JP5272851B2 - Communication interception system, communication interception device, communication interception method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a communication interception system capable of reducing the facility cost for communication interception while suppressing deterioration in communications processing, even if the scale of a communication network is enlarged. <P>SOLUTION: The communication interception system monitors and intercepts communications. The communication interception system includes a management device for specifying a terminal for interception and a communication interception device for monitoring and intercepting communications of the terminal for interception. If the management device determines that a terminal requesting connection is an object for interception, the management device informs the communication interception device that the terminal is the object for interception. The communication interception device build up a tunnel route between the terminal and the own device. <P>COPYRIGHT: (C)2011,JPO&amp;INPIT

Description

  The present invention relates to a communication interception system, a communication interception apparatus, a communication interception method, and a program for causing a computer to execute the method.

  It may be necessary to intercept for communication between terminals performed via a network. Patent Document 1 is disclosed as an example of a communication interception device for performing such interception.

  An example of a communication interception system using a communication interception device related to this will be specifically described below with reference to the drawings. FIG. 11A is a block diagram showing an entire network including a configuration example of a related communication interception system.

  As shown in FIG. 11A, a plurality of GWs (Gateways) 450 are connected to a service network 80 used by the user, and the plurality of GWs 450 are connected to a plurality of AGWs (Access Gateways) 550 via the network 2. A radio base station 60 that is wirelessly connected to a mobile communication terminal 701 is connected to an AGW 550. Each of the network 2 and the service network 80 may be a network operated by a company or the Internet. The user operates the mobile terminal 701 to connect the terminal 701 to the service network 80 via the radio base station 60, the AGW 550, and the GW 450, and further connect to the terminal 75.

  FIG. 11B is a block diagram for explaining a communication interception method by the communication interception system shown in FIG. 11A. FIG. 11B shows a case where there is one GW and one AGW for ease of explanation. In FIG. 11A and FIG. 11B, the user plane communication path (tunnel path) is schematically represented by a thick dotted line.

  The communication interception system shown in FIG. 11B includes a communication interception device 400 that intercepts communication, a communication interception management device 600 that manages the communication interception device 400, and subscriber management that manages subscriber information that is information about the terminal and its user. Device 500. The GW 450 and the AGW 550 are connected by a tunnel route 900. The communication interception device 400 is connected to each of the GW 450, the AGW 550, the subscriber management device 500, and the communication interception management device 600 through a control signal communication path. Further, the subscriber management device 500 is connected to each of the GW 450, the AGW 550, the communication interception device 400, and the communication interception management device 600 through a control signal communication path. Communication interception management device 600 is connected to each of subscriber management device 500 and communication interception device 400 via a control signal communication path.

  In the communication interception system shown in FIG. 11B, the gateway of AGW 550 and GW450 transmits data associated with the call to the other gateway via the tunnel route 900 for a call (communication session) that is not subject to interception as a normal communication process. Process. In addition, when the AGW 550 or GW 450 receives a communication intercept instruction including information (for example, the IP address of a terminal to be intercepted) for identifying the intercept target from the communication intercept device 400, the key information is Reference is made to search for a call to be intercepted for a call to be processed for communication. When AGW 550 or GW 450 finds a call to be intercepted, AGW 550 or GW 450 copies the data exchanged by the call to be intercepted, and transmits the copied data to communication interception apparatus 400 via control signal communication path 910. The AGW 550 or GW 450 transmits the original data at the time of copying to the other gateway via the tunnel route 900 in the same manner as in the normal communication process.

  In this way, when the AGW 550 or GW 450 receives a communication interception instruction from the communication interception device 400, in addition to the normal communication process, the AGW550 or GW450 searches for the interception target, copies the interception target data, and copies the copied data communication interception device 400. It is necessary to perform the process of sending to. Hereinafter, processing including search for an intercept target, copying of data to be intercepted, and transmission of the copied data to the communication interception device 400 is referred to as preparation processing for interception.

  Next, an example of another communication interception system will be described. FIG. 12 is a block diagram for explaining another configuration example of the related communication interception system. The way of displaying the communication path is the same as in FIG. 11B, and the description thereof is omitted.

  The major difference from the communication interception system shown in FIG. 11B is that neither the GW 40 nor the AGW 50 shown in FIG. 12 has a function for performing preparation processing for interception, and the middle of the tunnel route connecting the GW 40 and the AGW 50. A communication interception device (in FIG. 12 and the following sentence, expressed as an interception device) 410 is provided. The GW 40 and the AGW 50 perform normal communication processing. The intercepting device 410 is a device corresponding to a router in the IP network. The subscriber management device 500 is connected to each of the GW 40, the AGW 50, and the communication interception management device 600 through a control signal communication path.

  In the communication interception system shown in FIG. 12, the interception device 410 searches the tunnel route 900 for a call to be intercepted based on the key information. As a result of the search, when the intercepting device 410 finds a call to be intercepted, it starts communication interception, copies data associated with the call, and returns the original data to the tunnel route 900.

JP 2002-26976 A

  In the communication interception system described with reference to FIG. 11B, as shown in FIG. 11A, when there are a plurality of AGWs 550, it is not known to which AGW 550 the mobile object to be intercepted connects. Must be provided in advance. Even when the preparation processing for intercepting is performed on the GW 450 instead of the AGW 550, if there are a plurality of GWs 450, a preparation processing function for interception needs to be provided in advance in all the GWs 450.

  In addition, when the AGW 550 or GW 450 receives a communication interception instruction from the communication interception device 400, the AGW 550 or the GW 450 performs preparation processing for interception in parallel with normal communication processing. There is a risk that normal communication processing will be affected. As described above, there is a problem in that normal communication processing is reduced due to interception.

  In the communication interception system shown in FIG. 12, it is necessary to install the interception device 410 in a tunnel route formed between the GW 40 and the AGW 50. In this case, as the scale of the network 2 shown in FIG. 11A increases, the number of GWs and AGWs shown in FIG. 11A also increases. As a result, the number of eavesdropping devices provided between the GW and the AGW increases, and there is a problem that the cost for installation and operation of the equipment increases.

