WO2008131665A1

WO2008131665A1 - Lawful interception method, communication system, router and interception gateway

Info

Publication number: WO2008131665A1
Application number: PCT/CN2008/070539
Authority: WO
Inventors: Zhuoming Li
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-04-28
Filing date: 2008-03-20
Publication date: 2008-11-06
Also published as: CN101296270B; CN101296270A

Abstract

A lawful interception method and communication system thereof, a Label Switching Router and an interception gateway are provided. The lawful interception method includes steps: a boundary Label Switching Router receiving interception data as an interception access point, and obtaining an interception identification corresponding to the interception data; determining the corresponding Forwarding Equivalence Class according to the interception identification, in which the destination address of Forwarding Equivalence Class is the interception gateway; sending the interception data to the interception gateway through label switching path corresponding to the Forwarding Equivalence Class.

Description

Method for legal monitoring, communication system, router and monitoring gateway This application claims to be submitted to the Chinese Patent Office on April 28, 2007, the application number is 200710074168.7, and the invention name is "legal monitoring method, communication system, router and monitoring gateway". Priority of Chinese Patent Application, the entire contents of which is incorporated herein by reference.

Technical field

The present invention relates to the field of communication technologies, and in particular, to a lawful interception method, a communication system, a router, and a interception gateway.

Background technique

Lawful interception refers to the activities of the law enforcement agency to monitor the communication service of a specific target user within the scope of legal authorization. According to national laws and regulations, all operating communication networks must enable the national security agencies, judicial investigation agencies, police stations and other law enforcement agencies to conduct lawful interception of specific target users. The carrier's communication network equipment needs to provide an interface for legitimate interception. The interception gateway is a function that must be provided at the required time according to national laws and regulations. In some countries, these functions are integrated into the legal enforcement agency domain where the monitoring center is located.

With the development of data communication networks such as the Internet, especially the popularization of VoIP (voice over IP) technology, people's means of communication are becoming more and more abundant. It is not limited to the traditional circuit-switched network, and the national law enforcement agencies are not only fixed and mobile. In addition to lawful interception on the telephone network, it is increasingly necessary to perform lawful interception on a packet switched network such as the Internet.

As shown in Figure 1, it is a network structure diagram of an existing lawful interception system. The interception access point (IAP) function is integrated in the ingress router LER1 of the user access backbone network, and the interception gateway 11 can set the interception target parameter to the IAP in the ingress router LER1, for example, the login user name of the target 12 is monitored. IP address, protocol type, port number, etc. The ingress router LER1 filters all traffic flowing through it. For some specific services, it needs to go deep into the packet for deep filtering. If the filtered data matches the interception target parameter, the ingress router LER1 copies the IP packet, and transmits the copied IP packet to the Transmission Control Protocol (TCP) while the original IP packet is normally delivered. Or the user data UDP (User Datagram Protocol) packet, the IP address of the listening gateway 11 is used as the destination address of the re-encapsulated packet. If the network is carried on the MPLS network, the ingress router is re-based. The destination IP address of the encapsulated text, mapping the interception data to the destination address of the interception gateway 11. The corresponding forwarding equivalence class is forwarded to the access router LER2 connected to the interception gateway 11 through the label switching path. After receiving the interception data, the access router LER2 sends the interception data to the interception gateway 11 according to the destination address of the interception data. After receiving the interception data, the interception gateway 11 performs necessary processing, and then transmits the monitor data to the interception center 10.

