WO2012089050A1

WO2012089050A1 - Interception apparatus, interception method, and system

Info

Publication number: WO2012089050A1
Application number: PCT/CN2011/084318
Authority: WO
Inventors: 刘庄; 王宏磊; 曹广传
Original assignee: 华为技术有限公司
Priority date: 2010-12-31
Filing date: 2011-12-21
Publication date: 2012-07-05
Also published as: CN102075926A; CN102075926B

Abstract

Embodiments of the present invention provide an interception apparatus, an interception method, and a system. The interception method comprises: when a communication service implemented at a terminal is detected, acquiring a user identifier corresponding to the communication service; and sending an interception data request message to an interception gateway, the interception data request message comprising the user identifier and a service type of the communication service, so as to trigger the inception gateway to perform service interception according to the interception data request message. For the interception apparatus, interception method, and system according to the embodiments of the present invention, an NE sends an interception data request message to an LIG to query whether a user identifier is intercepted, and the NE performs interception according to interception data returned by the LIG, so that the NE side no longer needs to store interception data of a user and solves the problem of the leakage risk of interception data at the NE side, thereby guaranteeing the safety of the interception data of the user.

Description

Monitoring device, monitoring method and system

The embodiments of the present invention relate to communication technologies, and in particular, to a monitoring device, a monitoring method, and a system. Background technique

Lawful interception means that the national security agency monitors the communication process of a certain user according to the law. The lawful interception of the circuit domain generally adopts a network structure conforming to the 3GPPETSI interception protocol. In the prior art, the monitoring function is implemented by signaling interaction between a lawful interception gateway (LIG) and a network element (NE). Specifically, the LIG receives the monitoring data, and stores the monitoring data in a local database; the monitoring data can be used to control the monitored user. Then, the LIG sets the monitoring data to the NE, and the monitoring data is locally stored by the NE. Then, the NE can monitor the controlled user according to the stored monitoring data, and report the monitoring information to the LIG. In the process of implementing the present invention, the inventor has found that the prior art has the following problems: In the current monitoring method, the NE side needs to store the monitoring data to trigger the monitoring service, which causes the leakage of the monitoring data stored on the NE side. It may be backed up, and the user's monitoring data is highly confidential information, and does not allow any form of disclosure. Therefore, the current monitoring method has great security risks.

Summary of the invention

The purpose of the embodiments of the present invention is to provide a monitoring device, a monitoring method, and a system, to solve the problem of the risk of intercepting data leakage on the NE side, and to ensure the security of the user listening data. An embodiment of the present invention provides a monitoring method, including: acquiring, when monitoring a communication service performed by a terminal, a user identifier corresponding to the communication service; Sending a monitoring data request message to the monitoring gateway, where the monitoring data request message includes the user identifier, to trigger the monitoring gateway to perform a monitoring service according to the monitoring data request message. The embodiment of the present invention provides a monitoring method, including: receiving a monitoring data request message sent by a monitoring device, where the monitoring data request message includes a user identifier corresponding to the communication service; and performing a monitoring service according to the monitoring data request message. The embodiment of the present invention provides a monitoring device, including: a monitoring module, configured to acquire a user identifier corresponding to the communication service when monitoring a communication service performed by the terminal; and a requesting module, configured to send a monitoring data request message to the monitoring gateway And the intercepting data request message includes the user identifier, to trigger the intercepting gateway to perform a monitoring service according to the intercept data request message. An embodiment of the present invention provides a monitoring gateway, including: a second receiving module, configured to receive a monitoring data request message sent by a monitoring device, where the monitoring data request message includes a user identifier corresponding to a communication service; and a reporting module, configured to The intercept data request message performs a listening service. The embodiment of the present invention provides a monitoring system, including: the monitoring device provided by the embodiment of the present invention, the monitoring gateway provided by the embodiment of the present invention, and the monitoring center; the monitoring center is configured to receive the reporting by the monitoring gateway Monitor information. The monitoring device, the monitoring method, and the system in the embodiment of the present invention send a monitoring data request message to the LIG through the NE to query whether the user identifier is monitored, and the NE monitors according to the monitoring data returned by the LIG, so that the NE side can no longer store the user. The monitoring data solves the problem of the risk of intercepting data leakage on the NE side, and ensures the security of the user listening data. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

1 is a schematic structural diagram of an application system of an embodiment of a monitoring method according to the present invention;

2 is a schematic flowchart of Embodiment 1 of a monitoring method according to the present invention;

3 is a schematic flowchart of Embodiment 2 of a monitoring method according to the present invention;

4 is a schematic flowchart of Embodiment 3 of a monitoring method according to the present invention;

FIG. 5 is a schematic diagram of signaling of Embodiment 4 of a monitoring method according to the present invention;

6 is a schematic signaling diagram of Embodiment 5 of a monitoring method according to the present invention;

7 is a schematic signaling diagram of Embodiment 6 of a monitoring method according to the present invention;

8 is a schematic signaling diagram of Embodiment 7 of a monitoring method according to the present invention;

9 is a schematic signaling diagram of Embodiment 8 of a monitoring method according to the present invention;

10 is a schematic signaling diagram of Embodiment 9 of a monitoring method according to the present invention;

11 is a schematic structural diagram of an embodiment of a monitoring device according to the present invention;

12 is a schematic structural diagram of an embodiment of a monitoring gateway according to the present invention;

FIG. 13 is a schematic structural diagram of an embodiment of a monitoring system according to the present invention. detailed description

The technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Some embodiments, rather than all of the embodiments, are invented. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention. The main technical solution of the embodiment of the present invention is that the monitoring data of the user is stored only on the LIG side, and the monitoring data related to the monitoring service is pre-stored on the NE side; when the NE side receives the communication service letter of the user When the information is sent, the monitoring data request message is sent to the LIG side to check whether the terminal user identifier corresponding to the communication service is monitored. If the user identifier is monitored, the LIG may return the monitoring data response message to the NE side, and send the corresponding monitoring data to the NE. The NE monitors accordingly and reports the obtained monitoring information to the LIG. The solution enables the NE side to no longer monitor the pre-stored user's monitoring data, thereby ensuring the security of the user listening data. The technical solution of the present invention will be further described in detail below through the accompanying drawings and specific embodiments. To make the understanding of the listening method of the embodiment of the present invention clearer, firstly, the system architecture to which the monitoring method is applied is briefly described. As shown in FIG. 1 , FIG. 1 is a schematic diagram of an application system architecture of an embodiment of a monitoring method according to the present invention. The monitoring system may include a Law Enforcement Monitoring Facility (LEMF) 11, LIG12, and NE13. The LIG 12 may include a Management Function (ADMF) 14 and a Data Transfer Entity (DF), which may in turn include two logical entities, DF15 and DF16. DF15 is used to transmit the interception information at the signaling level, and DF16 is used to transmit the interception information at the media level. Among them, the entities of LEMF11 and LIG12 communicate through three communication interfaces: H11, H12 and H13, and the entities of LIG12 and NE13 communicate through three communication interfaces X1, X2 and X3. Specifically, the LEMF1 1 can input the related information of the monitored user to the LIG12 through the H11 interface, and the LIG12 can send a monitoring command to the NE13 through the X1 interface.

The interception information reported by the NE to the LIG may include the interception information at the signaling level and the media level. The interception information at the signaling level is Interception Related Information (IRI), which may include the user's power on, power off, and location update. , call and other activities; media-level monitoring information that is listening to communication content (Communication Content, referred to as: CC), can contain voice and video information. The X2 interface is used for the NE13 to report the IRI data to the LIG12, and the X3 interface is used for the NE13 to report the CC data such as the voice/video call content to the LIG. The LIG12 can report the IRI data to the LEMF11 through the H12 interface, and report the CC data to the LEMF11 through the H13 interface. Embodiment 1 2 is a schematic flowchart of the first embodiment of the monitoring method of the present invention. The method may be performed by the NE. As shown in FIG. 2, the monitoring method in this embodiment may include the following steps: Step 201: When monitoring the communication performed by the terminal Obtaining a user identifier corresponding to the communication service when the service is performed;

The NE monitors the communication service performed by the terminal. For example, the communication service may be a call service received by the NE, or a user location registration and power on/off operation processed by the NE, and a short message transmission service acquired by the NE. Step 202: Send a monitoring data request message to the monitoring gateway, where the monitoring data request message includes the user identifier, to trigger the monitoring gateway to perform a monitoring service according to the monitoring data request message.

The NE sends a listen data request message to the LIG to trigger the LIG to perform the monitoring service according to the intercept data request message. For example, the LIG may query the monitoring data corresponding to the user identifier stored on the user side according to the user identifier carried in the monitoring data request message, and send the monitoring data to the NE; the NE may communicate according to the monitoring data. The service listens to obtain the interception information. Alternatively, the NE may also carry the signaling information, such as the short message content and the user number, in the interception data request message reported to the LIG, so that the LI G determines that the type of the intercepted data is the signaling layer monitoring information, which may be The interception information is directly reported to the interception center in the signaling information of the interception data request message, thereby saving the signaling load between the NE and the LIG. In the monitoring method of the embodiment, the NE sends a monitoring data request message to the LIG to query whether the user identifier is monitored, so that the NE side can not pre-store the user's monitoring data before the monitoring, for example, not in the disk, database, and file on the NE side. The storage of any user's monitoring data solves the problem of the risk of monitoring data leakage on the NE side, and ensures the security of the user listening data. Embodiment 2 3 is a schematic flowchart of the second embodiment of the monitoring method of the present invention. The embodiment is based on the first embodiment, and further describes the operation of the NE after sending the interception data request message. As shown in FIG. 3, the method may include the following steps. Step 301: When monitoring the communication service performed by the terminal, acquiring the user identifier corresponding to the communication service; wherein, in addition to the user identifier corresponding to the communication service, the NE may also monitor the communication service performed by the terminal. According to different types of communication services, the corresponding service information is separately obtained. For example, if the communication service is a short message service, the user number and the short message content can be obtained, and if the communication service is the location registration and the power on/off service, the user location information, the service type, and the like can be obtained; if the communication service is a call service, You can get the calling number and called number information. Step 302: Send a monitoring data request message to the monitoring gateway. The monitoring data request message includes the user identifier, to trigger the monitoring gateway to perform a monitoring service according to the monitoring data request message. In this step, the NE may perform the step. The service information obtained in 301 is carried in the intercept data request message and sent to the LIG. Step 303: Start the timer to start timing. Specifically, after sending the monitoring data request message to the LIG, the NE may start a timer, and determine whether the monitoring data response message returned by the LIG is received within the set duration. If not, the communication service may continue to be performed, and the monitoring of the service is not performed; if yes, the NE may receive the monitoring data response message returned by the LIG, and the NE may continue to perform steps 304-306. Step 304: Receive a listening data response message returned by the monitoring gateway, where the monitoring data response message includes monitoring data. Step 305: Listening to the communication service according to the interception data, acquiring the interception information, and reporting the interception information to the interception gateway. Step 306: Clear the interception data stored in the memory. If the NE performs voice monitoring, the intercepted data temporarily stored in the memory may be cleared after the monitoring information is reported. In the actual application, the step 303 is not performed, but the step is performed in the following step: The NE receives the interception data response message returned by the LIG. If the message is empty, the LIG side does not have the monitoring data corresponding to the user identifier, and the The communication service is monitored, and the communication service is continued. If the message includes the monitoring data corresponding to the user identifier, step 305 is continued. In the monitoring method of the embodiment, the NE sends a monitoring data request message to the LIG to query whether the user identifier is monitored, and the NE performs monitoring according to the monitoring data returned by the LIG, so that the NE side can no longer store the user's monitoring data, for example, The user does not store any user's monitoring data in the disk, database, and file on the NE side, which solves the problem of the risk of monitoring data leakage on the NE side, ensuring the security of the user listening data; and, by setting a timer, the NE can be made to each The situation can be processed in time to improve the processing efficiency of the monitoring service. Embodiment 3 FIG. 4 is a schematic flowchart of Embodiment 3 of the monitoring method of the present invention. The method may be performed by the LIG. As shown in FIG. 4, the monitoring method in this embodiment may include the following steps: Step 401: The receiving monitoring device sends a listening data request message, where the intercept data request message includes a user identifier corresponding to the communication service;