  On the other hand, in the current mobile communication, it is common to perform communication without interruption even when a terminal moves between radio base stations, called handover. FIG. 13 is a block diagram for explaining a case where handover is performed in the communication system shown in FIG. 11B.

  When the terminal 701 and the terminal 75 communicate with each other via the service network 80, the GW 450, the AGW 550a, and the radio base station 60a, the AGW 550a receives an instruction from the communication interception apparatus 400 that the terminal 701 is an intercept target. The preparation process for interception described above is started. Thereafter, when the terminal 701 moves from the communication area of the radio base station 60a to the communication area of the radio base station 60b, the terminal 701 starts communication with the terminal 75 via the radio base station 60b and the AGW 550b. However, before starting the communication, the AGW 550a must notify the AGW 550b of information serving as a key for specifying the intercept target. The AGW 550b that has received the notification starts not only normal communication processing performed for other calls but also preparation processing for interception.

  FIG. 14 is a block diagram for explaining a case where a handover is performed in the communication system shown in FIG. In the case shown in FIG. 14, the terminal 701 communicates with the terminal 75 via the service network 80, the GW 40, the AGW 50a, and the radio base station 60a. At this time, when the terminal 701 moves from the communication area of the radio base station 60a to the communication area of the radio base station 60b, the connection destination of the terminal 701 is switched from the radio base station 60a to the radio base station 60b by handover. In order to switch the device that performs communication interception with respect to the terminal 701 at the time of handover from the interception device 410a to the interception device 410b, before the communication is switched, information serving as a key for specifying the interception target is received from the interception device 410a. 410b must be notified.

  The present invention has been made to solve the above-described problems of the technology, and it is not necessary to provide the AGW or GW with a function for intercepting communication even if the scale of the communication network increases. An object of the present invention is to provide a communication interception system, a communication interception apparatus, a communication interception method, and a program for causing a computer to execute the method, which suppresses a decrease in communication processing and suppresses equipment costs for communication interception. To do.

The communication intercept system of the present invention for achieving the above object is a communication intercept system for intercepting communication,
A management device that identifies a terminal to be intercepted;
A communication interception device that intercepts the communication of the terminal to be intercepted,
When the management device specifies that the terminal requested to be connected is an intercept target, it notifies the communication intercept device that the terminal is an intercept target,
The communication interception device is
A storage unit for storing data received from the data or communicating party the interception target terminal sends to the communication partner, when receiving a connection request from the first gateway, said managing an authentication request relating to said first gateway When receiving the authentication result of the first gateway and information indicating that the second gateway is designated as a connection destination from the management device, the device requests the second gateway to connect, and When a tunnel path connecting each of the second gateways and the own device is established, and the data about the terminal to be intercepted is received from one of the two gateways, the data is copied and the own device is copied. And a control unit that transfers the data to the other gateway.

The communication interception device of the present invention is a communication interception device that establishes a tunnel path between the terminal and the own device when information indicating that the terminal requested to be connected is an interception target is received from the management device. ,
A storage unit for storing data to be transmitted to or received from a communication partner by a terminal to be intercepted;
When a connection request is received from the first gateway, an authentication request relating to the first gateway is made to the management apparatus, and an authentication result indicating that the first gateway is authenticated and a second gateway is designated as the connection destination Is received from the management device, the second gateway is requested to connect, and a tunnel path is established for connecting each of the first and second gateways to the own device. When the data about the intercepted terminal is received from one gateway, the data is copied and stored in the storage unit of the own device, and the control unit transfers the data to the other gateway;
It is what has .

Also, the communication interception method of the present invention, when receiving information from the management device that the terminal requested to be connected is subject to interception, the communication interception by the communication interception device that constructs a tunnel path between the terminal and the device itself. A method,
When the communication interception device receives a connection request from the first gateway, it makes an authentication request for the first gateway to the management device,
When the communication intercepting device receives an authentication result indicating that the first gateway is authenticated and information indicating that the second gateway is designated as a connection destination from the management device, the communication intercepting device requests the second gateway to connect. Establishing a tunnel path connecting each of the first and second gateways to the own device,
When the communication interception device receives data from one of the first and second gateways to be transmitted to or received from the communication partner for the terminal to be intercepted, the data is copied and automatically transmitted. The data is stored in the storage unit of the device and the data is transferred to the other gateway .

Furthermore, when the program of the present invention receives information from the management device that the terminal requested to be connected is an interception target, the communication interception device that constructs a tunnel path between the terminal and the device itself ,
Upon receiving a connection request from the first gateway, a procedure for making an authentication request for the first gateway to the management device;
Upon receiving from the management device an authentication result for authenticating the first gateway and information for designating the second gateway as a connection destination, the connection request is made to the second gateway, and the first and second gateways are requested. A procedure for establishing a tunnel path connecting each of the two gateways and the own device;
When data transmitted to or received from a communication partner for the terminal to be intercepted is received from one of the first and second gateways, the data is copied and stored in the storage unit of the device itself Then, a procedure for transferring the data to the other gateway is executed .

  According to the present invention, since only the call to be intercepted is processed via the communication interception device, the gateway device does not need to search whether it is the subject of interception for the call to be controlled. The load is reduced. Moreover, since it is not necessary to install a communication interception device in all of the plurality of tunnel routes connecting the gateways, the equipment cost for the communication interception can be suppressed.

It is a block diagram for demonstrating one structural example of the communication interception system of this embodiment. It is a block diagram for demonstrating the communication interception method in the communication interception system shown to FIG. 1A. It is a block diagram which shows the example of 1 structure of the subscriber management apparatus shown to FIG. 1A. It is a block diagram which shows one structural example of the communication interception management apparatus shown to FIG. 1A. It is a block diagram which shows one structural example of the communication interception apparatus shown to FIG. 1A. It is a block diagram at the time of applying the communication interception system of this embodiment to a WiMAX network. It is a block diagram for demonstrating the communication interception method in the communication interception system shown to FIG. 5A. It is a block diagram which shows one structural example of the communication interception apparatus shown to FIG. 5A. In Example 1, it is a sequence diagram which shows the operation | movement procedure of the communication interception when the session of the user who is notified beforehand and which is notified is established. In Example 1, it is a sequence diagram which shows the procedure until it starts communication interception with respect to the call of the tunnel path | route already established between ASN-GW and HA. In Example 1, it is a sequence diagram which shows the procedure which complete | finishes communication interception. 6 is a diagram for explaining a case of handover in Embodiment 1. FIG. 6 is a diagram for explaining a case of handover in Embodiment 1. FIG. It is a block diagram which shows the whole network containing the example of 1 structure of a related communication interception system. It is a block diagram for demonstrating the communication interception method by the communication interception system shown to FIG. 11A. It is a block diagram for demonstrating another structural example of the related communication interception system. It is a block diagram for demonstrating the case where a handover is performed in the communication system shown to FIG. 11B. It is a block diagram for demonstrating the case where a handover is performed in the communication system shown in FIG.