2 is a structural diagram of a unit of a conventional label switching router for processing a lawful intercepting portion. The existing label switching router processes a legal listening data portion including a monitoring target management unit 21, a monitoring trigger unit 22, a monitoring copy unit 23, and a monitoring processing unit 24. And transmitting unit 25. The monitoring target management unit 21 is configured to receive the monitoring command and set the monitoring target parameter to the monitoring triggering unit 22; the monitoring triggering unit 22 is configured to filter the received data, and send the filtered monitoring data to the monitoring and copying unit 23 to monitor The copying unit 23 is configured to copy the listening data, forward the original listening data according to the normal process, and send the copied monitoring data to the monitoring processing unit 24, and the monitoring processing unit 24 is configured to encapsulate the monitoring data and encapsulate the data in the TCP or UDP message. And sending the encapsulated interception data to the sending unit 25 by using the IP address of the intercepting gateway as the destination IP address, and the sending unit 25 maps the intercepting data to the address of the intercepting gateway according to the destination address encapsulated by the intercepting processing unit 24 for the intercepting data. The corresponding forwarding equivalence class is sent to the transport network by forwarding the label switching path corresponding to the equivalence class.

During the work process, the inventor found that the lawful interception method has at least the following problems: The ingress router often provides services for many users, and the data traffic is very large. When performing the lawful interception function, the filtered listener data needs to be repackaged. The IP address of the address to the listening gateway is complicated, and it takes up more ingress router resources.

Summary of the invention

Embodiments of the present invention provide a lawful interception method, a communication system, a router, and a snooping gateway, which can reduce the complexity of the ingress router performing a lawful interception function.

An embodiment of the present invention provides a method for lawful interception, including:

The border label switching router as the interception access point receives the interception data and obtains a monitor flag corresponding to the interception data;

Determining, according to the interception flag, a corresponding forwarding equivalence class, where the destination address of the forwarding equivalence class is a interception gateway;

Sending the interception data to the interception network through a label switching path corresponding to the forwarding equivalence class turn off.

Embodiments of the present invention provide a communication system, the system comprising:

a border label switching router as a listening access point, configured to receive the monitoring data, and obtain a monitoring flag corresponding to the monitoring data; determine a corresponding forwarding equivalence class according to the monitoring flag; and compare the monitoring data by the forwarding The label switching path corresponding to the class is sent to the intercepting gateway; the destination address of the forwarding equivalence class is the intercepting gateway;

The intercepting gateway is configured to receive the intercepting data from the label switching path, where the intercepting data includes a flag that the last hop label switching router encapsulates for the listening data.

An embodiment of the present invention provides a label switching router, including:

a receiving unit, configured to receive monitoring data;

An obtaining unit, configured to acquire a listening flag corresponding to the intercepting data and a forwarding equivalence class corresponding to the monitoring flag;

And a sending unit, configured to send the intercepting data according to a label switching path corresponding to the forwarding equivalence class determined by the acquiring unit.

An embodiment of the present invention provides a monitoring gateway, including:

a label switching unit, configured to establish a label switching path with the border label switching router, a monitoring data receiving unit, configured to receive the monitoring data by using the label switching path, and a data processing unit, configured to receive the monitoring received by the monitoring data receiving unit The data is processed.

DRAWINGS

Figure 1 is a network architecture diagram of an existing lawful interception system.

2 is a structural diagram of a unit of a conventional border label switching router processing a lawful interception portion. FIG. 3 is a schematic diagram of networking of a lawful interception system in an embodiment of the present invention.

4 is a schematic flow chart of a lawful interception method in an embodiment of the present invention.

FIG. 5 is a schematic flow chart of a lawful interception method according to another embodiment of the present invention.

Figure 6 is a block diagram showing the structure of a router in the embodiment of the present invention.

FIG. 7 is a structural diagram of a unit of another router in the embodiment of the present invention.

FIG. 8 is a structural diagram of a unit of a monitoring gateway in an embodiment of the present invention.

FIG. 9 is a structural diagram of a unit of a listening gateway according to another embodiment of the present invention. detailed description

The present invention will be further described in detail below with reference to the drawings and specific embodiments.

Multi-Protocol Label Switch (MPLS) is a rapidly developing data communication technology in recent years. MPLS provides broadband high-speed switching for the network layer, which greatly improves the transmission performance and bandwidth of the network. The fundamental idea of MPLS is to move the router to the edge of the network, put a fast and simple switching device in the network center, integrate the basic technology of label switching and forwarding data and network layer routing, and implement a routing request for one connection request. Secondary exchange.