The LIG receives the interception data request message sent by the NE, and the message carries the user identifier acquired by the NE when monitoring the communication service of the terminal. Step 402: When it is determined that the monitoring data corresponding to the user identifier exists according to the user identifier, the interception information corresponding to the user identifier is obtained and reported to the monitoring center. Specifically, the LIG may query, according to the user identifier in the interception data request message, whether the monitoring data corresponding to the user identifier is stored in the local database. If the monitoring data is stored, it indicates that the terminal is monitored, and the LIG may return a monitoring data response message to the listening device, where the monitoring data response message includes the monitoring data corresponding to the user identifier; and receiving the monitoring The monitoring information obtained by the device listening to the communication service according to the interception data. If the interception data is not stored, it indicates that the terminal is not monitored, and the LIG may return a listen data response message to the NE, and the intercept data response message is empty, or may not respond to the NE. Further, if the LIG determines that the type of the interception data is the signaling layer interception information, the interception information may be obtained from the interception data request message. Specifically, the interception data request message received by the LIG carries signaling information. For example, when the call type is a short message originating service, the signaling information carried in the intercept data request message may include the user number of the originating user, the short message content, the location information of the originating user, and the like. The LIG may obtain the interception information from the interception data request message, and the interception information may include, for example, a user number and a short message content to report the information to the monitoring center. In the monitoring method of the embodiment, the monitoring data request message sent by the NE is received, and the monitoring data is returned to the NE for monitoring, so that the NE side can no longer store the user's monitoring data, for example, the disk, the database, and the file that are not on the NE side. The storage of any user's monitoring data solves the problem of the risk of monitoring data leakage on the NE side, and ensures the security of the user's monitoring data. Embodiment 4 FIG. 5 is a schematic diagram of signaling according to Embodiment 4 of the monitoring method of the present invention. As shown in FIG. 5, the monitoring method in this embodiment may include the following steps: Step 501: The NE acquires a user identifier of the terminal user, where the user The identifier can be a subscriber number. For example, an end user of a CDMA network can pass There are three types of numbers as the user ID of the end user, namely, Electronic Serial Number (ESN), International Mobile Subscriber Identity (IMSI), and Mobile Directory Number (Mobile). Directory Number (MDN), ΝΕ (ie, the listening device) can obtain the above three numbers and their corresponding number types. The communication service performed by the terminal user may be, for example, a call service accepted by the NE, or a user location registration and power on/off operation processed by the NE, and a short message transmission service acquired by the NE. Step 502: The NE sends a interception data request message to the interception gateway LIG.

After obtaining the user identifier, that is, the NE obtains the above three user numbers, the NE may send a interception data request message (Check LI Request message) to the LIG, and carry the acquired user identifier in the interception data request message. . For example, the ESN, IMSI, and MDN numbers and their number types may be included in the interception data request message, and the type of communication service received by the NE is a call service. In addition, while transmitting the above-mentioned listening data request message, the NE may start a timer, which may set a waiting time for the LI G to return a response to the monitoring data request message. In a specific implementation, the set duration is not too long, and is preferably controlled at a level of one hundred milliseconds so as not to be perceived by the user. Moreover, by setting a timer, the NE can be processed in time for various situations, and the processing efficiency of the monitoring service is improved. Step 503: The LIG queries whether the user identifier is monitored.

After receiving the interception data request message sent by the NE, the LIG queries whether the monitoring data corresponding to the user identifier carried in the interception data request message is stored in the database on the own side. If the interception data corresponding to the user identifier exists, it indicates that the terminal user corresponding to the user identifier needs to be monitored. At this point, you can continue to perform step 504 or step 506; otherwise, you can continue to perform In step 504, or LIG may not respond to the NE. Step 504: The LIG returns a monitoring data response message to the NE.