  The communication intercept system of this embodiment is demonstrated. FIG. 1A is a block diagram illustrating a configuration example of a communication intercept system according to the present embodiment. FIG. 1B is a diagram for explaining a communication interception method in the present embodiment. Note that, as described with reference to FIG. 11A, a plurality of GWs 40 and AGWs 50 are provided, and in this embodiment, there is a network similar to the network 2 illustrated in FIG. 11A. Here, in order to simplify the description, a case where there is one GW 40 and one AGW 50 will be described.

  In FIG. 1A and FIG. 1B, the tunnel path is schematically represented by a thick dotted line. The same reference numerals are given to the same components as those described in FIG. 12, and the detailed description thereof will be omitted.

  The communication system shown in FIG. 1A includes a GW 40 connected to a service network 80, radio base stations 60a and 60b, and an AGW 50. The terminal 701 or the terminal 702 is connected to the wireless base stations 60a and 60b by wireless communication.

  As shown in FIG. 1A, the communication interception system of this embodiment is a communication interception device 10 that intercepts communication, a communication interception management device 30 that manages the communication interception device 10, and a subscription related to a terminal connected to the service network 80. Subscriber management device 20 for managing subscriber information. In the present embodiment, the subscriber management device 20 and the communication interception management device 30 are provided separately, but one management server may be provided with the functions of both devices. Below, it demonstrates by the case where it provides separately.

  The communication interception device 10 is connected to each of the GW 40, the AGW 50, the subscriber management device 20, and the communication interception management device 30 through a control signal communication path. Further, the subscriber management device 20 is connected to each of the GW 40, the AGW 50, the communication interception device 10, and the communication interception management device 30 through a control signal communication path. The communication interception management device 30 is connected to each of the subscriber management device 20 and the communication interception device 10 via a control signal communication path.

  Terminal identifiers are given in advance to the terminals 701 and 702 and the terminal 75 shown in FIG. 1A as information serving as keys for identifying the terminals. The terminal identifier is different for each terminal. The terminal identifier is, for example, a telephone number or an IP address. Each device of the communication system and the communication interception system reads a terminal identifier included in a connection request from a terminal or data received from the terminal, and identifies a connection request source or a data transmission source terminal. Below, the description about the terminal identification operation | movement in each apparatus is abbreviate | omitted.

  Next, each configuration of the communication interception system shown in FIG. 1A will be described. FIG. 2 is a block diagram illustrating a configuration example of a communication interception management apparatus according to the present embodiment.

  As shown in FIG. 2, the communication interception management device 30 notifies the communication interception device 10 and the subscriber management device 20 of the operation unit 330 for designating a terminal to be intercepted and information on the terminal designated as the interception target. And a control unit 310. When the intercept target information, which is information for specifying the intercept target terminal, is input via the operation unit 330, the control unit 310 receives the terminal identifier of the intercept target terminal from the subscriber management device 20 and the communication interception. The device 10 is notified.

  The information to be intercepted is not limited to the terminal identifier such as the telephone number and IP address of the terminal, but may be the name of the user of the terminal. When the information to be intercepted is a user name, a storage unit (not shown) that stores data in which the user name and the terminal identifier are paired is provided in advance in the communication interception management device 30. Then, when a user name is input via the operation unit 330, the control unit 310 reads data including information that matches the input user name from a storage unit (not shown), and a terminal included in the read data The identifier is notified to the subscriber management device 20 and the communication interception device 10. Instead of providing a storage unit (not shown) for storing data in which a user name and a terminal identifier are paired, the control unit 310 sends inquiry information including information requesting a terminal identifier and user name information to the subscriber. The information may be transmitted to the management device 20 and the terminal identifier information may be acquired from the subscriber management device 20.

  The configuration of the control unit 310 is a dedicated circuit conforming to the function for executing the above-described operation. However, the control unit 310 is provided with a CPU (Central Processing Unit) (not shown) and a memory (not shown). The above function may be executed by the CPU executing the program stored in the above. As described above, when a storage unit (not shown) is provided in the communication interception management device 30, when the control unit 310 receives the information after the data analysis processing by the communication interception from the communication interception device 10, the information May be stored in a storage unit (not shown).

  Next, the configuration of the subscriber management apparatus will be described. FIG. 3 is a block diagram illustrating a configuration example of the subscriber management apparatus according to the present embodiment.

  As shown in FIG. 3, the subscriber management apparatus 20 includes a storage unit 220 that stores subscriber information and authentication information, and a control unit 210 that manages subscriber information stored in the storage unit 220 and performs authentication processing. Have. The subscriber information includes a terminal identifier of a terminal used by the user and user authentication information for authenticating the user. The authentication information is information for authenticating the GW 40, the AGW 50, and the communication interception device 10, and information on an IP address that is different for each device. The subscriber information may include user name information.

  When the control unit 210 receives from the gateway inquiry information including a request for authentication of the terminal that makes an entry request to the service network 80 and information on the terminal identifier, the control unit 210 refers to the user authentication information stored in the storage unit 220, and Notify the original gateway of the authentication result. At that time, the control unit 210 records a device identifier, which is information for specifying the gateway that has requested the authentication, in the subscriber information of the terminal. The device identifier is, for example, an IP address. In addition, when there is an inquiry for requesting authentication for any one of the GW 40, AGW 50, and the communication interception device 10, the control unit 210 notifies the inquiry source of the authentication result and performs authentication as in the user authentication process. The device identifier of the device to be authenticated is recorded in the authentication information corresponding to the inquiry source device.

