful interception model of an IMS network in the prior art;

2 is a logical structure diagram of a lawful interception network related to a listening object signaling message according to an embodiment of the present invention;

3 is a flow chart of transmitting legal interception information according to an embodiment of the present invention; 4 is a logical structural diagram of a lawful interception network related to intercepting an object media stream according to an embodiment of the present invention. Mode for carrying out the invention

In order to make the features and advantages of the present invention more comprehensible, the present invention will be further described with reference to the accompanying drawings.

In the embodiment of the present invention, the interception information is extended in the message related to the interception object, and the message related to the interception object is sent to the network function entity participating in the interception object session, and the interception information is transmitted to the session of the participating listener object. The network function entity, the network function entity monitors the interception object according to the received interception information, and reports the IRI and/or the content of the communication (CC, Content of Communication), which is transmitted in the message related to the interception object according to the embodiment of the present invention. Monitoring information does not require ADMF to manage and maintain numerous network functional entities, so it can reduce the workload of ADMF.

The specific implementation of the main idea of the present invention will be described below with reference to the specific embodiments with reference to the accompanying drawings. First, referring to FIG. 2, a logical structure of a lawful interception network related to a listening object signaling message according to an embodiment of the present invention will be described. Figure 2 shows an IMS network as an example. The network structure including the terminal, the network access unit, the S-CSCF, the AS, and the lawful interception service application server (LI-AS) is given.

Here, the terminal is a listening object, which may be a Session Initiation Protocol (SIP) terminal; or a traditional Plain Telephone Service (POTS) terminal and an Integrated Services Digital Network (ISDN). terminal.

The network access unit is connected to the terminal and the S-CSCF, and is used to connect the terminal to the IMS network, and provides functions such as registration, authentication, and authentication. The E1 interface between the network access unit and the S-CSCF uses the SIP protocol. The network access unit can be an application function entity (AF, Application Function ), for example: 3⁄4 port P-CSCF, the corresponding access terminal is a SIP terminal; the network access unit can also be an access gateway control function (AGCF, Access Gateway Control Function), and the corresponding access terminal is a POTS terminal. And ISDN terminals.

The network access unit may receive the interception indication that is sent by the law enforcement agency and carries the interception data. If the interception object is the calling party, the SIP message sent by the calling party arrives at the network access unit that can access the network, the network The access unit extends the interception information in the SIP message, so that subsequent network elements that the SIP message passes, such as an Interconnection Border Control Function (IBCF), and an inquiry call session control function (I-CSCF, Interrogation) -Call Session Control Function ), S-CSCF, AS, Exit Gateway Control Function (BGCF, Breakout Gateway Control Function), Media Gateway Control Function (MGCF, Media Gateway Control Function), etc. will be based on the interception information carried in the received message. The corresponding monitoring process reports the IRI and/or CC to the DF. When the network access unit sends the SIP message to the untrusted domain network entity, the interception information carried in the SIP message is deleted. Here, the untrusted domain network entity is relative to the trust domain network entity, and the trust domain network entity refers to a system and server owned, and/or operable, and/or controllable by the service provider. In contrast, the untrusted domain network entity may be a consumer device or a third party device or the like.

The S-CSCF is connected to the AS. There is an E2 interface between the two. The interface protocol is a SIP protocol. The S-CSCF can also receive the interception indication that is sent by the law enforcement agency and carries the interception data. When the SIP message related to the interception object arrives at the S-CSCF serving as the interception object, the S-CSCF is extended to carry the interception information in the SIP message. The subsequent network elements that the message passes, such as the IBCF, the I-CSCF, the AS, the BGCF, the MGCF, and the network access unit, perform corresponding interception processing according to the interception information carried in the received message. When the S-CSCF sends a SIP message to another untrusted domain network entity such as an AS, the interception information carried in the SIP message is deleted.

LI-AS is a functional entity that performs lawful interception of business logic and provides lawful interception services. The interception data can be obtained from the law enforcement agency side. An E3 interface exists between the LI-AS and the S-CSCF, and the interface protocol is the SIP protocol. The LI-AS receives the interception indication that is sent by the law enforcement agency and carries the interception data. When the SIP message related to the interception object arrives at the LI-AS that is the listener service, the SIP message is extended and carried in the SIP message. Subsequent network elements, such as IBCF, I-CSCF, S-CSCF, AS, BGCF, MGCF, network access unit, etc., will perform corresponding interception processing according to the interception information carried in the received message.

