CN100531074C - Method and system for legally monitoring IP multimedia subsystem network - Google Patents

Abstract

The present invention provides a method and system for IP multimedia subsystem network lawful interception. The method includes the following steps: (a) the call session control function (CSCF) receives a Session Initiation Protocol SIP message, and if it needs to be monitored, the SIP message is sent Forward to the monitoring gateway application server; (b) after receiving the SIP message, the monitoring gateway application server distributes the calling proxy port and the called proxy port on the monitoring gateway application server for this call, and revises the SIP message, modify the calling port information to the calling agent port information and send it to the called party, and modify the called port information to the called agent port information and send it to the calling party; (c) communication between the calling party and the called party The media streams are respectively sent to the called proxy port or the calling proxy port of the monitoring gateway application server, and the monitoring gateway application server copies the media streams and sends them to the legal enforcement monitoring device LEMF.

Description

Method and system for IP multimedia subsystem network lawful interception

technical field

The invention relates to the field of IP Multimedia Subsystem (IMS) communication, in particular to a method and system for IP Multimedia Subsystem network lawful monitoring.

Background technique

IMS communication technology is the development direction of communication in the future, and the research on IMS lawful interception is also a relatively popular research topic in the field of interception research. In the IMS communication architecture, the control layer equipment is completely separated from the bearer layer equipment. However, in the existing standard protocol, it is suggested that the monitoring and triggering of the controlled user should be realized on the control layer device, and the monitoring and control of the media stream should be realized on the media layer device (i.e., the bearer layer device); however, some control layer devices cannot directly output The content of the alleged target's communications. This is an implementation problem faced by IMS domain communication interception.

The current IMS network architecture diagram defined in 3GPP (Third Generation Partnership Project) is shown in Figure 1. The framework structure of IMS mainly includes CSCF (Call Session Control Function, call session control function), MGCF (Media Gateway Control Function, media gateway) Control Function), IMS-MGW (IMS-Media GateWay, IMS Media Gateway), MRFC (MultimediaResource Function Controller, Multimedia Resource Function Controller), MRFP (MultimediaResource Function Processor, Multimedia Resource Function Processor), BGCF (BreakoutGateway Control Function, egress gateway control function) and other functional entities. The CSCF is the core of the entire network, and supports the SIP (Session Initiation Protocol) protocol to process SIP sessions. P-CSCF (proxy CSCF) is the entrance of UE (user equipment) to access the IMS system, and realizes the functions of Proxy (proxy) and UserAgent (user agent) in the SIP protocol; MGCF and IMS-MGW are connected with CS (circuit domain ) domain and PSTN (Public Switched Telephone Network) intercommunication functional entity, respectively responsible for the intercommunication of control signaling and media flow; MRFC and MRFP are functional entities for realizing multi-party conference, MRFC at the control plane controls MRFP through H.248; BGCF is The demarcation point between the IMS domain and the external network, where it chooses to interconnect with the CS domain or PSTN.

At present, there are many types of monitoring standards, but they are all based on three standard interface methods. The HI1 interface realizes setting control and management; the HI2 interface reports the monitoring-related information (IRI) of the communication of the controlled target; the HI3 interface outputs the communication content of the controlled target (CC ). The HI2 interface message is generally output by the control layer device, and the HI3 interface communication content is completed by the bearer layer device.

The network elements shown in Figure 1 can be divided into control layer network elements and bearer layer network elements. It is difficult to require them to provide monitoring functions from the perspective of development and engineering implementation; especially many bearer layer network elements do not It has the function of copying the media, which brings difficulties to the implementation of monitoring in the current IMS field.

Contents of the invention

The technical problem to be solved by the present invention is to provide a method and system for legally intercepting IMS domain communication.

In order to solve the above-mentioned technical problems, the invention provides a kind of IP multimedia subsystem network lawful monitoring method, comprises the following steps:

(a) The call session control function CSCF receives the session initiation protocol SIP message, and if monitoring is required, the SIP message is forwarded to the monitoring gateway application server;

(b) After receiving the SIP message, the monitoring gateway application server distributes the calling proxy port and the called proxy port on the monitoring gateway application server for this call, revises the SIP message in this calling, and calls the The port information is changed to the calling agent port information and sent to the called party, and the called port information is changed to the called agent port information and sent to the calling party;

(c) The media streams communicated between the calling party and the called party are respectively sent to the called proxy port or the calling proxy port of the monitoring gateway application server, and the monitoring gateway application server copies the media streams and sends them to the legally enforced Monitoring equipment LEMF.