  In addition, when the control unit 210 receives information on the terminal identifier of the terminal to be intercepted from the communication interception management device 30, the control unit 210 searches the storage unit 220 for subscriber information corresponding to the terminal identifier, and as a result of the search, When the subscriber information is found, information indicating that it is an object to be intercepted is added to the subscriber information. When the information on the terminal identifier of the terminal to be intercepted is received from the communication interception management device 30, if the tunnel path 3 is established between the terminal to be intercepted and another terminal, the control unit 210 may The following control is performed on the communication interception device 10. The control unit 210 instructs the AGW 50 to switch the connection destination of the call tunnel path 3 between the terminals from the GW 40 to the communication interception device 10. In addition, the control unit 210 notifies the communication interception device 10 of the IP address of the GW 40 in order to instruct the communication interception device 10 to connect to another tunnel path.

  Further, after registering the information to be intercepted in the subscriber information as described above, the control unit 210 receives from the AGW 50 information indicating that a connection request has been received from the terminal to be intercepted. For the call, the AGW 50 is instructed to set the tunnel path 5 with the communication interception device 10, and the communication interception device 10 is notified of the IP address of the GW 40.

  The configuration of the control unit 210 is a dedicated circuit in accordance with the function for executing the above-described operation. However, the control unit 210 is provided with a CPU (not shown) and a memory (not shown), and a program stored in the memory is stored. The above functions may be executed by the CPU.

  Next, the configuration of the communication interception device will be described. FIG. 4 is a block diagram illustrating a configuration example of the communication interception apparatus according to the present embodiment.

  As shown in FIG. 4, the communication interception device 10 includes a storage unit 112 for storing data transmitted from the terminal 701 to be intercepted to the communication partner or data received from the communication partner, the communication control unit 113, and the communication interception. And a control unit 111 including a unit 114.

  The communication control unit 113 receives information on the terminal identifier of the terminal to be intercepted from the communication interception management device 30 and, when there is a connection request from the AGW 50, inquires of the subscriber management device 20 about the authentication and connection destination of the AGW 50. When the communication control unit 113 receives the authentication of the AGW 50 and the IP address of the GW 40 from the subscriber management information 20, the communication control unit 113 establishes the tunnel route 5 connecting the AGW 50 and the own device, and the tunnel route 4 connecting the GW 40 and the own device. And the communication control part 113 will transfer to the other gateway, if the data which made the transmission object the terminal of an interception object via at least one gateway among two apparatuses of GW40 and AGW50 are received. In addition, when the communication control unit 113 receives data whose destination is a terminal to be intercepted via at least one of the two devices GW 40 and AGW 50, the communication control unit 113 transfers the data to the other gateway.

  The communication interception unit 114 copies the data transferred by the communication control unit 113 and stores it in the storage unit 112. At this time, the copied data may be analyzed, and the communication history such as the communication start time and the communication end time and the communication content may be recorded in the storage unit 112 in time series. Hereinafter, the process of copying data and the process of analyzing the copied data are referred to as an intercept process.

  The control unit 111 has a configuration in which a dedicated circuit corresponding to the function of each unit in the control unit is provided. However, the control unit 111 is provided with a CPU (not shown) and a memory (not shown), and a program stored in the memory. As the CPU executes, a part or all of the configuration of each unit may be virtually configured in the communication interception device.

  Next, the communication interception method of this embodiment is demonstrated with reference to FIG. 1A and FIG. 1B.

  First, as shown in FIG. 1A, it is assumed that the terminal 701 and the terminal 75 are connected via the radio base station 60a, the AGW 50, the tunnel path 3, the GW 40, and the service network 80. Similarly, the terminal 702 is connected to a terminal (not shown) via the radio base station 60b, the AGW 50, the tunnel path 3, the GW 40, and the service network 80. In such a normal operation state, the tunnel path 3 is established between the AGW 50 and the GW 40.

  Subsequently, when the interception target information including the information of the terminal identifier of the terminal 701 is input to the communication interception management apparatus 30 via the operation unit 330 illustrated in FIG. 2, the communication interception management apparatus 30 includes the terminal 701. Is transmitted to each of the subscriber management device 20 and the communication interception device 10 via the control unit 310. When the subscriber management device 20 receives information on the terminal identifier of the terminal 701 to be intercepted from the communication interception management device 30, the subscriber management device 20 communicates the connection destination of the call tunnel path 3 related to the terminal 701 from the GW 40 to the communication interception device. To switch to 10. On the other hand, the communication interception apparatus 10 will request | require connection with GW40, if the information of the terminal identifier of the terminal 701 used as interception object is received from the communication interception management apparatus 30. FIG.

  In accordance with an instruction from the subscriber management device 30, the AGW 50 switches the tip of the tunnel path 3 established with the GW 40 from the GW 40 to the communication interception device 10, and between the communication interception device 10 as shown in FIG. 1B. A tunnel path 5 is constructed. The GW 40 establishes a tunnel route 4 with the communication interception device 10 in accordance with a connection request from the communication interception device 10. In this way, the transmission path of data transmitted and received between the terminal 701 and the terminal 75 is switched from the tunnel path 3 shown in FIG. 1A to the tunnel path 4 and the tunnel path 5 shown in FIG. 1B. The communication interception device 10 performs an intercept process on the call of the terminal 701 received from each of the AGW 50 and the GW 40. Note that the tunnel route 3 shown in FIG. 1A is used as it is for a call between a terminal 702 and a terminal (not shown) that are not subject to interception. In this way, a tunnel route is established for each terminal.

  In this embodiment, when non-intercepting data is transmitted / received between the GW 40 and the AGW 50, the GW 40 and the AGW 50 directly exchange data via the tunnel path, but the intercepting data is transmitted / received between the GW 40 and the AGW 50. 1A, the tunnel route shown in FIG. 1A is switched to the tunnel route shown in FIG. 1B, and the tunnel route connecting the GW 40 and the AGW 50 is connected via the communication interception device 10.