When the LIG needs to be queried, the LIG may return a Listening Data Response message (Check LI Response message) to the NE, and carry the monitoring data corresponding to the user identifier, where the monitoring data is used to be monitored. The user performs control. For example, the interception data may include a user number (such as an MDN number) that needs to be set to be monitored, and set an attribute of the interception data to monitor signaling level information, where the signaling level information is IRI data, which may include the user's booting. Or, shutdown, call, etc.; or, the attribute of the monitoring data may be set to media level information, and the media level information, that is, CC data, may include voice and video information, etc., as communication content. Otherwise, if the LIG query does not need to be monitored, the user may also return a listening data response message to the NE in this step to notify the NE that the user identifier is not being monitored. For example, LIG can make the returned listener data response message empty. Step 505: The NE monitors the interception information corresponding to the interception data, and reports the interception information to the LIG.

After receiving the interception data response message returned by the LIG, if the message carries the interception data, the NE may temporarily store the interception data in the memory, and trigger the monitoring of the interception information corresponding to the interception data, and the obtained The monitoring information is reported to the LIG. The interception information may include IRI data and CC data. Alternatively, the NE may not perform this step in the following two cases, that is, the monitoring information is not reported. For example, after receiving the monitoring data response message returned by the LIG after the timer is set, the NE discards the monitoring trigger and continues the communication service of the terminal user; or the listening data response message received by the NE is empty. Then stop waiting for the timer to continue the communication service of the end user. Step 506: The LIG reports the monitoring information corresponding to the user identifier to the monitoring center. After receiving the monitoring information reported by the NE, the LIG can transmit the monitoring information to the monitoring center LEA (the LEA is LEMF). In addition, in step 503, the LIG queries the user identifier carried in the interception data request message sent by the NE to be monitored, and the interception data attribute corresponding to the user identifier is the interception signaling layer information; After step 503, the interception information is directly obtained by the signaling information in the interception data request message and reported to the interception center without performing steps 504 and 505, which can reduce the signaling load between the NE and the LIG. In this embodiment, after the communication service is normally terminated, and the interception information is already on, the NE can clear the monitoring data of the user that is temporarily stored in the memory and is acquired by the LIG, so as to ensure the security of the user to monitor the data to the greatest extent. In addition, in order to ensure that the interception data transmission message and the interception data transmission message transmitted in the interception data response message are not stolen, the above message may be encrypted by using an encryption algorithm such as DES/AES, for example, AES256 with high algorithm strength may be used for encryption. To ensure the security of the interception data transmission. In this embodiment, the NE may be a communication device such as a mobile switching center (MSC), a home location register (HLR), a call session control function (CSCF), and a serving GPRS support node (SGSN). In the monitoring method of the embodiment, the NE sends a monitoring data request message to the LIG to query whether the user identifier is monitored, and the NE monitors according to the monitoring data returned by the LIG, so that the NE side can no longer monitor the monitoring data of the pre-storage user. For example, the user does not store any user's listening data in the disk, database, and file on the NE side, which solves the problem of the risk of monitoring data leakage on the NE side, and ensures the security of the user listening data. In the following Embodiments 5 to 9, the application of the monitoring method in the embodiment of the present invention is described by taking the monitoring call service, the location registration, the power on/off service, and the short message service as examples. Embodiment 5 FIG. 6 is a schematic diagram of signaling according to Embodiment 5 of the monitoring method of the present invention. This embodiment uses a location registration and a switching machine flow as an example to describe the monitoring method of the present invention. As shown in FIG. 6, the supervisor of this embodiment The listening method may include the following steps: Step 601: The NE receives a location registration and a switch request of the user. Step 602: The NE sends a monitoring data request message to the LIG.

After processing the user's location registration or power on/off operation, the NE can obtain the user identifier, for example, all the numbers of the user. At this time, the NE may send a monitoring data request message to the LIG, and carry all the numbers of the user, and the service type of the current service, for example, for location registration and power on/off service; The user location information can be carried, and when the service is the switch, the service type can be carried; in addition, the NE information can be carried. Step 603: The LIG returns a monitoring data response message to the NE.

The LIG queries the database on its own side. If there is monitoring data corresponding to the user number, it indicates that the user is being monitored. At this point, the LIG can return a listening data response message to the NE and carry the intercepted data it has queried. The interception data may include the user number being monitored and the type of information that needs to be monitored. In addition, if the query result of the LIG is that the subscriber number is not monitored, the intercepted data response message that is empty may be returned to the NE. Step 604: The NE reports the monitoring information to the LIG.

After obtaining the monitoring data returned by the LI G, the NE can monitor the monitoring information corresponding to the monitoring data and report it to the LIG. For example, if the type of the information to be monitored is IRI information, the NE can report the monitoring event (IRI-REPORT) to the LIG, that is, report the location registration and the user activity information of the switch. Step 605: The LIG forwards the monitoring information reported by the NE to the monitoring center LEA. In the monitoring method of the embodiment, the NE sends a monitoring data request message to the LIG to query whether the user identifier is monitored, and the NE performs monitoring according to the monitoring data returned by the LIG, so that the NE side can The user's monitoring data is no longer stored, which solves the problem of the risk of monitoring data leakage on the NE side, and ensures the security of the user listening data. Embodiment 6 FIG. 7 is a schematic diagram of signaling according to Embodiment 6 of the monitoring method of the present invention. This embodiment is still described by taking the location registration and the power on/off process as an example, and the process is optimized based on the second embodiment, LIG After receiving the listening data request message of the NE, the monitoring information is directly reported to the LEA without returning a response to the NE, thereby reducing the signaling load between the NE and the LIG. As shown in FIG. 7 , steps 701 to 702 of the monitoring method of the embodiment are the same as the first two steps of the fifth embodiment. Specifically, the method may include the following steps: Step 701: The NE receives a location registration and a switch request of the user. Step 702: The NE sends a monitoring data request message to the LIG.