The basic principles of MPLS technology are:

The Label Switching Router (LSR) groups data streams according to certain policies. This subset of packets is called Forwarding Equivalence Class (FEC). The existing criteria for dividing FEC are generally based on data. The network layer destination address is used, and each forwarding equivalence class is assigned a unique tag value. This process is called tag allocation. The router performs the same processing on the packet data of the same forwarding equivalence class, for example, to the same next hop router; the label switching router distributes the binding information of the tag value and the forwarding equivalence class to the upstream and downstream label switching routers. This process is called tag distribution. Through tag distribution, the entire MPLS network establishes an interconnected label switched path.

Each label switching router maintains two tables, one for forwarding the mapping table between the equivalence class and the tag, and the other for the forwarding table. The simplified format of the forwarding table is:

When a marked packet enters the label switching router, the label switching router retrieves the forwarding table according to the marking information carried by the packet header, that is, looks up the entry in the forwarding table whose entry label is equal to the label carried by the packet, and after retrieving, the packet header is The originally carried tag pops up, and the egress tag corresponding to the entry tag in the forwarding table is pushed into the packet as a new tag, and the packet is forwarded to the corresponding output port and sent to the next hop address. The process of popping the original markup and pushing in the new mark is called markup. Through this process, the entire packet is switched to the corresponding output port according to the marked of the packet.

The embodiment of the present invention provides a lawful interception party according to the basic principle of MPLS technology. Laws, communication systems, routers, and listening gateways to reduce the complexity of the ingress router performing lawful interception.

3 is a schematic diagram of networking of a lawful interception system according to an embodiment of the present invention, where user T is a monitoring target, user C is a communication peer of user T, and LER1 and LER2 are border label switching routers, wherein LER1 is a listening access point. The LIG is a monitoring gateway located at the boundary of the core network (ie, MPLS network), and has a label switching path with LER1 and LER2. LSR1, LSR2 and LSR3 are label switching routers carrying the MPLS network.

FIG. 4 is a schematic flowchart of a lawful interception method according to an embodiment of the present invention, which is described in conjunction with FIG. 3. The embodiment of the present invention requires that all the communication traffic of the user T be monitored. The steps of the lawful interception method in this embodiment include:

511. LER1 establishes a forwarding equivalence class whose destination address is LIG, allocates a label for the forwarding equivalence class, and establishes a label switching path corresponding to the forwarding equivalence class by using a label allocation and a label distribution process;

512. The LER1 uses the data structure to establish a mapping relationship between the interception flag and the forwarding equivalence class whose destination address is LIG. The interception flag may be a special identifier, and the mapping is established by using a two-dimensional or multi-dimensional table and the forwarding equivalence class;

513. The LIG sends a interception command to the border router LER1, and requests to listen to all communication traffic of the user T.

514. The LER1 receives the interception command, adds the IP address of the source IP address to the IP address, the destination IP address, and the filtering parameter of the IP address of the destination IP address and the source IP address to the access control list, and access control. Set the listener flag in the list;

515. The LER1 receives the uplink and downlink data, filters the flow data through the access control list, filters the data to the interception data, and directly reads the monitoring flag corresponding to the monitoring data in the access control list, or sends a command to the unit that manages the access control list. The message returns the interception flag by the unit that manages the access control list, and copies the interception data, one of which is forwarded according to the normal process, and the other reads the corresponding forwarding equivalence class in the two-dimensional or multi-dimensional table according to the interception flag. Or sending a command to the unit managing the aforementioned two-dimensional or multi-dimensional table, and returning the corresponding forwarding equivalence class by the unit managing the aforementioned two-dimensional or multi-dimensional table;

516. The LER1 intercepts the data by using a label corresponding to the forwarding equivalence class whose destination address is LIG. Change the path and send the monitoring data to the LIG;

S17. The LIG receives the monitoring data, processes the monitoring data, and distributes it to the monitoring center. In the above steps, the interception flag may also be a pointer to the forwarding equivalence class whose destination address is LIG, so that the forwarding equivalence class whose destination address is LIG pointed to by the pointer can be obtained by listening to the flag.