  In FIG. 1A and FIG. 1B, the devices of the GW 40, the AGW 50, the subscriber management device 20, the communication interception device 10, and the communication interception management device 30 are connected to facilitate understanding of the exchange of control signals between the devices. Although the control signal communication path to be performed is schematically shown, these devices may be connected by a dedicated network. In that case, it is assumed that means for preventing unauthorized entry into the communication interception system, such as a firewall, is provided between each of the GW 40 and the AGW 50 and a dedicated network.

  As described in the section of the subject of the present invention, in order to implement communication interception, it is necessary to provide the GW and AGW with a function for interception or to install an interception device for each route. there were. It is desirable for operators to minimize the arrangement of equipment for functions related to interception. In general, the calls to be intercepted may be some of the calls that are in operation.

  In this embodiment, for a call to be intercepted, a tunnel route connected between the GW and the AGW is constructed via a communication interception device using a tunnel protocol used in the mobile communication network. Therefore, the GW and the AGW do not need a function for communication interception, and only perform normal communication processing. And GW and AGW enable communication interception only by switching the constructed tunnel route to the interception target call via the communication interception device. Therefore, it is possible to suppress a decrease in communication processing without affecting normal communication. In addition, even if the network size increases, it is not necessary to increase the number of devices for communication interception, and it is possible to reduce the equipment cost for communication interception.

  In the communication intercept system shown in FIG. 12, the intercept device 410 recognizes to which gateway the received packet should be forwarded by using information on the IP layer of the communication protocol and sends it out. When a call to be intercepted uses a tunnel protocol, information serving as a key for identifying the call is usually higher than the IP layer in a plurality of layers of the communication protocol. Therefore, in order to check whether the packet is related to the terminal to be intercepted, the intercepting device 410 analyzes the packet to some extent in order to read out the key information, and searches whether the packet is to be intercepted. There is a need to. Therefore, high analysis processing capability is required for the communication interception device. Furthermore, depending on the tunnel protocol, the inside of the tunnel may be encrypted, and in this case, there is a possibility that the intercepting device 410 cannot retrieve information as a key.

  On the other hand, the communication interception device of the present embodiment does not need to search for all received packets because they are all interception targets. Even when a packet is encrypted using a tunnel protocol that encrypts the inside of the tunnel, the communication interception device 10 terminates the tunnel path, so that the encrypted packet can be decrypted, and the interception process is hindered. There is no.

  In this example, the communication interception system of this embodiment is applied to a WiMAX network. FIG. 5A is a block diagram when the communication intercept system of the present embodiment is applied to a WiMAX network. FIG. 5B is a block diagram for explaining a communication interception method in the communication interception system shown in FIG. 5A. 5A and 5B, the tunnel route is schematically represented by a thick dotted line.

  The communication system includes an HA (Home Agent) 45 corresponding to the GW 40 illustrated in FIG. 1A, an ASN-GW (Access Service Network-Gateway) 55 corresponding to the AGW 50, and a BS (Base Station) corresponding to the radio base station 60. 65.

  The communication interception system corresponds to a communication interception device 15 corresponding to the communication interception device 10 shown in FIG. 1A, an AAA (Authentication, Authorization and Accounting) server 25 corresponding to the subscriber management device 20, and a communication interception management device 30. Communication interception management device 35. The communication path connecting the devices is the same as the configuration described with reference to FIG. 1A, and thus detailed description thereof is omitted. The tunnel route to be intercepted is ASN-GW55-communication interception device 15-HA45.

  When receiving a connection switching instruction from the external device, the ASN-GW 55 switches the connection destination of the tunnel path from the HA 45 to the communication interception device 15 according to the instruction, or switches from the communication interception device 15 to the HA 45. A tunnel route 6 shown in FIG. 5A shows a case where the connection destination of the ASN-GW 55 is switched from the communication interception device 15 to the HA 45. A tunnel route 8 illustrated in FIG. 5B illustrates a case where the connection destination of the ASN-GW 55 is switched from the HA 45 to the communication interception device 15. In this embodiment, the external device that instructs connection switching is the AAA server 25.

  When there is a connection request from the ASN-GW 55, the communication interception device 15 constructs the tunnel route 8 connected to the ASN-GW 55 according to the connection request, notifies the HA 45 of the connection request, and between the HA 45 A tunnel route 7 is constructed.

  The AAA server 25 stores, in addition to subscriber information including user authentication information, authentication information for authenticating the HA 45, the ASN-GW 55, and the communication interception device 15, and information on the IP addresses of these devices (not shown). ). When the AAA server 25 receives an authentication request from the HA 45 or the ASN-GW 55 for the terminal that has made a connection request, the AAA server 25 notifies the request source of the authentication result and also sends the IP address of the request source device to the subscriber information of the terminal. To record.

  Further, when the AAA server 25 receives a notification of the terminal identifier of the terminal to be intercepted from the communication interception management device 35, the AAA server 25 stores the terminal identifier in a storage unit (not shown). When receiving a notification about a terminal to be intercepted, if the terminal is communicating, the ASN-GW 55 is instructed to switch the connection of the tunnel route, and the tunnel route connection is switched to the ASN-GW 55 according to the notification of the end of the interception. Instruct.

  On the other hand, when the terminal to be intercepted is not communicating, the AAA server 25 obtains information on the terminal identifier of the terminal that requests connection to the ASN-GW 55 from the ASN-GW 55, and whether or not the terminal is to be intercepted. Is determined with reference to a terminal identifier registered in a storage unit (not shown). As a result of the determination, if the terminal making a connection request to the ASN-GW 55 is a terminal to be intercepted, the AAA server 25 instructs the ASN-GW 55 to switch the connection for the tunnel route related to the call of the terminal.

  From the HA 45, it appears that the tunnel connection destination has moved from the ASN-GW 55 to the communication interception device 15 according to the protocol, and this is within the normal operation range of the HA 45 and has special operations for the HA. Therefore, detailed description thereof is omitted.

  Next, the configuration of the communication interception device 15 shown in FIG. 5A will be described. FIG. 6 is a block diagram illustrating a configuration example of the communication interception apparatus illustrated in FIG. 5A.

