WO2012097727A1

WO2012097727A1 - Method and communication system for monitoring terminal

Info

Publication number: WO2012097727A1
Application number: PCT/CN2012/070489
Authority: WO
Inventors: 张勇
Original assignee: 华为技术有限公司
Priority date: 2011-01-19
Filing date: 2012-01-17
Publication date: 2012-07-26
Also published as: CN102123367A

Abstract

Disclosed are a method and communication system for monitoring a terminal. The method includes: user access equipment receiving a control signalling sent from a management entity, with the control signalling including the identification of the terminal to be monitored; and the user access equipment obtaining the monitoring data of the terminal according to the control signalling so as to monitor the communication service of the terminal. By sending a control signalling to the user access equipment and monitoring the terminal by means of an access gateway or an access point device in the present embodiment, the problem in the prior art that the communication data and signalling data which fail to pass the core network cannot be monitored is solved, and the aim of allowing the Law Enforcement Agency (LEA) to monitor all kinds of communication services of the terminal is satisfied.

Description

Method and communication system for monitoring terminal

TECHNICAL FIELD The present invention relates to communication technologies, and in particular, to a method and a communication system for monitoring a terminal.

Background technique

Legitimate monitoring is the ability of the mobile communication system to provide the LEA with the communication content and the Intercept Related Information (IRI) of the monitoring terminal for the benefit of the Law Enforcement Agency (LEA). The terminal can be a mobile phone, a data card, an access point (AP) device, and the like.

In the communication mobile network, the monitoring related logical entity includes various network nodes, such as a Mobile Switching Center (MSC) and a General Packet Radio Service Support Node (GSN). The GSN includes a GPRS GPRS Support Node (hereinafter referred to as SGSN) and a Gateway GPRS Support Node (hereinafter referred to as GGSN). In addition, the communication network also includes a Management Function (hereinafter referred to as ADMF). ).

In the prior art technical solution, only the monitoring indication of the ADMF can be sent to the core network element device such as the MSC or the GSN, and the MSC or the GSN can only monitor the signaling or communication content entering the MSC or the GSN. The solution cannot be monitored in the wireless connection. The devices on the ingress side cannot be monitored for signaling or communication content that only passes through the radio access network device.

Summary of the invention

The present invention provides a method and a communication system for monitoring a terminal to achieve the purpose of LEA monitoring various types of communication services of the terminal.

The present invention provides a method for monitoring a terminal, including:

The user access device receives control signaling sent by the management entity; the control signaling includes The identity of the terminal to be monitored;

The user access device acquires monitoring data of the terminal according to the control signaling to implement monitoring of the communication service of the terminal.

The present invention further provides a communication system, including: a management entity and a user access device; the user access device receives control signaling sent by the management entity; and the control signaling includes an identifier of the terminal that needs to be monitored; Obtaining monitoring data of the terminal according to the control signaling to implement monitoring of the communication service of the terminal.

The present embodiment solves the problem that the communication data and signaling data that fail to pass the core network cannot be monitored in the prior art by transmitting control signaling to the access gateway and monitoring the terminal through the user access device, and satisfies the LEA. The purpose of monitoring various types of communication services of the terminal. DRAWINGS

FIG. 1 is a flowchart of a method for monitoring a terminal according to an embodiment of the present invention;

FIG. 1b is a schematic diagram of sending control signaling according to an embodiment of the present invention;

FIG. 1 is a schematic diagram of a CS service for a local exchange of a terminal according to an embodiment of the present invention; FIG. 1 is a schematic diagram of a scenario for monitoring PS domain data according to an embodiment of the present invention;

FIG. 2 is a schematic structural diagram of a communication system according to another embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is a partial embodiment of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

Universal Mobile Telecommunications System that supports lawful monitoring ( Universal Mobile Telecommunications

System, hereinafter referred to as UMTS), includes the following services: Normal Circuit Switched Domain (Circuit) SwitchedDomain, hereinafter referred to as CS) service, locally switched CS service, normal packet switched domain (PS) service, and Gi port service in the PS domain.