In the technical solution of the embodiment, the ingress router (ie, the border label switching router) establishes a forwarding equivalence class whose destination address is a lawful interception gateway, a label switching path corresponding to the forwarding equivalence class, and a interception flag and the forwarding. The mapping relationship between the equivalence classes, and setting the interception flag in the access control list, filtering the flow data through the access control list, so that the forwarding equivalence class corresponding to the interception flag can be obtained according to the interception flag in the access control list. The interception data is sent to the lawful interception gateway through the label switching path corresponding to the forwarding equivalence class. This solution simplifies the process of processing the interception data by the ingress router, reduces the burden on the network device for legitimate interception processing, and reduces the complexity of the system. The network device only adds the monitoring processing flow in the original forwarding processing flow, and the monitoring processing flow and the standard forwarding processing flow are consistent in the processing action, and it is no longer necessary to design a special monitoring triggering and processing part for the network device, especially Avoid designing specialized hardware parts for the listening function.

FIG. 5 is a schematic flow chart of a lawful interception method according to another embodiment of the present invention, which is described in conjunction with FIG. 3. The embodiment of the present invention requires that all communication traffic of the user T be monitored. The processing of the uplink traffic and the downlink traffic in the embodiment of the present invention is separately described.

The specific steps of the lawful interception method for the uplink traffic processing in the embodiment of the present invention are:

521, LER1 establishes a forwarding equivalence class whose destination address is LIG, allocates a label for the forwarding equivalence class, and establishes a label switching path corresponding to the forwarding equivalence class by using a label allocation and a label distribution process;

522. Using a data structure to establish a mapping relationship between the interception flag and the forwarding equivalence class of the LIG, the interception flag may be a special identifier, and the mapping is established by using a two-dimensional or multi-dimensional table and the forwarding equivalence class;

523. The LIG sends a interception command to the border router LER1, and requests to listen to all communication traffic of the user T.

524. The LER1 receives the interception command, as shown in FIG. 5, the IP address whose source IP address is T, The destination IP address is arbitrary, and the filtering parameters of the IP address of the destination IP address and the source IP address are added to the access control list, and the interception flag is set in the access control list;

525. The LER1 receives the uplink data, filters the uplink data through the access control list, obtains the interception flag, and uses the mapping relationship between the monitored monitoring data and the forwarding equivalence class to the destination address LIG according to the intercepted flag. The corresponding interception data is mapped to the forwarding equivalence class whose destination address is LIG;

526. The LER1 sends the interception data to the LIG through the label switching path corresponding to the forwarding equivalence class whose destination address is LIG.

527. After receiving the monitoring data, the LIG copies the monitoring data, and the IP address of the user C according to the destination address of the monitoring data, selects the label switching path between the LIG and the LER2, and sends the monitoring data to the LER2, and the other The analysis is processed and distributed to each monitoring center.

After receiving the interception data, LER2 sends the interception data to user C according to the destination IP address of the intercepted data.