  The communication interception device 15 processes a control signal in the mobile communication network, controls a tunnel protocol and session, a tunnel control unit 151 that processes a tunnel packet between the ASN-GW 55, an HA 45 A tunnel processing unit 153 that processes a tunnel packet between the communication unit, a communication interception unit 154 that copies data between the tunnel processing units, a data analysis unit 155 that analyzes the copied data, and a post-analysis required A data accumulating unit 156 that accumulates data and an intercept control unit 157 that processes an instruction from the communication interception management device 35.

  The data analysis unit 155 analyzes the data received from the communication interception unit 154 and records the communication history such as the communication start time and the communication end time and the communication contents in the data storage unit 156 in time series. The contents of communication are the contents of a call if the terminal to be intercepted is a telephone, and information indicating which site has been accessed on the network website if the data transmitted or received by the terminal to be intercepted is a packet. is there. Hereinafter, the information after data analysis is referred to as intercept information.

  The communication control unit 113 shown in FIG. 4 includes a tunnel control unit 151, a tunnel processing unit 152, a tunnel processing unit 153, and an intercept control unit 157. The communication interception unit 114 shown in FIG. 4 corresponds to the communication interception unit 154, and the data analysis unit 155 is provided in the control unit 111 shown in FIG. The storage unit 112 illustrated in FIG. 4 corresponds to the data storage unit 156.

  Each of the tunnel control unit 151, the tunnel processing unit 152, the tunnel processing unit 153, the communication interception unit 154, the data analysis unit 155, and the interception control unit 157 includes a dedicated circuit for executing each function. However, the communication interception device 15 is provided with a CPU (not shown) for executing processing in accordance with the program and a memory (not shown) for storing the program, and any or all of the above-described units are all stored by the CPU. It may be configured virtually in the communication interception device by executing the program.

  Here, the tunnel processing unit 152 and the tunnel processing unit 153 are provided, but instead of providing a tunnel processing unit individually corresponding to the connection destination, the function of one tunnel processing unit is logically changed according to the role. It may be separated.

  Next, an example of operation | movement of the communication interception system of a present Example is demonstrated. Here, an operation procedure for starting communication interception when information on a user to be intercepted is registered in the AAA server 25 in advance and a session of the user is established will be described.

  FIG. 7 is a sequence diagram showing an operation procedure of communication interception when a user session to be intercepted, which is notified in advance, is established in the communication interception system of the present embodiment.

  When the terminal identifier of the terminal 701 is input together with an instruction to specify the terminal to be intercepted, the communication interception management apparatus 35 uses the terminal identifier of the terminal 701 as information on the terminal to be intercepted, and the communication interception apparatus 15 and the AAA server 25. (Steps 101 and 102). At that time, the communication interception management device 35 may notify the communication interception device 15 of information on what kind of communication is requested. The AAA server 25 stores the terminal identifier of the terminal 701 to be intercepted in a storage unit (not shown). Thereafter, when the terminal 701 requests an entry from the ASN-GW 55 to communicate with the terminal 75, the entry request from the terminal 701 is notified to the ASN-GW 55 (step 103).

  The ASN-GW 55 notifies the AAA server 25 of an authentication request (Radius: Access Request) including terminal identifier information in order to perform user authentication for the terminal 701 (step 104). The AAA server 25 performs user authentication of the terminal 701 using the stored user authentication information. If the user authentication is successful, the AAA server 25 determines whether or not the terminal 701 that has requested connection to the ASN-GW 55 is an intercept target. If it is determined that the terminal 701 is a terminal to be intercepted, the AAA server 25 uses the communication intercepting device instead of the IP address of the HA 45 as the attribute of the connection destination device in the authentication success notification (Radius: Access Accept). 15 IP addresses are set and responded to the ASN-GW 55 (step 105). The AAA server 25 records the IP address of the ASN-GW 55 in the subscriber information corresponding to the terminal 701.

  When the ASN-GW 55 receives the authentication success notification for the terminal 701 from the AAA server 25, it sends a connection request (Mobile IPv4: Registration Request) to the notified connection destination device (step 106). Here, the connection destination device is the communication interception device 15.

  The communication interception device 15 stores information related to the terminal 701 received from the communication interception management device 35. Thereafter, when receiving a connection request from the ASN-GW 55, the communication interception device 15 inquires the AAA server 25 for authentication information related to the ASN-GW 55 in order to perform a tunnel path connection process in the same manner as a normal HA operation (Step S1). 107). The AAA server 25 notifies the communication interception device 15 of the authentication information related to the ASN-GW 55 and the GW information including the IP address information of the HA 45 that is the final connection destination (step 108). Further, the AAA server 25 records information on the IP addresses of the ASN-GW 55 and the HA 45 in the authentication information of the communication interception device 15. Below, the AAA server 25 records the connection destination IP address history for each of the terminal, the gateway, and the communication interception device 15 in communication in the subscriber information and the authentication information.

  When the communication interception device 15 receives the authentication information related to the ASN-GW 55 and the GW information indicating the final connection destination from the AAA server 25, the communication interception device 15 makes a connection request (Mobile IPv4: Registration Request) to the HA 45 based on the received information on the final connection destination. Is notified (step 109). Upon receiving a connection request from the communication interception device 15, the HA 45 notifies the communication interception device 15 of connection completion (Mobile IPv4: Registration Reply), and establishes the tunnel path 7 with the communication interception device 15 (step 110). .

  Further, after the establishment of the tunnel route 7 with the HA 45 is completed, the communication interception device 15 notifies the ASN-GW 55 of the completion of connection, and establishes the tunnel route 8 with the ASN-GW 55 (step 111). The ASN-GW 55 notifies the terminal 701 that the entry has been completed (step 112).

  Through step 110 and step 111, the packet of the terminal 701 is transmitted in the tunnel (step 113). After the establishment of the tunnel paths 7 and 8 is completed, the communication interception device 15 copies the packet in the tunnel at the communication interception unit 154 and starts the interception process (step 114). Then, intercept information, which is information obtained as a result of analyzing the copied data, is transmitted to the communication intercept management device 35 as necessary (step 115).

  Next, a procedure until communication interception is started for a call in which a tunnel path has already been established between the ASN-GW 55 and the HA 45 will be described.

