KR20120106302A - Ims having packet analysis function apparatus, lawful interception system based on ims using this and method the same - Google Patents

Abstract

The present invention provides an IMS network server having a PAF (Packet Analysis Function) device capable of listening to all traffic to a target terminal without changing or adding an existing node by introducing a PAF device in an IMS network environment, and an IMS network-based eavesdropping using the same. A system and method thereof are provided.

Description

IMS network server with PAF device, IMS network based interception system and method therefor {IMS having Packet Analysis Function Apparatus, Lawful Interception System based on IMS using this and Method the same}

The present invention relates to a legal interception method, and more particularly, to introduce a PAF (Packet Analysis Function) device that can listen to all the traffic to the target terminal without changing or adding the existing node by introducing a PAF device in the IMS network environment The present invention relates to an IMS network server having an IMS network-based interception system using the same, and a method thereof.

Lawful interception must be provided in the IMS network, which means that legally binding agencies must communicate legally with the parties to whom the legally binding agency collects and grasps information for various reasons, including public interest and arrest of criminals. To collect the content.

In most countries, lawful interception is required by law, and if a national interception agency requests such a legal interception, the carrier is obliged to provide a legal interception function.

In order to support such legal interception, additional development of many nodes is required, which is a huge burden on the service provider side.

Therefore, there is a need to propose a new model that can easily provide legal interception without changing existing nodes such as SBC, IBCF or C4 switches or developing additional nodes.

In order to solve the above-mentioned problems, an object of the present invention is to provide a new service model that can easily provide legal interception without changing existing nodes or developing additional nodes in an IMS network.

An embodiment of the present invention for achieving the above object is, by the CSCF receiving the call data transmitted from the terminal of the subscriber to listen to the interception setting information generated based on the SDP information included in the call data; It provides a PAF device of an IMS network server, which is received from a CSCF, extracts a corresponding traffic using the interception setting information, and provides the eavesdropping device.

On the other hand, according to another embodiment of the present invention for achieving the above object, when the call data is received from the terminal of the subscriber to be intercepted, the source information and the destination information is extracted from the SDP information of the call data to generate the eavesdropping setting related information. CSCF; And when the eavesdropping setting related information is received from the CSCF, provides an IMS network server having a PAF device including a PAF which extracts a corresponding traffic using the eavesdropping setting related information and provides it to the eavesdropping device.

On the other hand, according to another embodiment of the present invention for achieving the above object, when receiving an interception request message including the terminal information of the subscriber to be intercepted from the interception requesting agency, interception of the terminal information of the subscriber to be intercepted Device; And receiving the terminal information of the subscriber to be intercepted from the eavesdropping device, extracting the source information and the destination information from the SDP information of the call data transmitted from the terminal of the eavesdropping subscriber, and generating the eavesdropping setting related information from the CSCF. When the interception setting-related information is received, an IMS network-based interception system is provided, including; an IMS network server comprising a PAF which extracts a corresponding traffic using the interception setting-related information and provides the interception device.

On the other hand, another embodiment of the present invention for achieving the above object, step 1, the CSCF receives the call data from the terminal of the subscriber to be intercepted through at least one edge node; Generating, by the CSCF, the interception setting related information based on the SDP information included in the call data and transmitting the same to the PAF; And three steps of the PAF monitoring at least one or more edge nodes using the interception setting-related information, extracting corresponding traffic, and providing the corresponding traffic to the interception apparatus.

According to the present invention, by introducing a PAF in the IMS network server to collect the communication information of the target terminal in the PAF it is possible to efficiently listen to the communication content of the target terminal without changing the existing nodes or addition of nodes in the conventional IMS network. have. As a result, the present invention can also reduce the number of nodes that must be managed in order to intercept communication contents.

1 is a schematic diagram schematically showing a network relationship of an IMS network-based eavesdropping system according to an embodiment of the present invention.
FIG. 2 is a block diagram illustrating a configuration of an IMS network server-based eavesdropping system illustrated in FIG. 1 and an interface structure between each component.
3 is a block diagram showing the detailed configuration of the IMS network-based interception system shown in FIG.
4 is an exemplary diagram illustrating a messaging flow according to a process of processing an eavesdropping on a message of a target terminal in the IMS network-based eavesdropping system shown in FIG. 1.
FIG. 5 is an exemplary diagram illustrating a messaging flow according to a process of processing an eavesdropping on a message and a communication content (CC) for a target terminal in the IMS network-based eavesdropping system shown in FIG. 1.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention. In addition, the same code | symbol is attached | subjected about the similar part throughout the specification. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.