In the communication system, the normal CS service transmission path is: UE-AP-rauter (router)-AG-MSC; because the MSC passes, the communication system can monitor the normal CS service through the MSC.

The transmission path of the normal PS service is UE-AP-router-AG-GSN (SGSN or GGSN), and since the GSN is passed, the communication system can monitor the normal PS service through the GSN.

The transmission path of the Gi port service in the PS domain is the UE-AG-router-Internet Protocol (IP) network. According to the prior art scheme, the monitoring cannot be performed because the MSC and the GSN are not passed.

The transmission path of the locally exchanged CS service is UE-router-AG-router-UE. According to the prior art scheme, monitoring cannot be performed because the MSC and the GSN are not passed.

As can be seen from the above end, the communication system is used, and according to the prior art scheme, the communication system can only monitor normal CS services and normal PS services. For the rest of the business, since it does not pass through the MSC and GSN, it cannot be monitored. If the communication data of the terminal is encrypted, since the encryption process is transmitted to the AG, it cannot be monitored by the MSC or GSN.

In order to enable monitoring of the normal CS service, the locally exchanged CS service, the Gi interface service in the PS domain, and the normal PS service, the present embodiment provides a monitoring terminal based on the above-described communication system structure. Methods. To achieve the following technical purposes: The legally monitored ADMF can directly or indirectly monitor wireless access devices such as terminals and UMTS APs, and the monitoring granularity can only monitor a specified UMTS AP or terminal. The communication data of the AP that has only passed through the UMTS can be monitored. Since the communication data passing through the AP can be monitored and the communication between the users is encrypted, the encryption process occurs on the AG, and the communication data can be monitored on the AP.

As shown in FIG. la, the method for monitoring the terminal in this embodiment is as follows:

Step 11: The user access device receives control signaling sent by the ADMF, where the control signaling includes an identifier of the terminal that needs to be monitored.

In this embodiment, the user access device includes an AP and an AG. In order to enable the communication system to support LEA For the legal monitoring, the control signaling related to the monitoring terminal needs to be sent to the AG and the AP. The control signaling includes the identifier of the terminal that is legally monitored by the LEA, such as the International Mobile Subscriber Identification Number (IMSI) of the terminal and the Mobile Subscriber International ISDN/PSTN number. Information such as MSISDN (hereinafter referred to as MSISDN) can be used to monitor which terminals need to be monitored by other network element devices such as MSC and GSN.

The control information related to the terminal to be monitored is sent to the AG through ADMF. The following two methods are available:

The control information related to the terminal to be monitored is sent to the AG through the ADMF. See the schematic diagram of the transmission control signaling shown in Figure lb. The following two methods are available:

In the first mode, the control signaling of the terminal to be monitored is sent to the core network element by the ADMF, and the control signaling is sent to the AG by the core network element, where the core network element may be the MSC, the GSN, and the mobility management node (Mobility). Management Entity, hereinafter referred to as MME).

In the second mode, an interface between the ADMF and the AG is established in advance, and the ADMF sends the control signaling directly to the AG through the interface. After receiving the control signaling, the AG can send the control signaling to the AP, so that the communication system can monitor various services of the user terminal through the AG or the AP.

Step 12: The user access device acquires monitoring data of the terminal according to the control signaling to implement monitoring of the communication service of the terminal.

In this embodiment, the monitoring of the terminal may be performed in the following manners: 1. The AG acquires monitoring data of the terminal according to the control signaling of the terminal, so as to implement monitoring of the communication service of the terminal; Or, the AG sends the control signaling of the terminal to the AP; the AP acquires the monitoring data of the terminal according to the control signaling of the terminal, so as to implement monitoring of the communication service of the terminal. .

The AP obtains the identity of the monitoring terminal according to the control signaling to determine which terminals need to be monitored. In this embodiment, various types of communication services can be monitored by the AG or the AP.