  FIG. 8 is a sequence diagram illustrating a procedure until communication interception is started for a call on a tunnel route already established between the ASN-GW and the HA in the communication interception system according to the present embodiment. Note that the display of the terminal 701 is omitted in FIG. 8 and FIG. 9 referred to in the following description.

  As shown in FIG. 5A, the tunnel path 6 has already been established between the terminal 75 and the terminal 701 (step 201). When the instruction to designate the terminal 701 as the terminal to be intercepted and the terminal identifier of the terminal 701 are input, the communication interception management apparatus 35 performs the same as in steps 101 and 102 shown in FIG. The terminal identifier 701 is notified to the AAA server 25 and the communication interception device 15 (steps 202 and 203).

  When the AAA server 25 receives information on the terminal identifier of the terminal 701 to be intercepted from the communication interception management apparatus 35, the AAA server 25 refers to the subscriber information corresponding to the terminal 701, and the apparatus that has requested authentication of the terminal 701 is ASN- Recognize that it is GW55. Then, the AAA server 25 notifies the ASN-GW 55 of the IP address of the communication interception device 15 as a connection destination device in response to a switching instruction (Radius: Change of Authorization) for the communication path of the terminal 701 (step 204). Connection switching is executed in the same manner as steps 106 to 111 shown in FIG. 7 (steps 205 to 210). As shown in FIG. 5B, tunnel paths 7 and 8 are established.

  When the switching of the tunnel connection is completed, the ASN-GW 55 notifies the AAA server 25 of the switching completion (Radius Change of Authorization Ack) (step 211). Subsequently, similarly to Steps 113 to 115 shown in FIG. 7, the communication interception device 15 starts intercepting data transmitted and received by the terminal 701 (Steps 212 to 214).

  Next, a procedure for terminating communication interception will be described. FIG. 9 is a sequence diagram illustrating a procedure for terminating communication interception in the communication intercept system of the present embodiment.

  The communication interception device 15 constructs tunnel paths 7 and 8 between the ASN-GW 55 and the HA 45, respectively, and performs communication interception of data transmitted and received by the terminal 701 (step 301). When the terminal identifier of the terminal 701 is input together with an instruction to end the communication interception, the communication interception management device 35 notifies the AAA server 302 and the communication interception device 15 of the end of the intercept including the information of the terminal identifier (step 302). 303).

  When the AAA server 25 receives an instruction to end the intercept from the communication interception management device 35, the AAA server 25 notifies the ASN-GW 55 of a switching instruction (Radius: Change of Authorization) to the communication path of the terminal 701 and notifies the connection destination device. . At that time, the AAA server 25 notifies the ASN-GW 55 of the IP address of the HA 45 to which one end of the tunnel route 7 constructed by the communication interception device 15 is connected as a new connection destination device (step 304).

  When the ASN-GW 55 receives the switching instruction and the information of the connection destination device from the AAA server 25, the ASN-GW 55 notifies the connection request to the HA 45 serving as the notified connection destination device (step 305). When the connection request is received from the ASN-GW 55, the HA 45 switches the connection destination from the communication interception device 15 to the ASN-GW 55. The HA 45 notifies the ASN-GW 55 of the connection completion and switches the tunnel route (step 306). A tunnel path 6 is established between the ASN-GW 55 and the HA 45, and a packet transmitted / received by the terminal 701 is transmitted through the tunnel path 6 (step 307).

  When the tunnel path 6 is established with the HA 45, the ASN-GW 55 notifies the AAA server 25 of the completion of switching (step 308). The communication interception device 15 notifies the AAA server 25 of the end of the interception, and then terminates the interception after a certain period of time (step 309). And the communication interception apparatus 15 notifies the communication interception management apparatus 35 of the interception end notification containing the information to the effect of notifying the end of interception (step 310).

  In addition, when the user of the terminal 701 to be intercepted disconnects himself / herself, the subsequent processing is the same as when a normal terminal not to be intercepted disconnects, and thus detailed description thereof is omitted.

  Next, a case of handover in the communication intercept system of the present embodiment will be described. 10A and 10B are diagrams for explaining the case of handover in the present embodiment. Here, it is assumed that the terminal 701 is a terminal to be intercepted. Further, the control signal communication path connecting each of the ASN-GWs 55a and 55b and the subscriber management device 25 is not shown in the figure.

  As shown in FIG. 10A, when the terminals 701 and 75 are communicating, data exchanged between these terminals is transmitted via the tunnel paths 7 and 8. The communication interception device 15 performs interception processing on data received via the tunnel paths 7 and 8. When the terminal 701 moves from the communication area of the BS 65a to the communication area of the BS 65b, the BS 65b can communicate with the terminal 701. The BS 65b notifies the ASN-GW 55b of information on the terminal 701 that has become newly communicable.

  The ASN-GW 55 b requests the subscriber management apparatus 25 for authentication for the terminal 701. Subsequently, as a response, the ASN-GW 55b receives the authentication result and the IP address information of the communication interception device 15 as the connection destination of the tunnel path from the subscriber management device 25. After that, the same processing as Step 106 to Step 113 shown in FIG. 7 is performed, and the tunnel route 7 and the tunnel route 9 are constructed as shown in FIG. 10B. The communication interception device 15 performs interception processing on data received via the tunnel paths 7 and 9.

  In this embodiment, the ASN-GW 55a does not notify the ASN-GW 55b that the terminal 701 is to be intercepted, and the ASN-GW 55b starts preparation processing for intercepting even if the terminal 701 is taken over. There is nothing. The process performed by the ASN-GW 55b is the same as the normal handover. Even if a handover is performed on the communication of the terminal 701 to be intercepted, the communication intercepting apparatus 15 simply changes the connection destination of the tunnel path from ASN-GW 55a to ASN-GW 55b, and continues to receive all of the received data. Interception processing may be performed. In the present embodiment, no other communication interception device is required, and it is not necessary to switch the interception process to another communication interception device.

  As described above, the communication interception apparatus according to the present embodiment explicitly interrupts between AGW and GW only for a call to be intercepted using the tunnel protocol (mobility protocol) used in the mobile communication network. The end of the tunnel is connected and data is intercepted when data is relayed.