In addition, the LI-AS may also not receive the interception indication sent by the law enforcement agency with the interception data, but the trigger of the S-CSCF to the LI-AS indicates that the current service user of the S-CSCF is the interception object, and the S-CSCF from the law enforcement The organization side obtains the interception data. After the SIP message arrives at the S-CSCF, the S-CSCF determines whether the serviced user in the current session is monitored according to the interception data, and if it is intercepted, routes the SIP message to the LI-AS; or the S-CSCF receives The intercepted data is a triggering filter rule, and the S-CSCF matches the received SIP message with the filtering rule. If the matching succeeds, the SIP message is routed to the LI-AS, and the LI-AS inserts the received SIP message. Monitor information. The trigger filtering rules described herein may be obtained from the Home Subscriber Server (HSS) by the S-CSCF, as well as other initial filtering rules (iFC); or may be generated by the S-CSCF based on the interception data obtained from the law enforcement agency side.

In addition, in addition to the network access unit, the S-CSCF may delete the interception information carried in the SIP message sent to the untrusted domain network entity, and the IBCF, BGCF, I-CSCF, and MGCF as the network boundary network element may also be from the SIP. The related interception information is deleted in the message, and the deletion may be unconditional, or the SIP message may be sent to the untrusted domain to trigger the deletion.

In addition, in the packet domain, the media gateway and the Media Resource Function Processor (MRFP) are generally controlled based on the 248.248 protocol, but in some cases, they may also be controlled based on the SIP protocol. Therefore, the above SIP message carrying the interception information can also be sent to the media gateway and the MRFP, and the MRFP is sometimes called the media resource. Source server.

The following describes the specific process of transmitting legal interception information based on the network logical structure shown in FIG. 2. In this embodiment, the interception object in the IMS network is the called party, and the called party may sign different services, and each service is processed by a different AS. Here, it is assumed that the called party signs the source identifier display (OIP, Originating Identification Presentation) The service of the called party is processed by the OIPAS. Therefore, the network function entity participating in the interception object session is OIPAS, and the message related to the interception object is the request message Invite in the SIP message.

Referring to Figure 3, the specific process of transmitting legal interception information includes:

Steps 301-303, the request message Invite sent to the interception object arrives at the S-CSCF serving the interception object, and the S-CSCF expands the interception information of the interception object in the request message Invite before executing the iFC in the interception target user configuration. The S-CSCF then performs iFC to route the request message to the OIPAS;

The OIPAS provides the source identifier display service for the interception object. Therefore, when the request message is sent to the called party as the interception object, the S-CSCF serving the called party will route the request message to the OIP AS according to the iFC, in order to be able to listen. The supplementary service event provided by the OIP AS is extended to carry the interception information in the request message before the S-CSCF routes the request message to the OIPAS, and then the S-CSCF performs the iFC to route the request message to the OIP AS, such that the OIPAS You can receive the monitoring information. Therefore, OIPAS does not need to obtain monitoring data from ADMF to perform monitoring to report IRI. In other words, ADMF does not need to manage and maintain OIP AS, thus reducing the workload of ADMF to manage and maintain OIPAS.

Steps 304-307: After receiving the request message routed by the S-CSCF, the OIP AS performs the OIP service processing, and parses the request message, and reports the supplementary service event of the OIP service to the DF according to the interception information carried in the request message. And then routing the request message back to the S-CSCF serving the listener object;

Steps 308-309, after receiving the request message returned by the OIP AS, the S-CSCF according to the request message The priority of the iFC determines whether the request message needs to be routed to other ASs. It is assumed that the called party only subscribes to the OIP service. Then, the S-CSCF can determine that the request message does not need to be routed to other ASs, that is, the request message needs to be sent to the AS. Non-AS, then the S-CSCF deletes the interception information carried in the extension request message, and then routes the request message to other entities, for example, directly to the network access unit of the called party.

The AS sends the interception information to the AS in the SIP request message, and the AS reports the IRI according to the interception information carried in the SIP request message, and does not store the interception data sent by the ADMF, and the S-CSCF deletes the request message when it is sent to the non-AS. The interception information in the request message, so the possibility of data leakage can be reduced.