The steps of the lawful interception method for processing downlink traffic in the embodiment of the present invention include:

1. LER1 establishes a forwarding equivalence class whose destination address is LIG, allocates a tag for the forwarding equivalence class, and establishes a tag switching path corresponding to the forwarding equivalence class by using a tag allocation and a tag distribution process;

2. LER1 establishes a mapping relationship between the interception flag and the forwarding equivalence class to the destination address LIG;

3. The LIG sends a listening command to the border router LER1, and requests to listen to all communication traffic of the user T;

4. The LER1 receives the interception command. As shown in Figure 5, the IP address of the source IP address, the destination IP address, and the IP address of the destination IP address and the source IP address are added to the access control list. And set the listener flag in the access control list;

5. The LER1 receives the downlink data, filters the downlink data through the access control list, obtains the interception flag, and displays the intercepted flag according to the mapping relationship between the interception flag and the forwarding equivalence class to the destination address LIG. The corresponding interception data is mapped to the forwarding equivalence class whose destination address is LIG;

6. The LER1 will listen to the data through the label switching path corresponding to the forwarding equivalence class of the LIG, and send the intercepting data to the LIG; 7. After receiving the monitoring data, the LIG copies the monitoring data, and selects a label switching path between the LIG and the LER1 according to the destination address of the monitoring data, that is, the IP address of the user T, and the LIG adds the monitoring data sent to the LER1. Special tag, send the monitoring data to LER1, and the other one is analyzed and distributed to each monitoring center;

8. After receiving the data sent by the LIG, the LER1 first detects whether the data carries the special tag. If the special tag is detected, the intercepted data is directly sent to the user τ according to the destination IP address of the intercepted data.

More specifically, a multi-protocol label switching virtual private network technology can be used to establish a virtual private network between LER1 and LIG, and a multi-protocol label switching virtual private network uses a label stack technology, at the innermost layer of the label stack (ie, the bottom of the stack) ) is a mark distributed within the scope of the virtual private network, called the bottom mark, and the outer layer is the mark distributed throughout the network, used to forward along the mark exchange path in the network. The identification information of the virtual private network is included in the bottom of the stack. Then, in the above step 7, the special flag added by the LIG to the interception data may be the bottom mark of the virtual private network between the LIG and the LER1.

In this embodiment, the manner of obtaining the monitoring flag and determining the corresponding forwarding equivalence class according to the monitoring flag may refer to the previous embodiment.

In this embodiment, by monitoring the target traffic back to the monitoring gateway, the monitoring gateway completes the replication of the target traffic, which further simplifies the function of the monitoring access point of the network device. Although the interaction between the router as the interception access point and the interception gateway is increased, the process of performing the lawful interception by the router is basically the same as the process of forwarding the normal data traffic, and can be integrated into the normal data traffic processing process, so that the router can be utilized. The advantages of high-performance dedicated hardware enable high-speed processing, eliminating the need to implement complex monitoring traffic replication and packet delivery processing. This greatly reduces the processing burden of network devices such as routers performing lawful interception and ensures service processing performance.

The border label switching router pre-establishes a label forwarding path to the intercepting gateway through the label distribution and determines a forwarding equivalence class using the label forwarding path, because the border label switching router maps the listening flag and the forwarding equivalence class, so The monitoring target traffic is sent to the label forwarding path, and the monitoring gateway must pass through the monitoring gateway in the process of forwarding in the MPLS network, so that the border router no longer needs to use a special mechanism to ensure that the monitoring traffic is reliably delivered to the monitoring center, thereby further simplifying the network. The processing mechanism of the device's lawful interception improves the reliability of the interception data transmission.

One of ordinary skill in the art can understand all or part of the steps in implementing the above embodiments. The program can be completed by instructing related hardware, and the program can be stored in a computer readable storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, or the like.

An embodiment of the present invention provides a communication system, including a border label switching router and a monitoring gateway as a listening access point, where

a border label switching router as a listening access point, configured to receive the monitoring data, obtain a monitoring flag corresponding to the monitoring data, and copy the monitoring data; determine a corresponding forwarding equivalence class according to the monitoring flag, and the destination address of the forwarding equivalence class is The monitoring gateway sends the intercepted data to the intercepting gateway through the label switching path corresponding to the forwarding equivalence class, and forwards the original monitoring data according to a normal process; and the monitoring gateway is configured to receive the monitoring data from the label switching path. The monitoring data includes a flag of the last hop label switching router for intercepting the data packet, processing the monitoring data, and transmitting the processed monitoring result to the monitoring center.