For reference, in the specification of the present invention, interception, legal interception, interception of target terminal and target terminal are used in the same sense, and may be used interchangeably.

1 is a schematic diagram schematically showing a network relationship of an IMS network-based eavesdropping system according to an embodiment of the present invention.

As shown in FIG. 1, the IMS network-based interception system according to the present invention includes an access network 20, an IMS network server 30, a hearing interceptor (Lawful Interception Function, LIF) 40, and a listening interrogator (Law). Enforcement Agency, LEA) (50).

Here, the access network 20 implements multimedia services such as voice, audio, video, and data between the wireless communication network, the CS network (wired telephone network (PSTN)), or other IMS networks to the IMS network server 30. request.

In addition, the IMS network server 30 intercepts the terminal (User Event, UE, interception target terminal or target terminal) 10 of the subscriber to be intercepted in response to the call data interception request of the interception requesting agency 50. Initiate.

The initiation of such interception may be performed by extracting terminal information (auditing target identification information) for the target terminal 10 and setting the interception of the target terminal 10 in a waiting state, or by the terminal information (targeting target) of the target terminal 10. Identification information) in a predetermined storage device.

The IMS network server 30 maintains an eavesdropping wait state for the target terminal 10 corresponding to the call data interception request of the interception requesting agency 50, and the target terminal 10 communicates through the access network 20. When starting, the communication content (CC) for the target terminal 10 is collected from each of at least one or more nodes, and transmits the collected communication content (CC) to the interception device (40). At this time, at least one node is a border gateway node, such as SBC, IBCF and C4 Switch, IBCF is an edge node that serves as an access point with other IMS networks, C4 Switch is an existing PSTN or other network An edge node that interacts with.

At the same time, when the interception request message is received from the interrogation device 40, the IMS network server 30 transmits interception-related information (IRI) to the interception device 40 in a corresponding call session control function (CSCF).

Here, the interception related information (IRI) is divided into communication related information indicating whether a successful call, service related information such as a service profile for each customer, and user location information.

Then, the interception apparatus (LIF) 40 receives a call data interception request message for the target terminal 10 from the interception request authority (LEA) 50. In response to the call data interception request, the interception apparatus 40 may transmit a call data interception request for the target terminal 10 to the IMS network server 30 through a message transmission and reception with the IMS network server 30.

In addition, the interception request agency (LEA) 50 is a national interception agency, and may be a law enforcement agency.

FIG. 2 is a block diagram illustrating a configuration of an IMS network server-based eavesdropping system illustrated in FIG. 1 and an interface structure between each component.

As shown in FIG. 2, the IMS network server 30 includes a CSCF 31, a PAF 32, and at least one border gateway node (not shown) to perform legitimate eavesdropping on a target terminal. .

More specifically, referring to the configuration of the IMS network server 30, when the CSCF 31 receives the call data interception request message including the terminal information of the subscriber to be intercepted from the interception authority (LIF) 40, at least one or more In connection with the border gateway node, access of the interception-related control data to the target terminal is performed. Then, the accessed information is transmitted to the delivery unit (DF) 42.

In addition, when the CSCF 31 receives the call data interception request message including the terminal information of the subscriber to be intercepted from the interrogation authority (LIF) 40, the CSCF 31 includes a service description protocol (SDP) included in the call data transmitted from the target terminal. The interception-related information related to the received call data based on the information is transmitted to the PAF 32 so that the PAF 32 collects the communication contents (CC) for the target terminal using the interception-related information. Here, the interception related information related to the call data is information obtained by processing the voice traffic related information (origin and destination information of the media traffic) included in the SDP in the SIP message.

In addition, the CSCF 31 changes the source information and the destination information of the SDP to set the PAF 32 as a pass-through node for performing communication between the target terminal and the destination terminal to form a bearer channel. That is, the CSCF 31 transmits the response call data in which the destination information of the SDP in the call data received from the target terminal is changed to the PAF 32 to the target terminal to establish a call, and at the same time, the SDP in the received call data is set. The PAF 32 is set as a passthru node by setting the call after transmitting the call data in which the source information is changed to the PAF 32 and receiving the response call data.