After processing the user's location registration or power on/off operation, the NE can obtain the user identifier, for example, all the numbers of the user. At this time, the NE may send a monitoring data request message to the LIG, and carry all the numbers of the user in the message, and the call type of the current service, for example, location registration and power on/off. In addition, user location information, NE information, and the like can also be carried. Step 703: The LIG reports the monitoring information to the LEA.

After receiving the interception data request message of the NE, the LIG queries whether the user number is monitored. If the subscriber number is monitored and the required interception data attribute is IRI information, the LIG determines that the type of call carried in the interception data request message is a location registration and a switch request. At this time, the LIG can directly construct the X2 channel message and report it to the LEA, and does not need to return a response to the NE. The foregoing processing manner can prevent the NE from acquiring the interception data and then reporting the interception event to the LIG for redundant processing, but directly reporting the LIG, thereby reducing the signaling load between the NE and the LIG. Moreover, in this case, when the NE side is not aware, the monitoring of the user is completed, and the NE side does not need to receive and store the user's monitoring data, thereby ensuring the security of the user listening data. In addition, if the LIG query result is that the user number is not monitored, the LIG may not send a channel message, or may not return a response to the NE, or may return an empty intercept data response message to the NE. In the monitoring method of the embodiment, the NE sends a monitoring data request message to the LIG to query whether the user identifier is monitored, so that the NE side can no longer store the user's monitoring data, and the problem of the risk of monitoring data leakage on the NE side is solved, and the problem is ensured. The security of the user listening for data. Embodiment 7 FIG. 8 is a schematic diagram of signaling of Embodiment 7 of the monitoring method of the present invention. This embodiment uses a call flow as an example to describe the monitoring method of the present invention. As shown in FIG. 8, the monitoring method of this embodiment may include the following steps: Step 801: The NE receives a call request of the terminal user. For example, the call may be a relay incoming call, or may be a mobile origination call. Step 802: The NE sends a monitoring data request message to the LIG.

The NE obtains all the number information of the calling party and the called party. For example, the mobile subscriber has three numbers, ESN, IMSI, and MDN. All three numbers can be set to listen. The NE can only send these three numbers to the LIG. Listening to the data request message, and carrying all the user numbers it has obtained, and the type of service received. In addition, while transmitting the above-mentioned listening data request message, the NE may start a timer, which may set a time to wait for the LIG to return a response to the listening data request message. In a specific implementation, the set duration is not too long, and is preferably controlled at a level of one hundred milliseconds so as not to be perceived by the user. Moreover, by setting a timer, the NE can be processed in time for various situations, and the processing efficiency of the monitoring service is improved. Step 803: The LIG queries whether the user identifier is monitored. After receiving the interception data request message sent by the NE, the LIG queries whether the monitoring data corresponding to the user identifier carried in the interception data request message is stored in the database on the own side. If the interception data corresponding to the user identifier exists, it indicates that the terminal user corresponding to the user identifier needs to be monitored. At this point, step 804 can continue; otherwise, step 808 can be performed. Step 804: The LIG returns a monitoring data response message to the NE.

When the LIG needs to be monitored, and the call type is call service, the LIG can return a monitoring data response message to the NE, and carry the intercepted data of the query in the message. For example, the monitoring data may include a user number (such as an MDN number) that needs to be set to monitor, and set an attribute of the listening data. Specifically, the interception data may be required to monitor signaling layer information, where the signaling layer information, that is, IRI data, may include a user's startup, shutdown, call, and the like; or the interception data may also be requested as media layer information. Media level information, that is, CC data, may include voice and video information. If the information attribute of the interception data to be monitored is IRI data, step 805 and step 806 may be continued; if the information attribute of the interception data required to be monitored is CC data, step 807 may be performed. Step 805: The NE monitors the interception information corresponding to the interception data, and reports the interception information to the LIG.

After receiving the interception data response message returned by the LIG, if the message carries the interception data, the NE may temporarily store the interception data in the memory, and trigger the monitoring of the interception information corresponding to the interception data, and report to the LIG. The event IRI data is monitored; and the timer is stopped, and the basic call flow is continued. Step 806: The LIG reports the IRI monitoring information to the monitoring center. Step 807: The NE establishes a voice monitoring channel to the LEA. After receiving the monitoring data response message returned by the LIG, the NE establishes a voice monitoring channel to the LEA if it is determined that the user's monitoring data has voice monitoring. The voice interception channel may be established by the NE according to the voice interception number connection carried in the intercept data response message returned by the LIG. Step 808: The LIG returns an empty message to the NE.