Further, the above method may also have the following characteristics. In the step (a), after the CSCF receives the SIP message, it judges whether monitoring is required by querying the initial filtering criteria, and after querying the initial filtering criteria, if the monitoring trigger conditions, the monitoring is triggered.

Further, the above method may also have the following characteristics. In the step (a), after the CSCF receives the SIP message, it judges whether monitoring is required by querying the initial filtering criteria, and after querying the initial filtering criteria, if the monitoring trigger conditions, and further determine whether the SIP message route has passed through the monitoring gateway application server, and if not, trigger monitoring.

Further, the above method can also have the following features, in the step (b), if the monitoring gateway application server fails to allocate the calling and/or called agent ports or fails to establish the HI3 channel to LEMF, the monitoring gateway The application server performs processing according to the monitoring setting conditions of the user. If the monitoring setting conditions of the user are mandatory monitoring, the monitoring gateway application server returns a failure indication to the CSCF, and the call fails.

Further, the above method can also have the following characteristics, in the step (c), the LEMF is one or more, and the listening gateway application server assembles the media stream into the media packet format required by the LEMF , sent to the LEMF through the HI3 interface.

Further, the above method may also have the following features, in the step (b), after the monitoring gateway application server modifies the SIP message, it sends it to the CSCF, and then the CSCF sends it to the calling party or called.

Further, the above method can also have the following characteristics, in the step (b), the monitoring gateway application server adds the routing information of the monitoring gateway application server in the message header of the SIP message, and the modified SIP The message is sent to the CSCF.

Further, the above method may also have the following features: After receiving the SIP message returned by the monitoring gateway application server, the CSCF generates a monitoring related information X2 report and sends it to the monitoring gateway application server, and the monitoring gateway application server It is converted into a HI2 interface message and sent to the LEMF.

Further, the above method can also have the following features, in the step (b), after the monitoring gateway application server allocates the calling proxy port and the called proxy port, it locally establishes a port address mapping table for this call, including Calling port and calling proxy port information, called port and called proxy port information, during this call, when the calling or called port changes, update the port address mapping table.

An IP multimedia subsystem network lawful interception system, including CSCF, LEMF, and an interception gateway application server, wherein,

The CSCF receives the Session Initiation Protocol SIP message, judges whether monitoring is required, and if monitoring is required, forwards the SIP message to the monitoring gateway application server;

The monitoring gateway application server is used to receive the SIP message sent by the CSCF, allocate a calling agent port and a called agent port on the monitoring gateway application server for the call, modify the SIP message in the call, and modify the calling port information Send the calling agent port information to the called party, modify the called port information to the called agent port information and send it to the calling party, receive the calling party and the called party and send it to the called party port or calling party of the monitoring gateway application server. Proxy the media stream of the port, and copy the media stream, and send it to the legally enforced monitoring device LEMF;

The LEMF receives the media stream sent by the listening gateway application server.

The present invention realizes the function of monitoring by introducing the monitoring application server, thus minimizing the change of the service flow of each control network element brought about by the introduction of the monitoring function. After implementing the IMS monitoring of this method, the complex network element structure of the IMS domain can be avoided, and most network elements are not required to improve any monitoring technology, and the monitoring trigger can only be implemented on the CSCF network element device, that is, The monitoring of IMS domain communication is conveniently implemented, thereby greatly reducing the complexity of implementing IMS domain monitoring.

Description of drawings

Figure 1 is a diagram of the IMS network architecture defined in 3GPP;

Fig. 2 is a frame diagram of realizing IMS lawful interception of the present invention;

Fig. 3 is the flow chart of the business that INVITE (invitation) of the present invention triggers;

Fig. 4 is a flow chart of LIG AS (Lawful interception gateway application server, lawful interception gateway application server) monitoring function processing in the present invention.

Detailed ways

The present invention provides a kind of system that realizes the lawful interception of IMS system, as shown in Figure 2, mainly comprises LIG AS, S-CSCF, LEMF (legal mandatory monitoring equipment), wherein,

The S-CSCF is connected to the LIG AS, provides the function of triggering monitoring to the LIG AS server and provides the X2 monitoring interface function.

In order to ensure specific monitoring service processing, the S-CSCF should decide whether the LIG AS server is required to receive information related to incoming SIP session requests, that is, the S-CSCF assigns the monitoring service to an independent external LIG according to the information situation. AS server to process.