The process of reporting the supplementary service event by the OIP AS according to the interception information carried in the request message is described in the following example. In fact, regardless of which party is in the call, whether it is the calling party or the called party, all the S-CSCFs that arrive at the S-CSCF serving the listening object, the request message related to the listening object, the S-CSCF can The request message carries the interception information, and sends the request message to the AS specified by the iFC in the user configuration of the interception object, and also transmits the interception information to the AS, when the S-CSCF sends the request message to other untrusted domain network entities. The S-CSCF or the IBCF, the BGCF, the I-CSCF, and the MGCF as the network boundary network element delete the interception information carried in the request message. Specifically, if the intercepting object is the calling party, the network access unit that receives the interception indication that carries the interception data sent by the law enforcement agency side can be in the SIP message when the SIP message sent by the calling party arrives at the network access unit. The extension carries the monitoring information.

In addition, the embodiment shown in FIG. 3 is an example in which the request message carries the interception information. In an actual application, the response message may also be used to carry the interception information.

In the process shown in FIG. 3, the S-CSCF serving the interception object inserts and deletes the interception information in the SIP message. In specific implementation, the SIP related to the interception object may also be used. When the message arrives at the LI-AS of the listening object service, the LI-AS extends the interception information in the SIP message.

Similarly, FIG. 3 only shows the process in which the OIPAS receives the interception information carried in the SIP message and reports the IRI. In fact, the message carrying the interception information is sent to the I-CSCF, S-CSCF, AS, BGCF, MGCF, and media gateway in the trust domain. When a network entity such as MRFP is used, these network entities can report IRI to DF according to the interception information.

The above describes only the process of carrying the legal interception information in the SIP message. The following describes how to carry the interception information in the SIP message.

First, describe the interception information carried. The interception information carried in the SIP message includes an identifier of the interception object, and the identifier may be a SIP Uniform Resource Identifier (URI) or a telephone (td) Uniform Resource Locator (URL), or may be one of the specified parties in the description message. Or the flag of whether multiple parties are being monitored. The interception information may further include address information of the law enforcement agency or the interception center, the address information giving an address of the currently received IRI and/or CC, may be a routable URI, or an IP address, when reporting the IRI and/or The CC may be reported to the DF specified in the interception information according to the address information of the law enforcement agency or the interception center included in the interception information, and the address information may be a DF2 address, which is used to describe the address of the IRI receiving the interception object; or may be DF3 The address is used to describe the address of the receiving listening object CC; it can also be a combination of the DF2 address and the DF3 address. The interception information may further include a key or a certificate, and the key or the certificate is a unique identifier for confirming and receiving the interception information carried in the SIP message, that is, the interception information is confirmed to be correct and legal only when the key or the certificate matches, and the interception is received. Message. The interception information may further include canceling the interception indication information. When the AS or other entity participating in the interception object session receives the interception information carried in the message, the interception information may be saved locally in each case to avoid the repeated transmission. Next, if the interception object is unlisted, the AS or other entity participating in the interception object session deletes the interception information of the local monitor object according to the cancel monitor indication information in the interception information. The above supervision The listening message can be carried in any SIP message.

During a session, more than one network element can participate in controlling the upper limit of the CC. For example, the CC can be reported in the visited domain, or cc can be reported in the home domain. In order to reduce the number of repeated CC reports of different network elements, so as to avoid waste of media resources, the CC reporting process is generally performed only once in a session, on the premise that the CC is reported to the same DF3. The specific implementation can be as follows:

The first method is to carry only the indication for reporting the IRI in the above-mentioned monitoring information, and does not carry or delete the indication for reporting the CC, or set the indication for reporting the CC to "No". For example, in a session, the P-CSCF knows that the user has reported the CC in the visited domain, and only carries the indication of reporting the IRI in the SIP message sent by the P-CSCF, or sets the indication of reporting the CC to No, so that the home domain After receiving the SIP message, the NE will not report the CC. Of course, in the actual application, the home domain is not reported only after the domain is reported. For the reverse process, the domain is not reported after the home domain is reported, which is also within the protection scope of the present invention. Similarly, the DF2 address may be carried in the interception information without carrying the DF3 address, or the DF3 address may be deleted, or the DF3 address may be set to be invalid, etc., so that the subsequent network element does not know the DF3 address, or the received DF3. If the address is invalid, the CC cannot be reported.