For the communication data of the CS service of the terminal, including the normal CS service and the communication data of the locally exchanged CS service, when the monitoring is performed, the user access device is connected according to the identifier of the terminal. After the received communication data and signaling data of the circuit switched domain service of the terminal are copied, the data is forwarded to a monitoring point (which may be an IP monitoring point of the LEA) or a general packet radio service technical support node GSN for monitoring. The specific method is as follows:

The AP obtains the identifier of the terminal according to the control signaling, and learns the terminal that needs to be monitored. Transmitting the received communication data and signaling data of the CS service of the terminal to the AG according to the identifier of the terminal, and then forwarding the communication data of the terminal to the IP monitoring point by the AG, or may also The AP directly copies the communication data and the signaling data and forwards it to the IP monitoring point, so that the LEA can monitor the terminal through the IP monitoring point.

After receiving the indication of monitoring a terminal, if the corresponding terminal has a corresponding telephone or data service, the AP will copy the communication data and signaling data, and convert the copied data into an IP monitoring point to identify The format is transferred to the IP monitoring point after AG aggregation.

In general, the IP monitoring point can identify the format corresponding to Voice over Internet Protocol (VOIP). Therefore, when the AP converts the copied data into a format that can be recognized by the IP monitoring point, the CS data can be used by default. The voice signaling is converted into an application layer's Session Initiation Protocol (hereinafter referred to as SIP) signaling, and the communication data packet is converted into a VOIP format data packet. Enables the IP monitoring point to identify the data sent by the AP.

The communication between the terminal 1 and the terminal 2 is taken as an example. Referring to FIG. 1c, a schematic diagram of the CS service exchanged locally by the terminal is performed. The service between the terminal 1 and the terminal 2 is a local exchange service, and the data stream does not pass through the MSC. The AP copies the communication content between the terminal 1 and the terminal 2 according to the information such as the IMSI of the terminal to be monitored, and the AP converts the communication content between the terminal 1 and the terminal 2, and converts the converted communication content to AG, AG. The converted content is sent to an IP monitoring point that can monitor the communication content.

As shown in Figure lc, the signaling data of the core network can be monitored through the IP monitoring point of the core network. After the localized signaling data or communication data is converted by the AP, it is sent to the AG, and the AG is aggregated and forwarded to the AG. IP monitoring point.

When monitoring the PS service data of the terminal, the normal PS service data and the service data of the Gi port in the PS domain are included. When monitoring the normal PS service data, the user access device acquires the identifier of the terminal according to the control signaling; and according to the identifier of the terminal, the received communication of the packet switched domain service of the terminal After the data is copied, it is forwarded to the IP monitoring point for monitoring; and after copying the signaling data of the terminal, it is forwarded to the GSN for monitoring.

The following two methods can be used to monitor the normal PS service:

In the first manner, the AP obtains the identifier of the terminal according to the control signaling, and learns the terminal that needs to be monitored. And after the received communication data of the PS service of the terminal is copied according to the identifier of the terminal, the communication data is forwarded to an IP monitoring point for monitoring. At the same time, the AP copies the signaling data of the terminal and sends it to the GSN, so that the LEA can monitor the signaling data of the terminal through the GSN.

Mode 2, as shown in Figure Id, is a schematic diagram of a scenario for monitoring PS domain data. Referring to Figure Id, in this mode, a channel between the AP and the GSN needs to be established. When the data of the Gi port of the terminal needs to be monitored, the local Gi port function is enabled to establish a channel between the AP and the GSN. Since a channel is established between the AP and the GSN, the data of the local Gi port is not forwarded to the IP monitoring. Point, but copy the data of the local Gi port to the channel between the AP and the GSN, so that the LEA can monitor the data through the GSN.

When monitoring the service of the Gi interface in the PS domain, the user access device acquires the identifier of the terminal according to the control signaling; and according to the identifier of the terminal, the received PS domain of the terminal After the communication data of the service of the Gi port and the signaling data are copied, the data is forwarded to the channel between the access point device and the GSN, and monitored by the GSN.