Meanwhile, when the CSCF 31 receives the call data (SIP message) transmitted by the target terminal through another IMS network server, the CSCF 31 transmits the PAF 32 to the communication path based on the SDP (Service Description Protocol) information included in the SIP message. It is set as a transit nor and transmits interception information (IRI) to the delivery unit (DF) 42 of the interception organ 40.

At this time, the interception related information (IRI) that the CSCFF 32 transmits to the interception organ (LIF) 40 is transmitted in real time or at regular intervals.

In addition, the PAF 32 accesses at least one or more border gateway nodes to access interception-related control / bearer data of the target terminal. That is, the PAF 32 accesses the communication contents (CC) for the target terminal without disturbing the communication of the target terminal, and accesses the accessed communication contents (CC) in a form that can be used by the transfer unit (DF) 42. The change is transferred to the transfer unit (DF) 42.

In this case, when the PAF 32 performs a lot of access to the communication contents (CC) of the target terminal, performance degradation occurs due to copying of the memory, and thus the communication contents of the target terminal ( Access to CC may be performed through a mirroring port.

Specifically, the PAF 32 forms a bearer channel by receiving the SIP message and the SDP information received from the CSCF 31, and dumps the media data of the corresponding target terminal through the bearer channel (DUPM) or the eavesdropping device (LIF). 40 is transmitted to the delivery unit (DF) 42 of.

At this time, the media data transmitted by the PAF 32 to the interrogation organ (LIF) 40 is transmitted in real time or at regular intervals.

Then, the listening device (LIF) 40 is a control unit (ADMinistration Function, ADMF, hereinafter referred to as ADMF) for transmitting the interception request message including the target terminal information to the CSCF 31 of the IMS network server 30 (41). And a delivery unit 42 for receiving the interception related information IRI from the CSCF 31 and the media data from the PAF 32.

Here, the transfer unit (DF) 42 may be configured to include a plurality, and may be provided with a mediation function (not shown) therein. The intermediary unit MF is located between the IMS network server 30 and the interception request authority (LEA) 50, and converts the received control / bearer data of each target terminal into a message of a predetermined type to handover the interface. The handover interface (HI) is transmitted to the LEMF 51 of the interception request authority (LEA) 50.

The interception device (LIF) 40 provides an interface with the interception request authority (LEA) 50, and also provides an interface between the CSCF 31 and the PAF 32 of the IMS network server 30.

More specifically, the configuration of the interception apparatus 41, the control unit (ADMF) 41 performs a management function of the legal interception, that is, the command management for interception in the IMS network server 30, the IMS network server 30 The eavesdropping requirements for the eavesdropping related control / bearer data are transmitted to the CSCF 31.

The transfer unit (DF) 42 controls control data of each target terminal input from the CSCF 31 of the IMS network server 30 and each input from the PAF (Packet Analysis Function) 32 of the IMS network server 30. The intercepted bearer data of the target terminal is transmitted to the interception request authority (LEA) 50. Here, the interception-related control data is interception information (IRI), the bearer data is the communication content (CC).

The LEMF 51 of the interception request authority (LEA) 50 is a monitoring device and processes the collected control / bearer data.

Now, in the present embodiment, the interface structure between the components of the IMS network server-based interception system will be described. In this system, information exchange between the interrogation device (LIF) 40 and the interrogation request authority (LEA) 50 is performed. This is done via the handover interface HI.

HI is an interface for the transmission of interception telegrams, and includes information on management information such as interception requests, that is, an interface for exchanging information for activation of interception (HI 1), an interface for exchanging interception related information (HI 2), and communication contents. It consists of an interface (HI 3) for delivering.

Specifically, the control unit (ADMF) 41 and LEMF (51) through the HI 1 legitimate interception request, interception target identification information, interceptor's identifier, interception start and interception period, interception request service, interception contents delivery address (The HI 2 / HI 3 destination address of LEMF) and the like, and the transmission unit 42 and the LEMF 51 exchange all data for setting a communication service such as interception related information (IRI) through HI 2. In addition, the HI 3 transmits the actual communication information (CC).

In the present system, information exchange between the IMS network server 30 and the listening device (LIF) 40 is performed through the X1 to X3 interfaces.