The border label switching router, which is a listening access point, is further configured to establish a forwarding equivalence class whose destination address is a listening gateway, allocate a label for the forwarding equivalence class, and establish the forwarding equivalence class corresponding by the label distribution process. Labeling the path, and establishing a mapping relationship between the interception flag and the forwarding equivalence class of the interception gateway.

An embodiment of the present invention provides another communication system including a border label switching router and a listening gateway as a listening access point, wherein

A border label switching router, which is used as a monitoring access point, is configured to receive the monitoring data, obtain a monitoring flag corresponding to the monitoring data, determine a corresponding forwarding equivalence class according to the monitoring flag, and exchange the monitoring data through the label corresponding to the forwarding equivalence class. The path is sent to the listening gateway;

a monitoring gateway, configured to establish a label switching path between the border label switching routers, and receive the monitoring data from the label switching path, where the monitoring data includes a label that is encapsulated by the last hop label switching router for listening data, and the monitoring is copied. Data, one of the interception data is sent to the border label switching router through the label switching path corresponding to the destination address of the monitoring data, and another listening data is processed and sent to the monitoring center, if the border label switching router is used as a monitor The border of the access point is marked as a switching router, and the intercepting gateway is further configured to add a special flag to the sent intercepting data.

The border label switching router, which is a listening access point, is further configured to establish a forwarding equivalence class whose destination address is a intercepting gateway, assign a label to the forwarding equivalence class, and establish the Forwarding the label switching path corresponding to the equivalence class, and establishing a mapping relationship between the interception flag and the forwarding equivalence class of the interception gateway.

The border label switching router as the intercepting access point is further configured to detect whether the intercepting data sent by the intercepting gateway carries the special tag, and if the data carries the special tag, the intercepting data is in accordance with a normal process. Forward.

In the above two embodiments, the specific implementation of obtaining the interception flag and determining the corresponding forwarding equivalence class according to the interception flag may refer to the above method embodiment.

The system of the embodiment of the present invention only needs to include a monitoring processing flow in the forwarding processing flow of the original network device, and the monitoring processing flow and the standard forwarding processing flow are consistent in processing actions, and no need to design for the network device. The special monitoring triggering and processing part, in particular, avoids the need to design a special hardware part for the listening function, so that the network device can perform the legal monitoring function complexity.

FIG. 6 is a structural diagram of a unit for legally listening to a relevant part of a router according to an embodiment of the present invention. As shown in FIG. 6, the router has a label switching function, including:

The path establishing unit 61 is configured to establish a forwarding equivalence class whose destination address is a lawful interception gateway, allocate a label for the forwarding equivalence class, and establish a label switching path corresponding to the forwarding equivalence class by using label distribution;

The mapping unit 62 is configured to establish a mapping relationship between the interception flag and the forwarding equivalence class whose destination address is a lawful interception gateway;

The receiving unit 63 is configured to receive the monitoring data, and send the monitoring data to the copying unit 64; the copying unit 64 is configured to copy the monitoring data, one of which is forwarded according to a normal process, and the other is sent to the sending unit 65;

The obtaining unit 66 is configured to obtain a monitoring flag corresponding to the monitoring data, and obtain a forwarding equivalence class corresponding to the monitoring flag according to the monitoring flag and the mapping relationship established by the mapping unit, where the destination address of the forwarding equivalence class is a legal listening gateway ;

The sending unit 65 is configured to send the interception data according to the label switching path corresponding to the forwarding equivalence class determined by the obtaining unit 66.

The specific implementation manners of the obtaining unit 66 and the mapping unit 62 in this embodiment may refer to the description in the method embodiment.