The S-CSCF's decision may be based on interception information received from the HSS (Home Subscriber Server) (this information may be partially filtered). The filtering information is stored and transmitted according to each monitoring user information.

The address information of the LIG AS server comes from HSS. Alternatively, ADMF (Administration Function) can be used to control and configure the address information of the LIG AS server to achieve the purpose of setting filter conditions.

When S-CSCF handles calls, from the perspective of S-CSCF, S-CSCF and LIG AS and "SIP Application server (SIP application server)", "OSA service capability server (open service platform service capability server)" and The interface of "IM-SSF (IP Multimedia Service Switching Function)" is identical. In terms of processing logic, the LIG AS server will be handled in the same way as other SIP application servers. S-CSCF notifies LIG AS or IM SSF, OSASCS and other SIP application servers through SIP session request, and these servers should ensure that they can send messages to S-CSCF to let S-CSCF know the results of all actions.

During the call process, the S-CSCF transmits the corresponding X2 information to the LIG AS as the call state transitions. The X2 information can also be provided by the P-CSCF to the LIG AS.

The SIP call traverses the LIG AS server mainly through the ISC (IP Multimedia Subsystem Service Control) interface. ISC is the interface between S-CSCF (Serving CSCF) and Application Server (AS). The interface between S-CSCF and LIG AS is to use the monitoring function service provided by LIG AS. The SIP application server can run the service on the mainframe. The SIP application server may affect the SIP session on the service resources, or even conflict, so the SIP application server communicates with the S-CSCF through the ISC interface.

The LIG AS is introduced by the present invention, and the LIG AS is a SIP application server, which also has the function of monitoring the gateway LIG. It has the conversion and control functions of the control layer and the media layer, and is used to realize the traversal of SIP signaling and media.

The control layer of the LIG AS server modifies the port of the passing SIP message to achieve the purpose of controlling the routing of the media flow; after modifying the traversing SIP signaling message, the LIG AS will serve as an intermediate device for the media flow, providing a communication with the SIP Traversal of session-related media, and copy the passed IP media content and convert it into the standard monitoring information content required by the monitoring center equipment LEMF for analysis and processing by the monitoring center.

The X interface is mainly used to monitor the internal interface of the gateway LIG and the monitored network element to transmit monitoring information; in the present invention, there is only the X2 interface event message between the LIG AS and other controlled network elements, and the X3 interface does not exist. After the LIG AS receives the X2 information, it converts it into a standard HI2 interface message and sends it to the monitoring center equipment LEMF; for the X3 media stream to be monitored, the routing control function of the media stream is performed through the LIG AS application server, so that the monitoring The media stream passes through the device, and when passing through, LIG AS performs the copy function of the media stream at the same time. Therefore, the control layer equipment in the IMS system only needs to process the process according to the normal telecommunication service call control, and only needs to provide the X2 interface messages required for monitoring for the monitoring function, and has almost no impact on the process processing of the unit; for the media layer equipment , the existence of the monitoring function can be ignored, and the processing of the monitoring function of the media layer is handled by LIG AS, which is a transparent operation for other media layer devices.

In the existing agreement, the application server providing additional multimedia services or other services can reside in the user's home network (registered network) or in a third party. This third party can be a network or a separate AS. As a kind of application server AS, LIG AS is recommended to reside in the core network of the user's home network.

The LEMF exists as a monitoring center device, and receives the HI2 report message and HI3 communication content from the LIG AS server; the HI2 interface is mainly used to report events related or irrelevant to the call; the HI3 interface is used to transmit the monitored communication content.

Refer to Figure 3 for the business process of S-CSCF triggering monitoring through the ISC interface. In Figure 3, the filtering criterion LI is defined as determining whether to trigger monitoring by judging whether the calling and called users in the SIP message are controlled targets. The process shown in the figure Described as follows:

Step 1, the user initiates a SIP session by sending a SIP initial request to its S-CSCF;

Step 2, after receiving the SIP initial request, the S-CSCF deduces the triggering service point (SPT) from the request, and then checks whether the SPT matches the filtering criterion LI, if it matches, the monitoring will be triggered, and the S-CSCF forwards The SIP initial request to LIG AS;

The trigger service point usually includes the URI of the call request; SIP method (type of request, such as INVITE or MESSAGE); SIP message header (comprising information relevant to the request); session situation (initiation, termination, termination unregistered ); session description (the service point trigger of the content of the session description protocol field).