Specifically, the ADMF 41 provides the interception related setting information to the CSCF 31 through the X1_1 interface.

The CSCF 31 provides interception setting information to collect communication contents (CC) information to the PAF 32 through the X1 interface, and interception related information (IRI) to the delivery unit (DF) 42 via the X2 interface. ).

The PAF 32 receives the interception-related information, extracts and dumps the corresponding traffic, or provides a communication content (CC) to the transfer unit (DF) 42 through the X3 interface.

3 is a block diagram showing the detailed configuration of the IMS network-based interception system shown in FIG.

As shown in FIG. 3, the interception system based on the IMS network interoperates with the access network 20, and includes at least an IMS network server 30, an interception device 40, and an interception request organ 50. Here, the access network 20 may be an internet, PSTN, and mobile network as an existing network access network, and processes data traffic according to various service requests of the terminal.

The IMS network server 30 includes a CSCF 31, a PAF server 32, at least one border gateway node, and an HSS 36.

The at least one border gateway node, e.g., SBC 33, IBCF 34, etc., conforms to the standard specification defined in 3GPP.

Now, descriptions of the general functions and the detailed operations of the above-described elements will be omitted, and the operations will be described based on the operations corresponding to the present invention.

First, when the CSCF 31 receives the call data interception request message including the terminal information of the subscriber to be intercepted from the interrogation authority (LIF) 40 through the X1_1 interface, the CSCF 31 initiates interception of the target terminal.

Then, the target terminal 10 transmits a SIP message (INVITE, MESSAGE, REGISTER or SUBSCRIBE), which is call data for call connection, to the IMS network server 30 through the access network 20.

Then, the CSCF 31 of the IMS network server 30 confirms subscriber information through the HSS 36. In this case, the subscriber information includes additional service information of the subscriber.

Therefore, the CSCF 31 checks the additional service information of the subscriber and performs a process for starting the corresponding service.

If the subscriber who has transmitted the SIP message as the call data is set as the eavesdropping subscriber, the CSCF 31 performs the process of starting the corresponding service and at the same time, the service description protocol (SDP) included in the SIP message as the call data. The received call data related information based on the information, that is, the eavesdropping setting related information (origin and destination information) is transmitted to the PAF 32 through the X1 interface, and at the same time, the border gateway node, for example, the SBC 33, the IBCF (34), the relevant information (1) is confirmed from the call data received from the target terminal via the C4 SwitcH (35) or the like.

At the same time, the CSCF 31 transmits interception-related information (IRI) for the target terminal 10 to the interception apparatus (LIF) 40 through the X2 interface.

In addition, the CSCF 31 sets the PAF 32 as a node via the communication requested by the target terminal 10 based on the SDP information (origin and destination information).

After that, when the interception setting related information is received from the CSCF 31, the PAF 32 dumps the media data ② transmitted from the target terminal 10 or transmits the communication contents CC including the media data to the X3 interface. It transmits to the interception device (LIF) 40 through. Here, the media data may include, but is not limited to, voice, video, and MP3 according to VoIP service and Miltimedia service.

As described above, the CSCF 31 delivers the interception setting related information (origin and destination information) generated based on the SDP information of the SIP message received from the target terminal 10 to the PAF 32 to transmit all communication contents. It is intercepted by the PAF 32 so that it can be provided to the interception device (LIF) (40).

In addition, the PAF 32 may be set as a node via the corresponding communication through the eavesdropping setting related information (origin and destination information received from the CSCF 31) to intercept the communication contents of the target terminal 10.

Then, the interception apparatus (LIF) 40 intercepts the interception related information IRI for the target terminal 10 through HI2, and the communication contents CC to the target terminal 10 through HI3. To 50).

So far, the configuration and function of the IMS network-based interception system proposed by the present invention have been described with reference to FIGS. 1 to 3.

Next, the process of performing the interception on the target terminal in the IMS network-based interception system will be described with reference to FIGS. 4 to 5.

First, FIG. 4 is an exemplary diagram illustrating a messaging flow according to a process of processing an eavesdropping on a message of a target terminal in the IMS network-based eavesdropping system shown in FIG. 1.