The router in the embodiment of the present invention establishes a forwarding equivalence class of the lawful interception gateway by establishing a destination address, a label switching path corresponding to the forwarding equivalence class, and a mapping relationship between the interception flag and the forwarding equivalence class, and setting the interception flag in the access control list, filtering the flow data through the access control list, thereby The forwarding equivalence class corresponding to the interception flag may be obtained according to the interception flag in the access control list, and the interception data is sent to the legal interception gateway by using the label exchange path corresponding to the forwarding equivalence class. The overhead of re-encapsulating TCP or UDP packets for the interception data in the prior art is avoided, and the overhead of performing fragmentation on the border label switching router and performing fragment reassembly on the interception gateway is avoided.

FIG. 7 is a structural diagram of a unit of another router legally listening to a relevant part in the embodiment of the present invention. As shown in FIG. 6, the router has a label switching function, including:

The path establishing unit 71 is configured to establish a forwarding equivalence class whose destination address is a lawful interception gateway, allocate a label for the forwarding equivalence class, and establish a label switching path corresponding to the forwarding equivalence class by using label distribution;

The mapping unit 72 is configured to establish a mapping relationship between the interception flag and the forwarding equivalence class whose destination address is a lawful interception gateway;

The receiving unit 73 is configured to receive the monitoring data, and send the monitoring data to the sending unit 75. The acquiring unit 76 is configured to acquire the monitoring flag corresponding to the monitoring data, and obtain the monitoring flag according to the monitoring flag and the mapping relationship established by the mapping unit 72. Forwarding equivalence class, the destination address of the forwarding equivalence class is a lawful interception gateway;

The sending unit 75 is configured to send the monitoring data according to the label switching path corresponding to the forwarding equivalence class determined by the obtaining unit 76.

The receiving unit 73 may further include a special tag detecting module 731 and a forwarding unit 732, and the special tag detecting module 731 is configured to detect whether the intercepting data sent by the legal intercepting gateway has a special tag added by the legal intercepting gateway for the monitoring data, if the monitoring The data detection has the special flag, and the forwarding unit 732 forwards the data according to the normal flow. The description in the example.

FIG. 8 is a structural diagram of a unit of a monitoring gateway according to an embodiment of the present invention. As shown in FIG. 8, the monitoring gateway includes:

a label switching unit 81, configured to establish a forwarding equivalence class to the border label switching router and a label switching path corresponding to the forwarding equivalence class; The monitoring data receiving unit 82 is configured to receive the monitoring data through the label switching path, and send the monitoring data to the data processing unit 83;

The data processing unit 83 is configured to process the monitoring data received by the monitoring data receiving unit 82.

FIG. 9 is a structural diagram of a unit of a monitoring gateway according to another embodiment of the present invention. As shown in FIG. 9, the monitoring gateway includes:

a label switching unit 91, configured to establish a forwarding equivalence class to the border label switching router and a label switching path corresponding to the forwarding equivalence class;

The monitoring data receiving unit 92 is configured to receive the monitoring data through the label switching path. The monitoring data copying unit 94 is configured to copy the monitoring data received by the monitoring data receiving unit 92, and send a piece of monitoring data to the data processing unit 93. Another listening data is sent to the monitoring data transmitting unit 95;

a data processing unit 93, configured to process the interception data;

The monitoring data sending unit 95 is configured to send the monitoring data to the border label switching router by using a label switching path corresponding to the destination address of the listening data.

The snoop data transmitting unit 95 may further include a special tag adding module 951 and a forwarding unit 952 for adding a special tag to the snoop data transmitted to the border tag switching router as the snooping access point, the forwarding The unit 952 is configured to send the intercept data to the border label switching router by using a label switching path corresponding to the destination address of the listening data.

The intercepting gateway of the embodiment of the present invention receives the interception data from the label switching path by establishing a label switching path to the border label switching router, thereby avoiding the overhead of re-entering TCP or UDP packet encapsulation data in the prior art. This avoids the overhead of performing fragment reassembly on the listening gateway. In summary, the above description is only a preferred embodiment of the technical solution of the present invention, and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Rights request

A method for lawful interception, characterized in that it comprises:

And transmitting the interception data to the monitoring gateway through a label switching path corresponding to the forwarding equivalence class.