  As described above, in the present embodiment, the GW and AGW in the network do not need a function for communication interception, and it is not necessary to provide a communication interception device for each route. In addition, a device that performs an intercept process for copying and analyzing data to be intercepted is functionally separated, and the intercept process is concentrated and executed on some devices. Therefore, deployment costs (CAPEX: Capital Expenditure) can be suppressed as compared with the case where a gateway device having a function for communication interception is deployed in the entire network or when a communication interception device is deployed for each route.

  In addition, if a device that performs interception processing can be connected via an IP network, it can be geographically separated from the GW node. Therefore, interception processing can be centrally managed via the IP network, and an operating cost (OPEX: Operating Expense) can be obtained. ) Is suppressed. If a communication path is constructed with each GW node using the tunnel protocol, a configuration for separating the devices that execute the intercept processing in the network using the tunnel protocol can be taken, and the devices can be centrally managed.

  In addition, since only the call to be intercepted is processed via the communication interception device, the influence on calls other than the intercepted object can be suppressed during the interception. In addition, since the communication interception device does not need to process whether the call to be controlled is to be intercepted and distinguish it from the call that is not intercepted, preparation processing for intercepting each of the AGW and GW Rather than providing functions, it is possible to simplify processing and configuration.

  Furthermore, even if the communication interception device performs interception processing on the data to be intercepted exchanged between two gateways, even if one gateway is changed due to handover, the connection destination of the tunnel route is changed. Therefore, the communication interception device only needs to continue the interception process for the data transferred by itself. Therefore, it is not necessary to perform the notification of the interception target between the gateways described in FIG. 13, and it is not necessary to perform the notification of the interception target between the communication interception apparatuses described in FIG. 14.

2 Network 10, 15 Communication interception device 20 Subscriber management device 25 AAA server 30, 35 Communication interception management device 40 GW
45 HA
50 AGW
55 ASN-GW
80 Service network

Claims (6)

A communication interception system for intercepting communications,
A management device that identifies a terminal to be intercepted;
A communication interception device that intercepts the communication of the terminal to be intercepted,
When the management device specifies that the terminal requested to be connected is an intercept target, it notifies the communication intercept device that the terminal is an intercept target,
The communication interception device is
A storage unit for storing data received from the data or communicating party the interception target terminal sends to the communication partner, when receiving a connection request from the first gateway, said managing an authentication request relating to said first gateway When receiving the authentication result of the first gateway and information indicating that the second gateway is designated as a connection destination from the management device, the device requests the second gateway to connect, and When a tunnel path connecting each of the second gateways and the own device is established, and the data about the terminal to be intercepted is received from one of the two gateways, the data is copied and the own device is copied. And a control unit that stores the data in the storage unit and transfers the data to the other gateway. The communication interception system according to claim 1,
The management device
A storage unit which the terminal identifier is stored for identifying the terminal interception target, information indicating that a connection request from the terminal of the terminal identifier to the first gateway that matches the terminal identifier stored in the storage unit Is received from the first gateway, the first gateway is notified of information indicating that the connection destination of the tunnel path for communication of the terminal to be intercepted is designated to the communication interception device, and the first gateway Upon receiving the authentication request for the gateway from the interception device, transmits the information to the effect that specifies the second gateway said first gateway as an authentication result indicating that authentication and other destination to the communication interception device A communication interception system having a control unit. The communication interception system according to claim 1,
The management device
A storage unit in which subscriber information including information on terminal identifiers different for each terminal and information for specifying a gateway connected to the terminal is stored, and information on terminal identifiers of terminals to be intercepted from the communication interception management device. Upon receipt, reading the subscriber information include an identifier corresponding to the terminal identifier from the storage unit, with respect to the first gateway recorded in the subscriber information, the tunnel for communication of the interception target terminal The first gateway is notified of information indicating that the connection destination of the route is designated to the communication interception device, and the first gateway is authenticated when an authentication request regarding the first gateway is received from the communication interception device. and a control unit that transmits information to the effect that specifies the second gateway as a fact of the authentication result and other destination to the communication interception device, wiretapping cis Beam. When receiving information from the management device that the terminal requested to be connected is an interception target, a communication intercepting device that constructs a tunnel path between the terminal and the device,
A storage unit for storing data to be transmitted to or received from a communication partner by a terminal to be intercepted;
Upon receiving the connection request from the first gateway, indicating that specifies perform authentication request for the first gateway to the management apparatus, the authentication result and the second gateway to the effect that authenticates the first gateway to the destination Is received from the management device, the second gateway is requested to connect, and a tunnel path is established for connecting each of the first and second gateways to the own device. When receiving the data for the terminal of the interception target from one gateway, and a control unit which is copied the data stored in the storage unit of the own device, and transfers the data to the other gateway,
That communication interception apparatus having a. Upon receiving the information indicating the connection requested terminal is intercepted target from the management device, a communication interception method according to wiretapping device for constructing a tunnel path between the terminal and the host device,
When the communication interception device receives a connection request from the first gateway, it makes an authentication request for the first gateway to the management device,
When the communication intercepting device receives an authentication result indicating that the first gateway is authenticated and information indicating that the second gateway is designated as a connection destination from the management device, the communication intercepting device requests the second gateway to connect. Establishing a tunnel path connecting each of the first and second gateways to the own device,
When the communication interception device receives data from one of the first and second gateways to be transmitted to or received from the communication partner for the terminal to be intercepted, the data is copied and automatically transmitted. A communication interception method of storing in a storage unit of a device and transferring the data to the other gateway . Upon receiving information from the management device that the terminal requested to be connected is a target of interception, a communication interception device that constructs a tunnel path between the terminal and the own device ,
Upon receiving a connection request from the first gateway, a procedure for making an authentication request for the first gateway to the management device;
Upon receiving from the management device an authentication result for authenticating the first gateway and information for designating the second gateway as a connection destination, the connection request is made to the second gateway, and the first and second gateways are requested. A procedure for establishing a tunnel path connecting each of the two gateways and the own device;
When data transmitted to or received from a communication partner for the terminal to be intercepted is received from one of the first and second gateways, the data is copied and stored in the storage unit of the device itself And a program for executing a procedure for transferring the data to the other gateway .

Images