As illustrated in FIG. 4, when the interception organ (LIF) 40 receives an interception request message for requesting interception of a specific target terminal (UE) 10 from the LEMF 51 of the interception request authority (S401). In operation S402, an Eavesdropping setting request message for requesting setting of the eavesdropping related matter of the target terminal (UE) 10 is transmitted to the P-CSCF 31a of the IMS network server. Here, the interception setting request message of the target terminal (UE) 10 is a message for requesting the setting of the interception-related matters for the target terminal (UE) 10.

Then, the P-CSCF 31a updates the subscriber information of the HSS so that the service profile of the subscriber of the target terminal (UE) 10 can be changed to an eavesdropper, and monitors the eavesdropping state of the target terminal (UE) 10. Activation starts the interception (S403).

Thereafter, the P-CSCF 31a continuously monitors the target terminal (UE) 10 and the SIP message (REGISTER) to the P-CSCF 35-1 in order for the target terminal (UE) 10 to start communication. In step S404, the P-CSCF 31a transmits a SIP message (REGISTER) of the target terminal (UE) 10 to the interception organ (LIF) 40 (S405).

In addition, the P-CSCF 31a forwards the SIP message (REGISTER) received from the target terminal (UE) 10 to the I-CSCF 31b (S406), and the I-CSCF 31b receives the HSS 33. Send a User-Authorization-Request (UAR) message inquiring which S-CSCF to send a SIP message (REGISTER), and in response to this receives a User-Authorization-Answer (UAA) message from the HSS 33 (S407). ).

Then, the I-CSCF 31b sends a SIP message (REGISTER) to the assigned S-CSCF 31c (S408), and the S-CSCF 31c sends a SAR (SAR) requesting subscriber information to the HSS 33 (S408). Sends a Sever-Assignmentt-Request (Sever-Assignmentt-Request) message in response to the SAA (Sever-Assignmentt-Answer) message from the HSS 33 and delivers the SIP message (REGISTER) to the destination terminal in conjunction with the application server (S409). ).

Thereafter, the S-CSCF 31c notifies the I-CSCF 31b of 200 that the transmission of the SIP message (REGISTER) of the target terminal (UE) 10 is completed (200 OK), and the I-CSCF 31b receives the P-. The 200 OK message is notified to the CSCF 31a, and the P-CSCF 31a notifies the 200 OK message to the target terminal (UE) 10 and the LIF 40. FIG.

As such, when the target terminal (UE) 10 requests to transmit a SIP message (REGISTER) to the CSCF 31 through the access network, the CSCF 31 sends a SIP message (REGISTER) of the target terminal (UE) 10. After the processing of the transmission of the SIP message (REGISTER) of the target terminal (UE) 10 to the interception organ (LIF) (40).

FIG. 5 is an exemplary diagram illustrating a messaging flow according to a process of processing an eavesdropping on a message and a communication content (CC) for a target terminal in the IMS network-based eavesdropping system shown in FIG. 1.

As shown in FIG. 5, when the target terminal (UE) 10 transmits a SIP message (INVITE (SDP offer)) for data session connection to the P-CSCF 31a (S501), the P-CSCF 31a is transmitted. ) Transmits a SIP message (INVITE) to the listening device (LIF) 40 (S502).

In addition, the P-CSCF 31a establishes a bearer channel of the PAF 32. The P-CSCF 31a establishes a bearer channel of the PAF 32, and the call data related information (source and destination of media traffic) in a SIP message (INVITE (SDP offer)). Information) is extracted and transmitted to the PAF 32 (S503).

Then, the P-CSCF 31a forwards the SIP message (INVITE (SDP offer)) received from the target terminal (UE) 10 to the S-CSCF 31c (S504).

In addition, the S-CSCF 31c is an application server that receives the subscriber profile in association with the HSS and provides the service requested by the target terminal (UE) 10. The SIP message (INVITE (SDP) received from the P-CSCF 31a is received. offer)) and receives a response message (200 OK message (SDP Answer)) (S506).

Then, the S-CSCF 31c forwards a response message (200 OK message (SDP Answer)) to the P-CSCF 31a (S507), and the P-CSCF 31a sends the response message (200 OK message (SDP). Answer)) is transmitted to the interception device (LIF) 40 (S508).

Then, the P-CSCF 31a modifies the bearer channel of the PAF 32 (S509), and then sends a response message (200 OK message (SDP Answer) to the target terminal (UE) 10. Pass)) (S510).