The second method is to carry the CC report completion indication in the foregoing interception information, and indicate that the CC report has been completed in the current session. Further, the CC reporting completion indication may further include completing the network element reported by the CC and/or the corresponding DF3 address reported by the CC. For example, in a session, the P-CSCF knows that the user has reported the CC in the visited domain, and the SIP message sent in the sent SIP message carries the completion indication of the CC and the corresponding DF3 address, so that the network element of the home domain is received. After the SIP message, it is determined whether the DF3 address corresponding to the CC reported by the previous network element is consistent with the DF3 address corresponding to the CC reported by the local network element. If the same, the CC report is not processed; if not, the local network element is not processed. The corresponding DF3 address is reported to the CC. For example, when the DF3 address corresponding to the visited domain and the home domain is inconsistent, even if the CC has been reported in the visited domain, the home domain is processed. CC reported.

The interception information carried in the SIP message can be carried by the SIP header field or by the SIP message body. The use of the SIP header field to carry the interception information includes carrying and extending the SIP header field carrying the existing header field, and using the existing header field to carry the interception message is as follows:

The SIP header field P-Charging-Function-Address is used to transmit the allocation of the charging function address. The S-CSCF adds the message header to the request when the request message Invite arrives, and uses the extended parameter to carry the interception information in the message header. For example, use the extended parameter li-id to carry the identifier of the listener object tom@home.com, and use the extended parameter delivery-function to carry the DF address df2@lea.com,

P-Charging-Function- Address:

Li-id=tom@home.com; deli very-f unction=df 2 @ lea.com

An example of extending the SIP message header field to carry interception information is as follows:

P-LI: <sip:tom@home.com>; delivery- function=df2 @ lea.com

The extended SIP message header field P-LI carries the identifier indicating the listening object as tom@home.com; the DF address is df2@lea.com;

Or,

P-LI: orig; delivery- function=df2 @ lea.com

The P-LI header field carries the interception object identifier orig, indicating that the message sending source, that is, the calling user is monitored, and the specific listening object is the identifier of the message sending source, which can be taken from the From header field or P-Asserted-Identity. Head field, etc.

Or,

P-LI: dest; delivery- function=df2 @ lea.com

The P-LI header field carries the interception object flag dest, indicating that the called party of the message is the listener, and the specific interception object is the message destination identifier, which can be taken from the Request-URI content, the To header field, and the P - Asserted-Identity header field or P-Called-Party-ID Header field, etc.

An example of canceling the monitoring indication information is as follows:

P-LI: dest; cancel

The above-mentioned P-LI header field carries the interception object flag dest and the cancel cancel indication flag cancel, indicating that the message destination is canceled.

An example of a key or certificate is as follows:

P-LI: key= "6629fae49393a05397450978507c4efl"

The key in the P-LI header field is the key of the interception information or the key value of the certificate. After the entity participating in the interception object receives the message carrying the interception information, the key or certificate key value of the interception information carried in the message is The correctness and legality of the interception information carried in the message are confirmed according to a previously agreed algorithm or other manner, and the processing described in the present invention is further performed according to the interception information.

Using the SIP message body to carry the interception message usually carries the interception information by inserting a type of MIME (Multipurpose Internet Mail Extensions) type including a type name, a subtype name, a required parameter, and a decoding type in the SIP message body. And the interception information can be described in the Extended Markup Language (XML).

Referring to FIG. 2 and FIG. 3, the process of inserting a snoop message into a SIP message, passing it to an AS or other network element participating in the interception object session, and reporting the IRI by the AS or other network element participating in the interception object session is actually described in detail. Other network function entities participating in the interception object session do not always participate in the interception object session in the SIP protocol, such as a GPRS Gateway Support Node (GGSN), a Border Gateway Function (BGF), including The gateway of the residential gateway and the access gateway can obtain the interception information by transmitting the interception information in the non-SIP protocol message related to the interception object, and then report the IRI and/or CC, and the non-SIP protocol messages can be diameters ( Diameter) message or H.248 message or public open policy service protocol message (COPS, Common Open Policy Service protocol).