The method of claim 1, wherein the method further comprises: pre-establishing a forwarding equivalence class whose destination address is a snooping gateway and a label switching path corresponding to the forwarding equivalence class.

The method of lawful interception according to claim 1 or 2, wherein the method further comprises:

A mapping relationship between the monitoring flag and the forwarding equivalence class is established in advance.

The method of lawful interception according to claim 1, wherein the interception flag corresponding to the interception data is obtained by accessing a control list.

The method of lawful interception according to claim 1, wherein the method further comprises:

After receiving the interception data, the interception gateway copies the interception data;

One of the interception data is sent to the border label switching router through the label switching path corresponding to the destination address of the monitoring data, and another monitoring data is processed and sent to the monitoring center.

The lawful interception method according to claim 5, wherein the border label switching router is a border label switching router as a listening access point, and the method further includes:

Before the intercepting gateway sends one of the interception data to the border label switching router as the intercepting access point, adding a special flag to the intercepting data;

After receiving the monitoring data with the special tag, the border label switching router as the intercepting access point forwards the intercepting data according to a normal process.

The method for lawful interception according to claim 6, wherein the special flag is a virtual private between the interception gateway and the border label switching router as a listening access point. The bottom of the net is marked.

8. A communication system, characterized in that the system comprises:

a border label switching router as a listening access point, configured to receive the monitoring data, and send the monitoring data to the monitoring gateway through the label switching path; the border label switching router includes: a receiving unit, configured to receive the monitoring data;

a sending unit, configured to send the monitoring data by using a label switching path corresponding to the forwarding equivalence class determined by the acquiring unit;

And a listening gateway, configured to receive the interception data from the label switching path.

The communication system according to claim 10, wherein the boundary label switching router further comprises:

a path establishing unit, configured to establish a forwarding equivalence class whose destination address is a snooping gateway, and a label switching path corresponding to the forwarding equivalence class;

The mapping unit is configured to establish a mapping relationship between the interception flag and the forwarding equivalence class of the interception gateway.

10. The communication system according to claim 8 or 9, wherein the monitoring gateway comprises:

11. A label switching router, comprising:

a receiving unit, configured to receive monitoring data;

And a sending unit, configured to send the intercepting data by using a label switching path corresponding to the forwarding equivalence class determined by the acquiring unit.

The label switching router according to claim 11, further comprising: The path establishing unit is configured to establish a forwarding equivalence class whose destination address is a snooping gateway and a label switching path corresponding to the forwarding equivalence class.

The label switching router according to claim 12, further comprising: a mapping unit, configured to establish a mapping relationship between the interception flag and the forwarding equivalence class of the interception gateway.

The label switching router according to claim 11, wherein the receiving unit comprises:

a special tag detecting module, configured to detect whether the monitoring data received by the receiving unit has a special tag;

And a forwarding unit, configured to: when the special tag detecting module detects that the intercepting data has the special tag, forward the intercepting data according to a normal process.

15. A monitoring gateway, comprising:

The monitoring gateway according to claim 15, further comprising:

And a monitoring data sending unit, configured to send the monitoring data by using a label switching path corresponding to the destination address of the listening data.

The monitoring gateway according to claim 16, further comprising:

And a monitoring data copying unit, configured to copy the monitoring data received by the monitoring data receiving unit, and send one of the monitoring data to the monitoring data sending unit, and send another monitoring data to the data processing unit.

The monitoring gateway according to claim 17, wherein the monitoring data transmitting unit comprises:

A special tag adding module for adding a special tag to the interception data sent to the border tag switching router as the intercepting access point;

And a forwarding unit, configured to send the interception data to which the special tag is added to the border label switching router by using a label switching path corresponding to the destination address of the interception data.