The LIG queries the database on its own side. If the user number is not monitored, it can return a listening data response message to the NE, and the message is an empty message. At this time, after receiving the monitoring data response message, the NE determines that there is no monitoring data of the calling party and the called party, and then stops waiting for the timer to continue, and continues the basic call flow. In this embodiment, after the call is normally ended, the interception event and the voice have been reported normally, the NE can clear the interception data acquired by the LIG for the current call, and the user continues to request the interception data from the LIG to ensure the NE side to listen. The security of the data. In addition, in order to ensure that the interception data transmission message and the interception data transmission message transmitted in the interception data response message are not stolen, the above message may be encrypted by using an encryption algorithm such as DES/AES, for example, AES256 with high algorithm strength may be used for encryption. To ensure the security of the interception data transmission. Further, in this embodiment, when the LIG query obtains that the user number needs to be monitored, and the information attribute of the interception data to be monitored is IRI data, the LIG may report directly to the LEA as described in the third embodiment, instead of The response is returned to the NE to reduce the signaling load between the NE and the LIG. In the monitoring method of the embodiment, the NE sends a monitoring data request message to the LIG to query whether the user identifier is monitored, and the NE monitors the monitoring data returned by the LIG, so that the NE side can no longer store the user's monitoring data, and the solution is solved. The NE side has the problem of monitoring the risk of data leakage, which ensures the security of the user listening data. Embodiment 8 FIG. 9 is a schematic diagram of signaling of Embodiment 8 of the monitoring method of the present invention. This embodiment uses a short message originating process as an example to describe the monitoring method of the present invention. As shown in FIG. 9, the monitoring method of this embodiment The method may include the following steps: Step 901: The NE receives a short message originating service request of the user. Step 902: The NE forwards the user short message to the MC (short message center). Step 903: The MC successfully sends the short message, and returns the processing to the NE. The result is a response; Step 904: The NE sends a listen data request message to the LIG.

After determining that the MC successfully sends the short message, the NE may send a monitoring data request message to the LIG, and carry all the number information, the called number, and the call type of the short message originating user, and may also carry the short message. Send the user's location information, short message content and other information. Step 905, the LIG will report to the monitoring center;

The LIG checks whether all the numbers of the originating user of the short message are monitored. If the information attribute of the intercepted data and the information to be monitored is IRI data, the LIG also determines that the call type sent by the NE is a short message service. The LIG can directly construct X2 channel messages and report them to the LEA. At the same time, the LIG also determines whether the called number is being monitored. If the called number is also monitored and the IRI data is required to be monitored, the LIG can directly construct the X2 channel message and report it to the LEA without returning a response to the NE. The foregoing processing manner can prevent the NE from acquiring the interception data and then reporting the interception event to the LIG for redundant processing, but directly reporting the LIG, thereby reducing the signaling load between the NE and the LIG. Moreover, in this case, when the NE side is not aware, the monitoring of the user is completed, and the NE side does not need to receive and store the user's monitoring data, thereby ensuring the security of the user listening data. In this embodiment, if all the numbers of the calling and called users do not have corresponding monitoring data, the LIG may not report the monitoring information to the LEA, and does not return a response to the NE. In addition, the LIG may send the monitoring data to the NE, and then send the monitoring back to the NE, as described in the fourth embodiment, when the LIG needs to be monitored, and the information attribute that is required to be monitored in the monitoring data is the IRI data. Information is reported. In the monitoring method of the embodiment, the NE sends a monitoring data request message to the LIG to query whether the user identifier is monitored, so that the NE side can no longer store the user's monitoring data, and solves the problem that the NE side has the risk of monitoring data leakage. The security of the user listening data. Embodiment 9 FIG. 10 is a schematic diagram of signaling according to Embodiment 9 of the monitoring method of the present invention. In this embodiment, the short message termination procedure is taken as an example to describe the monitoring method of the present invention. As shown in FIG. 10, the monitoring method in this embodiment may include the following steps: Step 1001: The MC (short message center) sends a short message request to the NE, and requests the NE to send the short message to the user to send the short message. Step 1002: Sending a short message success, and returning a short message response to the MC; Step 1003: The NE sends a monitoring data request message to the LIG;

After determining that the short message is successfully sent, the NE may send a monitoring data request message to the LIG, and carry the short message to receive all the number information of the user, the short message calling number and the call type, and may also carry the short message. Receive information such as the user's location information, short message content, and the like. Step 1004, the LIG will report to the monitoring center;

The LIG checks whether all the numbers of the short message receiving user are monitored. If the information attribute that is required to be monitored in the listening data is IRI data, the LIG also determines that the call type sent by the NE is a short message service, then, at this time, LIG The X2 channel message can be directly reported to the LEA. At the same time, the LIG also determines whether the calling number is being monitored. If the calling number is also monitored and the IRI data is required to be monitored, the LIG can directly construct the X2 channel message and report it to the LEA without returning a response to the NE. The foregoing processing manner can prevent the NE from acquiring the interception data and then reporting the interception event to the LIG for redundant processing, but directly reporting the LIG, thereby reducing the signaling load between the NE and the LIG. Moreover, in this case, when the NE side is not aware, the monitoring of the user is completed, and the NE side does not need to receive and store the user's monitoring data, thereby ensuring the security of the user listening data. In this embodiment, if all the numbers of the calling and called users do not have corresponding monitoring data, the LIG may not report the monitoring information to the LEA, and does not return a response to the NE. In addition, the LIG may send the monitoring data to the NE, and then send the monitoring back to the NE, as described in the seventh embodiment, when the LIG needs to be monitored, and the information attribute that is required to be monitored in the monitoring data is the IRI data. Information is reported. In the monitoring method of the embodiment, the NE sends a monitoring data request message to the LIG to query whether the user identifier is monitored, so that the NE side can no longer store the user's monitoring data, and solves the problem that the NE side has the risk of monitoring data leakage. The security of the user listening data. Embodiment 10 FIG. 11 is a schematic structural diagram of an embodiment of a monitoring device according to the present invention. The monitoring device of this embodiment may be used to perform a monitoring method according to any embodiment of the present invention. The listening device may be an NE, and may specifically be a communication device such as a Mobile Switching Center (MSC), a Home Location Register (HLR), a Call Session Control Function (CSCF), and a Serving GPRS Support Node (SGSN). As shown in FIG. 11, the monitoring device of the present embodiment may include a monitoring module 21 and a requesting module 22; wherein the monitoring module 21 may obtain the user identifier of the terminal user and the communication service performed by the terminal user; The monitoring data request message may be sent to the monitoring gateway LIG, where the monitoring data request message includes the user identifier obtained by the monitoring module 21 and the service type of the communication service. Further, the listening device of this embodiment may further include a first receiving module 23 and a listening module.