Step 3. LIG AS executes specific business logic, allocates media ports and replaces address information in SIP messages. After the execution is completed, the SIP request is sent back to the S-CSCF, and business-related information may be modified;

Step 4a, after receiving the SIP request returned from the LIG AS, the S-CSCF derives the SPT from the request again, and then checks whether the SPT matches other filtering criteria, and if it matches, the S-CSCF forwards the request to AS1, Go to step 5a, otherwise, go to step 4b;

Among them, AS1 is another AS application server in the system.

Step 4b, if the request does not match any subsequent filtering criteria, the S-CSCF searches for the next-hop network element according to the normal SIP routing mechanism and forwards it (the SIP routing mechanism adopts the loose routing of RFC3261 Loose Routing), and ends;

Step 5a, AS1 executes specific business logic according to the ServiceKey (service key), and after the execution is completed, sends the SIP request back to the S-CSCF, and may modify service-related information;

Step 6a, S-CSCF checks the SIP request sent by AS1 and finds that it does not match any filter criteria, so S-CSCF searches for the next hop according to the normal SIP routing mechanism and forwards it;

The above 4a, 4b, 5a, and 6a describe the two call flows after the call is monitored by the LIG AS, which is used to illustrate that the call flow of the LIG AS and AS1 is similar in form, that is, the interaction between the LIG AS and the S-CSCF is different from that of other ASs and AS1. The interaction of S-CSCF is similar.

In the IMS system, the triggering of monitoring services is completed in the S-CSCF, and the service data is downloaded to the S-CSCF during the registration phase, including Filter Criteria (filtering criteria). When a user registers, or receives a terminated initial request from an unregistered user, the initial filtering rules that trigger monitoring are downloaded to the S-CSCF. After downloading the user configuration from the HSS, the S-CSCF performs an evaluation of the listening filter criteria:

Step 1, CSCF receives the SIP request, checks whether the public user identity is prohibited, if not, continues;

The public user identity is the user identity in the IMS, which is used to communicate with other users; it can be published in the phone book or a kind of identification on the business card; this step mainly identifies whether the user has the right to initiate a call;

Step 2, check whether the request is an initial request or a termination request;

Step 3: Select an initial filtering rule (Originating, Terminating, or Terminating_Unregistered by an unregistered user) for the session situation, and set the monitoring trigger rule as the highest priority filtering rule by default.

The listening trigger here is triggered by the session situation.

Step 4. By comparing the public user identity of the call request with the service configuration, it is checked whether the request matches the highest priority initial filter rule of the user, ie, the interception trigger filter rule.

1) If the request matches the filter rule, the S-CSCF forwards the request to the LIG AS. Next, the S-CSCF also checks whether the request matches the next filtering rule with lower priority, and if so, applies the filtering rule to the SIP method when the SIP message is returned from the LIG AS.

2) If the request cannot be matched with the monitoring trigger filter rule with the highest priority, check whether it matches the filter rule with the next priority until it matches the previous one.

3) If no initial filtering rule is applicable, the S-CSCF forwards the request based on the routing decision.

If the contacted LIG AS does not respond, the S-CSCF follows the default procedure associated with the initial filtering rule, ie either terminates the session or allows the session to continue based on the information in the filtering rule. The general default is to allow the session to continue; if the initial filter rules do not contain an indication of what the S-CSCF should do after failure to contact the LIG AS, the default behavior of the S-CSCF is to allow the call to continue.

After the S-CSCF network element triggers the monitoring, it forwards the SIP call request to the LIG AS; when the request message reaches the LIG AS, the LIG AS device applies for resources in the device to set the calling and called proxy ports of this call. After the resource port application is successful, the SIP message will be modified, and the calling agent port (IP+UDP Port, Internet Protocol + User Datagram Protocol port) located on the LIG AS will be sent to the called user, and the The called proxy port (IP+UDP Port) is sent to the calling user.

In this way, under the control of the LIG AS, the uplink media stream of the calling party is sent to the called proxy port on the LIG AS, and the uplink media stream of the called party is sent to the calling proxy port. Inside the LIG AS, the media sent to the calling and called agent ports are exchanged and re-forwarded to the calling and called users. In this way, the media stream traverses inside the LIG AS device, and this process is transparent to the calling and called users.

While the media is traversing, LIG AS is also responsible for duplicating the traversing media, and encapsulating and sending them to the monitoring center device LEMF in a standard HI3 message, so as to monitor the communication in the IMS domain.