In fact, in the network structure shown in FIG. 2, only the transmission of signaling messages is considered, and the content of the call when the terminal is in a call, including media streams such as voice and video, is respectively passed through the BGF according to the type of the terminal. A functional entity such as a GGSN or a gateway accesses the network. Referring to FIG. 4, FIG. 4 illustrates a logical structure of a normal interception network involved in listening to an object media stream according to an embodiment of the present invention. An application function entity (AF), such as a P-CSCF, or an Interconnection Border Control Function (IBCF), or an AGCF, determines the size of the terminal call media stream according to the signaling message, and sends a message to notify the service policy decision function ( SPDF (Service Policy Decision Function) or Policy Decision Function (PDF), which sends a message to the BGF, GGSN or gateway by SPDF or PDF to allocate the appropriate bandwidth to the terminal. Since BGF or other gateways are all types of media gateways (MGs, Media Gateways), BGFs, gateways, etc. are collectively referred to as media gateways. The interface protocol between AF and SPDF or PDF is Diameter protocol, and the Diameter message is transmitted; the interface protocol between SPDF and media gateway is H.248 protocol, and H.248 message is transmitted; the interface protocol between PDF and GGSN is COPS protocol. , Pass the COPS message.

In this case, the AF extends the carrying information in the Diameter message sent to the SPDF or PDF to transmit the monitoring information to the SPDF or PDF, and further expands the carrying information in the H.248 message or the COPS message by the SPDF or the PDF. The BGF, the GGSN, or the gateway, the BGF, the GGSN, or the gateway monitors the intercepted object. Since the media stream of the terminal call passes through the BGF, the GGSN, or the gateway, the BGF, the GGSN, or the gateway can not only report the IRI but also report the CC. In addition, similarly, for the terminal accessed through the AGCF, the AGCF can carry the interception information to the gateway in the H.248 message when interacting with the gateway, and the gateway reports the IRI and/or according to the interception information in the H.248 message. CC to DF. Therefore, the message related to the interception object includes a Diameter message, an H.248 message, and a COPS message, and the network function entity participating in the interception object session is a BGF, a GGSN, or a gateway. MRFP is also available The interception information is obtained by extending the H.248 message carrying the interception information. For example, when the session of the interception object needs to use the resource on the MRFP, the media resource function controller MRFC transmits the interception information to the MRFP through the H.248 message, and the MRFP reports the IRI and/or CC according to the interception information in the H.248 message. Give DF.

As can be seen from the above description, the interception information may further include an indication of reporting the IRI and/or the CC, indicating whether the current monitoring needs to report the IRI and/or the CC; and further including a DF address, the DF address including the DF2 address and the DF3 address, respectively Corresponding to the address of the reported IRI and the address of the CC, the DF2 address and the DF3 address can both be URIs or IP addresses.

Specifically, an example of extending the interception information in the H.248 message is as follows:

To extend the carrying of the interception information, the interception information packet needs to be defined. The interception information packet defined here includes the interception information packet identifier (ID) and the attribute, and the attributes include: the interception object identifier, and may further include a DF2 address and/or a DF3 address, and report IRI and/or CC indication, key or certificate, canceled listening indication information, etc. The listening object identifier is used to describe the user identity of the listening object, which may be a SIP URI or a td URL. The DF2 address is used to describe the address of the IRI output of the listening object, which may be a URI or an IP address; DF3 address The address used to describe the output of the listening object CC, which can be either a URI or an IP address.

The extension carrying the interception information in the Diameter message can be implemented by extending the Diameter attribute value pair (AVP) to carry the interception information during the session. The AVP includes the attribute name, attribute code, and attribute value type. The specific AVP format can include the listener object identifier, the DF2 address, and/or the DF3 address.

To extend the carrying of the interception information in the COPS message, the 3GPP can be extended to the Policy Information Base (PIB) defined by the Go interface between the PDF and the GGSN. For example, the interception information is defined as a COPS proprietary object, including the interception object identifier. , DF2 address and / or DF3 address, etc. Listening to information specific objects are sent to the GGSN in PDF Carry in the message.

It can be seen that the contents of the interception information transmitted in the SIP message, the Diameter message, the H.248 message, and the COPS message are the same, except that the format of the message is different.