The first receiving module 23 may receive the monitoring data response message returned by the LIG, where the monitoring data response message includes the monitoring data corresponding to the user identifier, and the monitoring module 24 may perform the monitoring information corresponding to the monitoring data. The monitoring is performed, and the monitoring information is reported to the LIG. Further, the monitoring device of this embodiment may further include a clearing module 25, a timing module 26, and The judging module 27 is configured to: after the monitoring information is reported to the LIG, clear the monitoring data stored in the memory; the timing module 26 may set a duration of waiting for the listening data response message and perform The judging module 27 can be configured to instruct the listening module 24 to give up monitoring when the listening data response message returned by the LIG is not received after the set time of the timing module 26 is passed. The monitoring device of the embodiment sends a monitoring data request message to the LIG to query whether the user identifier is monitored, etc., so that the NE side can no longer store the user's monitoring data, and the NE side has the risk of monitoring data leakage. The problem is to ensure the security of the user listening data. Embodiment 11 FIG. 12 is a schematic structural diagram of an embodiment of a monitoring gateway according to the present invention. The monitoring gateway of this embodiment may be used to perform a monitoring method according to any embodiment of the present invention. As shown in FIG. 12, the monitoring gateway of this embodiment may include a second receiving module 31 and a reporting module 32. The second receiving module 31 may receive a listening data request message sent by the monitoring device, and a service type of the communication service. The monitoring module 32 may report the monitoring information corresponding to the user identifier to the monitoring center when the user identifier needs to be monitored. Further, the intercepting gateway of the embodiment may further include a querying module 34, and the querying module 34 may query whether the monitoring data corresponding to the user identifier exists locally when the second receiving module 31 receives the intercepting data request message. . The reporting module 32 of the monitoring gateway of this embodiment may further include a response module 33 and a processing module 35. The response module 33 may, when the query result of the query module 34 is YES, return a monitoring data response message to the listening device, where the monitoring data response message includes monitoring data corresponding to the user identifier; The receiving module 31 is further configured to receive the monitoring information that is returned by the monitoring device and that is corresponding to the monitoring data. The processing module 35 can query the result of the query module 34. If yes, the received monitoring information corresponding to the service type in the received monitoring data request message is reported to the monitoring center. Further, the intercepting gateway of the embodiment may further include a sending module 36, where the sending module 36 may determine that the user identifier does not need to be monitored when the query result of the query module 34 is negative, and then return a monitoring to the listening device. The data response message, the listen data response message is empty. The monitoring gateway of the embodiment, by setting the second receiving module, receives the monitoring data request message sent by the user, so that the monitoring data of the user can no longer be stored on the side, and the problem of the risk of monitoring data leakage on the side is solved, and the problem is ensured. The security of the user listening for data. Embodiment 12 FIG. 13 is a schematic structural diagram of an embodiment of a monitoring system according to the present invention. The monitoring system of this embodiment may be used to perform a monitoring method according to any embodiment of the present invention. As shown in FIG. 13 , the monitoring system may include a monitoring device 41, a monitoring gateway 42 and a monitoring center 43. The monitoring device 41 may be the monitoring device according to the seventh embodiment of the present invention, which may be Communication equipment such as a switching center (MSC), a home location register (HLR), a call session control function (CSCF), and a serving GPRS support node (SGSN). The monitoring gateway 42 can be the monitoring gateway described in Embodiment 8 of the present invention. The interception center 43 can send the interception data to the interception gateway 42 and receive the interception information reported by the interception gateway 42. In the monitoring system of this embodiment, by setting the monitoring device and the monitoring gateway, the monitoring device sends a request to the monitoring gateway to query whether the user number is monitored, and the monitoring gateway sends the monitoring data to the monitoring device, so that the NE side can no longer store the user. Listening to the data solves the problem of the risk of intercepting data leakage on the NE side, ensuring the security of the user listening data. A person skilled in the art can understand that all or part of the steps of implementing the foregoing method embodiments may be completed by using hardware related to the program instructions, and the foregoing program may be stored in a computer readable memory. In the storage medium, when the program is executed, the steps including the foregoing method embodiments are performed; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk or an optical disk.

It should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those skilled in the art that: The technical solutions described in the foregoing embodiments are modified, or some of the technical features are equivalently replaced. The modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

Claim

A monitoring method, comprising: acquiring a user identifier corresponding to the communication service when monitoring a communication service performed by the terminal; and sending a monitoring data request message to the monitoring gateway, where the monitoring data request message is included The user identifier is used to trigger the interception gateway to perform a monitoring service according to the interception data request message.