Through this, the target terminal (UE) 10 establishes a signaling session with the called terminal by call connection and transmits actual data (voice, video, etc.) to perform communication.

At this time, the PAF 32 is a target terminal (UE) 10 from at least one border gateway node through a bearer channel formed based on call data related information (source and destination information of media traffic). After capturing the communication content (CC) of the dump or transfer the communication content (CC) to the interception device (LIF) (40) (S511).

Then, the interception apparatus (LIF) 40 transmits the communication content (CC) of the target terminal (UE) 10 transmitted from the PAF 32 to the LEMF 51 of the interception request authority (S512). At this time, the interrogation organ (LIF) 40 converts the media data transferred from the PAF 32 so that it can be played in the LEMF 51 and transmits the media data to the LEMF 51. This LIF may perform codec change processing on the media data.

In other words, when the corresponding target terminal (UE) 10 originates or receives a call, the PAF 32 forwards the text message passing through the target terminal (UE) 10 to the interrogation authority (LIF) 40. And the communication data (CC) generated by the target terminal (UE) 10, for example, media data such as voice and video, that is, the communication content (CC). To pass).

On the other hand, in the case of the communication content (CC) generated in the target terminal (UE) (10), since the relevant traffic does not pass through the CSCF, the P-CSCF (31a) is to extract the information related to the communication content (CC) (Media traffic) The relevant information (the source information and the destination information of the media traffic) is extracted from the Session Description Protocol (SDP) information and transmitted to the PAF 32.

Then, the PAF 32 receives the relevant information extracted from the SDP information from the P-CSCF 31a, extracts the corresponding media traffic, and dumps it or sends it directly to the interrogation organ (LIF) 40.

After that, when the call between the target terminal (UE) 10 and the called terminal or the receiving terminal is lost and the BYE message is transferred to the S-CSCF 31c (S513), the S-CSCF 31c transmits the BYE message to the P-CSCF ( 31a) (S514).

Then, the P-CSCF 31a releases the bearer channel with the PAF 32 (S515), and the PAF 32 stops the associated traffic capture (S516).

At this time, the P-CSCF 31a transfers the BYE message to the interception device (LIF) 40 (S517), and then transfers the BYE message to the target terminal (UE) 10 (S519).

Then, when the BYE message is received from the P-CSCF 31a, the intercepting device (LIF) 40 stops the transmission of the communication content CC to the LEMF 51 (S519).

As described above, the present invention provides a new service model that can efficiently perform legitimate eavesdropping without minimizing or adding existing nodes in the conventional IMS network by introducing PAF (Packet Analysis Funtion) in the IMS network. That is, the present invention needs to add an X3 interface to edge nodes such as border gateway nodes such as SBC, IBCF or C4 switch in order to intercept without missing all traffic. It is possible to legally intercept all traffic to the target terminal without the work of. As a result, it is possible to obtain an effect of reducing the effective interception and the management node of the interception equipment.

So far I looked at the center of the preferred embodiment for the present invention. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Therefore, the disclosed embodiments are to be regarded as illustrative rather than restrictive, and all differences within the equivalent scope should be construed as being included in the present invention.

Further, the system and method according to the present invention can be embodied as computer readable codes on a computer readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored. Examples of the recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like, and a carrier wave (for example, transmission via the Internet). The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

10. Target terminal (target terminal) 20. Access network
30. IMS Network Server 31. CSCF
32.PAF 40.LIF
41.ADMF 42.DF
50. LEA 51. LEMF

Claims (23)