The embodiment of the present invention sets an apparatus for transmitting a lawful interception message in a network function entity participating in a listening object session, and the apparatus includes the following modules:

When the message related to the interception object is a SIP message, the network function entity participating in the interception object session is an AS, an I-CSCF, an IBCF, a BGCF, an MGCF, a media gateway, or

MRFP;

When the message related to the interception object is a Diameter message, the network function entity is SPDF or PDF;

When the message related to the interception object is an H.248 message, the network function entity is a media gateway or an MRFP;

When the message related to the interception object is a COPS message, the network function entity is a GGSN.

The device may further comprise:

a monitoring information deleting module, configured to: before the network function entity sends the message related to the intercepting object to the untrusted domain entity, if yes, delete the message related to the intercepting object Monitor information.

If the interception information includes an indication of reporting a CC and/or a DF3 address, the apparatus further includes: The CC reporting indication setting module is configured to delete the indication of reporting the CC in the monitoring information, set the indication of reporting the CC to No, delete the DF3 address in the monitoring information, or set the DF3 address to be invalid;

The CC reporting indication determining module is configured to determine, according to the interception information parsed by the interception information parsing module, whether the intercepted message meets any of the following conditions:

If the indication of the CC is not reported, the indication of the CC is no, the DF3 address or the DF3 address is invalid. If yes, the indication is not sent to the reporting module.

Alternatively, the CC reporting indication setting module and the CC reporting indication determining module implement the following functions:

The CC report indication determining module is configured to determine, according to the interception information parsed by the interception information parsing module, whether the CC report completion indication is set to Yes in the snoop message, and if yes, send an indication that the CC is not reported to the reporting module. If not, notifying the CC reporting indication setting module to set the CC reporting completion indication to Yes;

The CC report indication setting module is configured to set the CC report completion indication in the interception message to Yes according to the notification of the CC report indication module.

The process of transmitting the lawful interception information of the present invention is described above with reference to the accompanying drawings in conjunction with the specific embodiments. It can be seen from the above description that the embodiment of the present invention extends the carrying of the interception information in the message related to the interception object, and transmits the interception while transmitting the message. The message is sent to the network function entity participating in the listening object session, so that the network function entity can listen to the monitoring object according to the transmitted monitoring information, and report the IRI and/or CC to the law enforcement agency side. Therefore, this approach can reduce the likelihood of data breaches while reducing the burden on the law enforcement agency side. In addition, since the message related to the interception object is sent to the network function entity that does not perform the interception, the interception information carried in the message related to the interception object is deleted, so that the possibility that the interception information is leaked is reduced, and the security of the monitoring is improved. Sex.

The above is a description of a specific embodiment of the present invention, and the present invention can be used in the specific implementation process. The method of Ming is appropriately modified to suit the specific needs of the specific situation. Therefore, it is to be understood that the specific embodiments of the present invention are not intended to limit the scope of the invention.

Claims

Claim

A method for transmitting legal interception information, the method comprising: the network function entity participating in the interception object session receiving a message related to the interception object carrying the interception information;

The method according to claim 1, wherein the message related to the interception object is a Session Initiation Protocol SIP message.

The method according to claim 2, wherein the network function entity is an application server AS, an inquiry call session control function I-CSCF, an interworking boundary control function IBCF, an egress gateway control function BGCF, and a media gateway control. One or any combination of the function MGCF, the media gateway, the media resource function processor MRFP.

The method according to claim 2, wherein before the network function entity receives the message related to the interception object and carrying the interception information, the method further includes:

The service call session control function S-CSCF carries the interception information in the SIP message related to the interception object, and sends the SIP message to the network function entity;

Alternatively, the S-CSCF sends the SIP message related to the interception object to the lawful interception service application server LI-AS, and the LI-AS carries the interception information in the SIP message, and then sends the interception information to the S-CSCF; the S-CSCF will The SIP message is sent to the network function entity.

The method according to claim 4, wherein when the interception object is the calling party, the carrying the interception information in the message related to the interception object includes:

The network access unit carries the interception information in the SIP message related to the interception object.

The method according to claim 2, wherein the method further comprises: deleting the SIP message before sending the SIP message to the untrusted domain network entity With monitoring information.