The monitoring method according to claim 1, wherein the triggering the intercepting gateway to perform the monitoring service according to the intercepting data request message comprises: receiving the monitoring that the intercepting gateway returns according to the intercepting data request message a data response message, the interception data response message includes the interception data corresponding to the user identifier; the monitoring service is monitored according to the interception data, the interception information is acquired, and the interception information is reported to the monitor Gateway.

The monitoring method according to claim 1 or 2, wherein after the reporting the monitoring information to the monitoring gateway, the method further comprises: clearing the monitoring data stored in the memory.

The monitoring method according to any one of claims 1 to 3, wherein the intercepting data request message further includes: signaling information; the triggering the intercepting gateway to perform according to the intercepting data request message The monitoring service includes: the monitoring gateway acquires the monitoring information from the signaling information and reports the information to the monitoring center.

The monitoring method according to claim 4, wherein the intercepting data request message further includes signaling information, including: if the call type is a short message service, sending a monitoring data request message to the listening gateway. And setting the user number and the short message content in the listening data request message; or If the call type is a location registration service, send a monitoring data request message to the intercepting gateway, and set the user location information in the intercept data request message; or, if the call type is a switch-on service, The gateway sends a listener data request message, and sets the service type in the intercept data request message; or, if the call type is a call service, acquires the calling number and the called number corresponding to the call service, to the monitoring The gateway sends a listen data request message, and sets the calling number and the called number in the intercept data request message.

The monitoring method according to claim 2, wherein, before the listening gateway returns a monitoring data response message according to the monitoring data request message, the method further includes: the monitoring gateway querying whether the local presence exists according to the user identifier The user identifier corresponds to the interception data, and the query result is yes.

The monitoring method according to claim 2, after the sending the monitoring data request message to the monitoring gateway, the method further includes: starting a timer, and determining whether the monitoring gateway is received within a set duration Returning the listening data response message; if not, executing the communication service.

The monitoring method of claim 2, after the sending the monitoring data request message to the monitoring gateway, the method further comprising: receiving the monitoring data response message returned by the monitoring gateway, when determining the monitoring data When the response message is empty, the communication service is executed.

A monitoring method, comprising: receiving a monitoring data request message sent by a monitoring device, wherein the monitoring data request message includes a user identifier corresponding to the communication service; and performing a monitoring service according to the monitoring data request message.

The monitoring method according to claim 9, wherein the performing the monitoring service according to the monitoring data request message comprises: returning a monitoring data response message to the monitoring device, where the monitoring data response message includes The interception data corresponding to the user identifier; and the interception information obtained by the interception device to listen to the communication service according to the interception data.

The method of monitoring according to claim 10, further comprising: before the returning the monitoring data response message to the monitoring device, the method further comprising: querying whether the monitoring data corresponding to the user identifier exists locally, and the query result is Yes.

The monitoring method according to claim 9, wherein the monitoring data request message further includes signaling information; and the monitoring service is performed according to the monitoring data request message, comprising: if the monitoring data is determined The type is the signaling layer interception information, and the interception information is obtained from the signaling information in the interception data request message.

The method of monitoring according to claim 9, further comprising:

Returning a listening data response message to the listening device, where the listening data response message is empty.

A monitoring device, comprising: a monitoring module, configured to acquire a user identifier corresponding to the communication service when monitoring a communication service performed by the terminal; and a requesting module, configured to send a monitoring data request to the monitoring gateway The message, the interception data request message includes the user identifier, to trigger the interception gateway to perform a monitoring service according to the intercept data request message.

The listening device according to claim 14, further comprising: a first receiving module, configured to receive a listening data response message returned by the monitoring gateway according to the monitoring data request message, and the monitoring data response The message includes the interception data corresponding to the user identifier; the intercepting module is configured to listen to the communication service according to the interception data, obtain the interception information, and report the interception information to the interception gateway.

The listening device according to claim 15, further comprising: a clearing module, configured to: after the monitoring information is reported to the monitoring gateway, clear the monitoring data stored in the memory.

The listening device according to claim 14, further comprising: a timing module, configured to set a duration of waiting for the listening data response message, and start a timer to perform timing; the determining module is further configured to determine Whether the listening data response message returned by the monitoring gateway is received within a set time period of the timing module, and if not, instructing execution of the communication service.

A monitoring gateway, comprising: a second receiving module, configured to receive a monitoring data request message sent by the monitoring device, where the monitoring data request message includes a user identifier corresponding to the communication service; and the reporting module is configured to: The monitoring service is performed according to the interception data request message.

The intercepting gateway according to claim 18, further comprising: a querying module, configured to: when the second receiving module receives the interception data request message, query whether the local presence and the user identifier Corresponding monitoring data.

The monitoring gateway according to claim 19, wherein the reporting module comprises: a response module, configured to: when the query result of the query module is YES, return a monitoring data response message to the listening device, where the monitoring data response message includes monitoring data corresponding to the user identifier; The receiving module is further configured to receive the interception information that is obtained by the monitoring device and that is obtained by monitoring the communication service according to the interception data.

The monitoring gateway according to claim 19, wherein the reporting module comprises: a processing module, configured to: when the query result of the query module is yes, and the type of the monitoring data is a signaling layer When the information is monitored, the interception information is obtained from the interception data request message.

The monitoring gateway according to any one of claims 19 to 21, further comprising: a sending module, configured to: when the query result of the query module is negative, return a monitoring data response message to the listening device The listening data response message is empty.

A monitoring system, comprising: the monitoring device according to any one of claims 14-17, the monitoring gateway according to any one of claims 18-22, and a monitoring center; Receiving the interception information reported by the interception gateway.