Receiving the interception setting related information generated on the basis of the SDP information included in the call data in the CSCF receiving the call data transmitted from the terminal of the interrogation target subscriber from the CSCF, and the corresponding traffic using the interception setting related information PAF device of the IMS network server to extract the information provided to the interception device.
The method of claim 1,
The interception setting-related information includes a source information and a destination information extracted from the SDP information PAF device of the IMS network server.
The method of claim 2,
The PAF apparatus monitors at least one or more edge nodes using the source information and the destination information to capture media data received or transmitted from the terminal of the subscriber to be listened to and then provide the same to the eavesdropping apparatus. PAF device.
The method of claim 3,
The PAF device is a PAF device of the IMS network server, characterized in that providing the media data to the interception device in real time or at regular intervals.
The method of claim 1,
When the call data is received from the terminal of the subscriber to be intercepted, the CSCF transmits the interception setting related information generated by extracting the source information and the destination information from the SDP information of the call data to the PAF. Device.
A CSCF for extracting source information and destination information from the SDP information of the call data and generating interception setting information when the call data is received from the terminal of the subscriber to be intercepted; And
When the interception setting information is received from the CSCF, IMS network server having a PAF device including a PAF to extract the corresponding traffic using the interception setting information to provide to the interception device.
The method according to claim 6,
When the CSCF receives an eavesdropping request message including the terminal information of the eavesdropping subscriber from the eavesdropping device, the CSCF updates the subscriber information by inquiring the service profile of the HSS to change the eavesdropping subscriber into an eavesdropping target. IMS network server with.
The method according to claim 6,
The CSCF receives the call data of the terminal of the subscriber to be intercepted from at least one edge node, extracts the interception related information from the call data, and provides the interception device to the interrogation device.
The method according to claim 6,
The interception setting-related information includes the source information and the destination information extracted from the SDP information IMS network server having a PAF device.
10. The method of claim 9,
The PAF apparatus monitors at least one or more edge nodes using the source information and the destination information to capture media data received or transmitted from the terminal of the subscriber to be listened to and to provide it to the interception apparatus. Network server.
The method of claim 10,
The PAF device provides an IMS network server having a PAF device, wherein the media data is provided to the interrogation device in real time or at regular intervals.
An intercepting apparatus for transmitting the terminal information of the intercepting target subscriber when receiving an interception request message including the terminal information of the intercepting target subscriber from the interrogation requesting institution; And
When receiving the terminal information of the subscriber to be intercepted from the interrogation device, the CSCF which extracts the source information and the destination information from the SDP information of the call data transmitted from the terminal of the interrogation target subscriber and generates the eavesdropping setting related information; And an IMS network server comprising a PAF that extracts the corresponding traffic using the interception setting-related information and provides it to the interception apparatus when the setting related information is received.
The method of claim 12,
When the CSCF receives an eavesdropping request message including terminal information of an eavesdropping subscriber from an eavesdropping device, the CSCF updates the subscriber information by inquiring a service profile of the HSS to change the eavesdropping subscriber into an eavesdropping target. Based interception system.
The method of claim 12,
The CSCF receives the call data of the terminal of the subscriber to be intercepted from at least one edge node, extracts the interception-related information from the call data, and provides the interception device to the interception apparatus.
The method of claim 12,
The interception setting-related information includes a source information and a destination information extracted from SDP information.
16. The method of claim 15,
The PAF apparatus monitors at least one or more edge nodes using the source information and the destination information to capture media data received or transmitted from the terminal of the subscriber to be listened to and to provide it to the interception apparatus. system.
17. The method of claim 16,
The PAF device is an IMS network-based interception system, characterized in that to provide the media data to the interception device in real time or at regular intervals.
Receiving, by the CSCF, call data from a terminal of the subscriber to be intercepted through at least one edge node;
Generating, by the CSCF, the interception setting related information based on the SDP information included in the call data and transmitting the same to the PAF; And
And monitoring, by the PAF, at least one edge node using the interception setting-related information, extracting corresponding traffic, and providing the corresponding traffic to the interception apparatus.
19. The method of claim 18,
The step 1 further comprises the step of extracting the source information and the destination information from the SDP information of the call data transmitted by the CSCF to generate the eavesdropping configuration related information.
19. The method of claim 18,
The first step may further include, when the CSCF receives an eavesdrop request message including terminal information of the eavesdropping subscriber from the eavesdropping device, updating the subscriber information of the HSS with the eavesdropping subscriber's service profile. Interception method based on IMS network, characterized in that.
19. The method of claim 18,
In step 3, the PAF extracts the traffic in real time or at regular intervals and transmits the traffic to the interception apparatus.
20. The method of claim 19,
In step 3, the PAF monitors at least one or more edge nodes using the source information and the destination information to capture media data received or transmitted from the terminal of the subscriber to be intercepted and provide the IMS to the interception apparatus. Network based interception method.
A recording medium having recorded thereon a program which can be read and executed by a digital signal processing apparatus as a program for performing the method of any one of claims 18 to 22.

Images