The method according to claim 6, wherein the entity for deleting the interception information carried in the SIP message comprises a network access unit, an S-CSCF, an I-CSCF, an IBCF, a BGCF or an MGCF.

The method according to any one of claims 2 to 7, wherein the carrying the interception information in the SIP message comprises:

The SIP header field carries the interception information or uses the SIP message body to carry the interception information.

The method according to claim 1, wherein the message related to the interception object comprises a Diameter Diameter message, or an H.248 message, or a public open policy service protocol message COPS message.

The method according to claim 9, wherein, when the message related to the interception object is a Diameter message, the network function entity is a service policy decision function SPDF or a policy decision function PDF;

When the message related to the interception object is a COPS message, the network function entity is a GPRS gateway support node GGSN.

The method according to claim 9, wherein the carrying the interception information in the message related to the interception object comprises:

When the message related to the interception object is a Diameter message, the application function AF entity carries the interception information in the Diameter message and sends it to the service policy decision function SPDF or the policy decision function PDF;

When the message related to the interception object is an H.248 message, the SPDF or the PDF or the MGCF carries the interception information to the media gateway in the H.248 message, or the media resource function controller MRFC carries the interception in the H.248 message. Information is sent to the MRFP; When the message related to the interception object is a COPS message, the PDF carries the interception information in the COPS message and sends the information to the GGSN.

The method according to claim 11, wherein the application function entity is a proxy call session control function entity P-CSCF or an interworking boundary control function entity IBCF or an access gateway control function AGCF.

The method according to any one of claims 1 to 7, 9 to 11, wherein the interception information comprises: an identifier of a listening object.

The method according to claim 13, wherein the identifier of the interception object is composed of one or a combination of a SIP uniform resource identifier, a telephone uniform resource locator, and one or more monitored symbols.

The method according to claim 13, wherein the monitoring information further comprises:

Report an IRI and/or CC indication, forward a functional entity DF address, a key or certificate, cancel one of the listening instructions, or any combination.

16. The method of claim 15, wherein the DF address comprises a DF2 address and/or a DF3 address.

The method according to claim 15, wherein the reporting, by the network function entity, the CC further comprises:

After the network function entity reports the CC to the law enforcement agency, it indicates that the subsequent network function entity does not need to report the CC again.

The method according to claim 17, wherein the method for indicating that the subsequent network function entity does not need to report the CC again includes:

The network function entity deletes the indication of reporting the CC in the interception information, sets the indication of reporting the CC to No, deletes the DF3 address in the interception information, or sets the DF3 address to be invalid; Then, after receiving the interception information, the subsequent network function entity does not report the CC.

The network function entity sets the CC report completion indication in the interception information to be YES; and the subsequent network function entity does not report the CC after receiving the interception information.

The method according to claim 19, wherein the CC reporting is completed.

An apparatus for transmitting a lawful interception message, wherein the apparatus is disposed in a network function entity participating in a listening object session, and includes the following modules:

The device according to claim 21, wherein, when the message related to the interception object is a SIP message, the network function entities participating in the interception object session are AS, I-CSCF, IBCF, BGCF, MGCF , media gateway or MRFP;

The device according to claim 21, further comprising: a monitoring information deleting module, configured to: when the network function entity compares the listening object Before the off message is sent out, it is judged whether it is to be sent to the untrusted domain entity, and if so, the interception information in the message related to the interception object is deleted.

The device according to claim 21, 22 or 23, wherein the monitoring information includes an indication of reporting CC and/or a DF3 address, the device further comprising:

The CC report indication setting module is configured to delete the indication of reporting the CC in the monitoring information, set the indication of reporting the CC to No, delete the DF3 address in the monitoring information, or set the DF3 address to be invalid.

The device according to claim 24, further comprising: a CC report indication determining module, configured to determine, according to the interception information parsed by the interception information parsing module, whether the snoop message conforms to any of the following Situation:

The device according to claim 21, 22 or 23, wherein the device further comprises a CC reporting indication setting module and a CC reporting indication determining module,

The CC report indication determining module is configured to determine, according to the interception information parsed by the interception information parsing module, whether the CC report completion indication is set to Yes in the snoop message, and if yes, send the CC that does not report to the reporting module. Instructing, if not, notifying the CC reporting indication setting module to set the CC reporting completion indication to Yes;