In addition, the communication service of the terminal may also include the CS service and the PS service at the same time. At this time, the function of copying and converting data can be implemented on the AG. In this case, the method for monitoring the terminal is: the AP acquires the identifier of the terminal that needs to be monitored according to the control signaling; the AP sends the CS service communication data and signaling data of the terminal to the AG, and the AG exchanges the domain service. The communication data and the signaling data are converted into communication data and signaling data of the PS type; and the converted communication data and signaling data are forwarded to the GSN, so that the LEA can be monitored by the GSN, and the communication service of the PS domain still uses the above The monitoring method is monitored, thereby enabling simultaneous monitoring of the CS service and PS service of the terminal through the GSN in the communication system. For the communication service of two users, encryption is adopted. Since the encryption process occurs in the AG, when the terminal is monitored, if the AP replicates and forwards the communication data to the monitoring device, the following method can be used: AP After receiving the control signaling, the identifier of the terminal is obtained. The received communication data and signaling data of the terminal before being encrypted are copied according to the identifier of the terminal, and then forwarded to the monitoring point for monitoring. If the AG replicates and forwards the communication data to the monitoring device, the following method may be adopted: after receiving the control signaling, the AG acquires the identifier of the terminal; according to the identifier of the terminal, the received terminal is not After the communication data and signaling data before encryption are copied, they are forwarded to the IP monitoring point for monitoring. This enables the communication system to monitor the communication traffic encrypted between users.

The present embodiment solves the problem that the communication data and signaling data that fail to pass the core network cannot be monitored in the prior art by transmitting control signaling to the access gateway and monitoring the terminal through the user access device, and satisfies the LEA. The purpose of monitoring various types of communication services of the terminal.

2 is a communication system according to an embodiment of the present invention, including: a management entity 21 and a user access device 22, wherein the user access device 22 includes an access gateway and an access point device.

The user access device 22 receives the control signaling sent by the management entity; the control signaling includes the identifier of the terminal that needs to be monitored; and the monitoring data of the terminal is obtained according to the control signaling to implement the The communication service of the terminal is monitored.

The management entity 21 may send the control signaling including the terminal identifier in the following two manners: The management entity 21 sends the control signaling of the terminal to the core network element, and the core network element sends the control signaling Give the access gateway.

Alternatively, the management entity 21 sends the control signaling directly to the access gateway through an interface with the access gateway.

After receiving the control signaling, the access gateway may forward the control signaling to the access point device.

In this embodiment, the communication service of the terminal to be monitored includes a circuit switched domain service; when performing monitoring, the user access device acquires the identifier of the terminal according to the control signaling; And identifying, by the identifier of the terminal, the received communication data and signaling data of the circuit switched domain service of the terminal, and forwarding the data to the monitoring point or the GSN for monitoring.

For the case where the communication service of the terminal to be monitored includes a normal packet switched domain service, The user access device obtains the identifier of the terminal according to the control signaling, and copies the received communication data of the packet switched domain service of the terminal according to the identifier of the terminal, and forwards the data. Monitoring to the monitoring point; and copying the signaling data of the terminal, and then forwarding to the GSN for monitoring.

For the case where the communication service of the terminal to be monitored includes the service of the Gi port in the packet switching domain, the user access device acquires the identifier of the terminal according to the control signaling when performing the monitoring; The identifier of the terminal is copied to the channel between the access point device and the GSN by the received communication data and the signaling data of the service of the Gi-switch in the packet exchange domain of the terminal, and is monitored by the GSN.

In addition, if the communication service of the terminal to be monitored is an encrypted communication service, when the monitoring is performed, the access gateway acquires the identifier of the terminal according to the control signaling; and receives the identifier according to the identifier of the terminal. After the unencrypted communication data and signaling data of the terminal are copied, the terminal is forwarded to an IP monitoring point for monitoring.

It will be understood by those of ordinary skill in the art that the drawings are only a schematic representation of one embodiment, and the modules or processes in the drawings are not necessarily required to practice the invention.

A person skilled in the art can understand that the modules in the device in the embodiment may be implemented in hardware or in software. The devices are distributed in the device according to the embodiment, and the corresponding changes may be different from the embodiment. In one or more devices. The modules of the above embodiments may be combined into one module, or may be further split into multiple sub-modules.

The serial numbers of the embodiments of the present invention are merely for the description, and do not represent the advantages and disadvantages of the embodiments.