Through the above steps, the encapsulation and delivery of the HI3 message is completed; the HI2 message will be provided by the P-CSCF/S-CSCF with the X2 interface message, and then the conversion of the HI2 message interface will be completed in the LIG AS, and the internal interface X2 message will be converted into a standard HI2 interface information.

Below, the present invention is further described in detail through an embodiment of the present invention, and the specific steps are as follows,

Step 301, after the CSCF receives the SIP message of a certain session, it judges according to the user attributes corresponding to the source SIP URI (Uniform Resource Identifier) and the destination SIP URI in the message, and judges whether it meets the trigger monitoring by querying the iFC condition of the initial filtering rule conditions; when the conditions for triggering the monitoring are met, it is judged whether the SIP message route has passed through the LIG AS; if the message has not passed through the LIG AS, the monitoring operation is triggered.

Step 302, if monitoring is triggered, after the LIG AS corresponding to the iFC condition is found, the CSCF forwards the call message to the LIG AS.

In step 303, the LIG AS allocates the calling and called agent ports for this call.

After receiving the call request message, the LIG AS applies for the calling and called agent ports locally, and at the same time establishes the port address mapping table for this call. If the application fails, that is, the application for the calling and/or called agent port fails, LIG will process it according to the monitoring setting conditions of the user. If the monitoring attribute of the user is set as the monitoring setting must be performed, a failure indication will be returned to CSCF, resulting in This call fails; otherwise, this monitoring is ignored, LIG AS forwards the received call message back to CSCF, and CSCF completes this call control according to normal processing.

Step 304, LIG AS establishes HI3 channel to LEMF.

After LIG AS successfully applies for the proxy port, it establishes the HI3 channel to LEMF. If the HI3 channel fails to be established, LIG AS will handle it according to the monitoring setting conditions of the user. If the monitoring attribute of the user is set to disallow continuing communication operations when the HI3 channel fails to be established, a failure indication will be returned to the CSCF, causing the call to fail; otherwise, the monitoring will be ignored and the call received by the LIG AS will be ignored. The message is forwarded back to CSCF; CSCF completes the call control according to normal processing;

Step 305, the LIG AS changes the port in the SIP message to replace the calling address, and replaces the SDP (Session Description Protocol) information of the calling proxy port with the calling SDP information. Then forward the modified SIP message back to the CSCF, and add the routing information of this LIGAS in the routing information field Via of the message header, so as to prevent other S-CSCFs from triggering the monitoring call to the LIG AS again;

Step 306, the CSCF sends an INVITE message to the next-hop network element, in which the port in the calling SDP information has been replaced with the calling proxy port;

Step 307, when the CSCF receives the 200OK message from the called user (that is, the response message of the called user), it passes the message to the LIG AS, and the LIG AS modifies the called SDP information of the 200 OK message, and transfers the called proxy port SDP Information replaces the called SDP information, and updates the port address mapping table at the same time; then forwards the modified 200OK message to the CSCF, and the CSCF will forward the 200OK message to the calling party, in which the port information part of the original called user SDP has been replaced It is the called proxy port.

Step 308, after the communication between the calling party and the called party, the media of the calling party and the called party will be sent to the proxy port on the LIG AS, and the traversal will be realized on the LIG AS;

In step 309, the media stream is copied on the LIG AS and sent to the LEMF.

LIG AS equipment needs to complete the distribution operation of LEMF and HI3 interface adaptation; LIG AS queries the user's setting and control data. For the situation where multiple monitoring centers control a user at the same time, the setting and control mode of each monitoring center is the same as that of HI3 Interface requirements may vary. According to the setting and control parameters of the monitoring center, LIG AS copies the media to multiple monitoring centers, assembles it into the media package format required by LEMF according to the setting and control parameters, and then distributes it to each LEMF to complete the distribution operation.

Each LEMF requires different processing for the HI3 interface as follows. The RTP packet of the user media arrives at the LIG AS, and the LIG AS encapsulates the HI3 interface requirements according to the monitoring center and sends it to the LEMF. If LEMF requires E1 trunk for bearer (refer to ts 101 671), then LIG AS needs to convert the IP media packet into TDM (Time Division Multiplexing) mode first, and establish an ISUP (Integrated Services Digital Network User Part) call to LEMF . This method can only monitor voice and fax services. If the monitoring center requires the HI3 interface to be implemented in accordance with TS 102232 or TS 133108, LIG AS will take the received RTP (Real-time Transport Protocol) packet as the data content, encapsulate it according to the format defined by TS 102232 or TS 133108, and then send it to the LEMF device.