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by program instruction related hardware, and the foregoing program may be stored in a computer readable storage medium, and when executed, the program includes The foregoing steps of the method embodiment; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk. It should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those skilled in the art that: The technical solutions described in the foregoing embodiments are modified, or the equivalents of the technical features are replaced by the equivalents of the technical solutions of the embodiments of the present invention.

Claims

Claim

A method for monitoring a terminal, comprising:

The user access device receives control signaling sent by the management entity; the control signaling includes an identifier of the terminal that needs to be monitored;

2. The method of monitoring a terminal according to claim 1, wherein the user access device comprises an access point device and an access gateway.

The method for monitoring a terminal according to claim 1 or 2, wherein the communication service of the terminal that needs to be monitored includes a circuit switched domain service;

The user access device acquires monitoring data of the terminal according to the control signaling, so as to implement monitoring of the communication service of the terminal, including:

Obtaining, by the user access device, an identifier of the terminal according to the control signaling;

The user access device copies the received communication data and signaling data of the circuit switched domain service of the terminal according to the identifier of the terminal, and forwards the data to the monitoring point or the general packet radio service technical support node GSN. monitor.

The method for monitoring a terminal according to claim 1 or 2, wherein the communication service of the terminal that needs to be monitored includes a normal packet switched domain service;

The user access device copies the received communication data of the packet switched domain service of the terminal according to the identifier of the terminal, and then forwards the data to the monitoring point for monitoring; and after copying the signaling data of the terminal, forwarding Go to the GSN for monitoring.

The method for monitoring a terminal according to claim 2, wherein the communication service of the terminal to be monitored includes a service of a Gi port in a packet switching domain;

The user access device acquires monitoring data of the terminal according to the control signaling to implement The communication service of the terminal is monitored, including:

Transmitting, by the user access device, the communication data and signaling data of the service of the Gi port in the packet switched domain of the terminal, according to the identifier of the terminal, and forwarding the data to the access point device and the GSN. On the channel, to monitor through the GSN.

The method for monitoring a terminal according to claim 2, wherein the communication service of the terminal to be monitored is an encrypted communication service;

Obtaining, by the access gateway, an identifier of the terminal according to the control signaling;

The access gateway copies the received communication data and signaling data before the encryption of the terminal according to the identifier of the terminal, and then forwards the data to the monitoring point for monitoring.

7. A user access device, characterized in that

The user access device is configured to receive control signaling sent by the management entity; the control signaling includes an identifier of a terminal that needs to be monitored; and acquiring, according to the control signaling, monitoring data of the terminal to implement Monitoring the communication service of the terminal.

The user access device according to claim 7, wherein the user access device comprises an access point device and an access gateway.

The user access device according to claim 7 or 8, wherein the communication service of the terminal to be monitored comprises a circuit switched domain service;

The user access device is configured to obtain an identifier of the terminal according to the control signaling, and copy the received communication data and signaling data of the circuit switched domain service of the terminal according to the identifier of the terminal. , forwarded to the monitoring point or the general packet radio service technical support node GSN for monitoring.

The user access device according to claim 7 or 8, wherein the communication service of the terminal that needs to be monitored includes a normal packet switched domain service;

The user access device is configured to obtain an identifier of the terminal according to the control signaling, and copy the received communication data of the packet switched domain service of the terminal according to the identifier of the terminal, and then forward to monitoring After monitoring and copying the signaling data of the terminal, the point is forwarded to the GSN for monitoring.

The user access device according to claim 8, wherein the communication service of the terminal to be monitored includes a service of a Gi port in the packet switching domain;

The user access device is configured to obtain, according to the control signaling, an identifier of the terminal, and according to the identifier of the terminal, receive communication data and a service of a service of a Gi port in a packet switching domain of the terminal according to the identifier of the terminal. After the data is copied, it is forwarded to the channel between the access point device and the GSN for monitoring by the GSN.

The user access device according to claim 8, wherein the communication service of the terminal to be monitored is an encrypted communication service;

The access gateway is configured to obtain an identifier of the terminal according to the control signaling, and copy the received communication data and signaling data before the encryption according to the identifier of the terminal, and forward the Go to the monitoring point for monitoring.