Step 310, in the subsequent call process, for each SIP message passing through the LIG AS, the port address of the corresponding calling and called SDP information and the port address of the calling and called agent modified by the LIG AS will be converted.

Step 311, in the communication process, when the SDP changes, if the media type changes, only the transfer after the message address translation is performed; if the media port address changes, the port address mapping table saved by LIGAS will be updated, and the subsequent The address information of the SIP call message;

For the case of adding media streams, the LIG AS side needs to add a group of proxy ports, and at the same time copy and send the newly added media streams to LEMF. Adding a media stream can be indicated by adding "m=" in the SDP description.

For the case of deleting media streams, each media stream corresponds to a group of proxy ports, because the number of media streams can be obtained in the SDP protocol, and the description order of each media stream in SDP is unchanged, so each group of proxy ports can be There is a one-to-one correspondence between ports and each media stream. When deleting a media stream, the LIGAS side needs to delete the corresponding proxy port, and at the same time notify the LEMF to stop receiving the media through a SIP signaling message.

Step 312, the call ends, the media channel is released, and the HI3 interface connection is released at the same time, and the current call port address mapping table in the LIG AS is deleted.

In the above processing, the LIG AS server divides a call into two planes for calling and calling. In the SDP sent to the calling user, fill in the called agent port; in the SDP sent to the called user, fill in The calling agent port. In this way, the media stream of the calling and called users is controlled to be sent to the proxy port of LIG AS.

LIG AS allocates a proxy port for each call, and uses the proxy port to communicate with the real port of the calling party and the called party to perform media communication, realize media traversal, and copy and send it to the LEMF device through the HI3 interface. Port proxy and media traversal are transparent to users and network elements other than CSCF.

Fig. 4 is the specific message flow chart of the present invention concrete implementation under the IMS environment, below in conjunction with flow chart, further illustrate the specific processing method to a monitor call on CSCF and LIG AS equipment, in the figure, between LIG AS and LEMF Communication is performed through the HI interface; there is an X2 interface between the LIG AS and the S-CSCF; there are four messages on the X2 and HI2 interfaces: BEGIN, CONTINUE, END, and REPORT, indicating the start of the call, events in call, end, and other reports event.

Step 401: the calling user sends an INVITE request to the S-CSCF;

Step 402: The CSCF device judges whether to trigger the monitoring filter criterion through the SDP information of the calling user carried in the INVITE message;

Step 403: When the SDP (Session Description Protocol) information of the calling user satisfies the monitoring trigger condition, the S-CSCF sends the INVITE request to the LIG AS; in order to ensure that the LIG AS can receive the INVITE request again after completing the operation, it also By adding some information in the route-related message header to ensure that the subsequent request message route can pass through itself again;

The above part of the information means that the routing information of this LIG AS is also added in the routing information field Via of the message header.

Step 404: After receiving the call request, the LIG AS allocates the local calling and called agent ports, and establishes a port address mapping table, fills the calling and called SDP and the local calling and called agent ports into the form, and establishes a mapping relationship;

Steps 405, 406: LIG AS establishes the HI3 channel to LEMF, so that the media stream passing through the device during the call can be sent to LEMF (CC) after copying is completed. When the CC channel is established, LEMF (CC) will reply ACK to LIG AS in response to the request message.

Step 407: The LIG AS modifies the call request message from the S-CSCF, replaces the caller SDP information in the original message with the calling agent port address, and then sends it back to the S-CSCF;

Step 408: After receiving the changed call request message, the S-CSCF transmits it to the target user according to the normal route;

Steps 409 and 410: After the S-CSCF forwards the call request according to the normal route, it generates an X2 report according to the relevant information in the INVITE message and sends it to the LIG AS, and the report type is BEGIN; after the LIG AS receives the report, it will perform interface conversion, Convert the report into a standard HI2 interface message IRI-BEGIN and pass it to LEMF(IRI);

Steps 411-415: After receiving the INVITE request, the called terminal prompts the user and rings, and sends a 180 (Ringing) response to the S-CSCF, and the S-CSCF forwards the response message to the LIG AS; after the LIG AS receives the message , modify the address information according to the port address mapping table, that is, replace the called SDP information with the called proxy port SDP information, and then send the modified ringing message back to the S-CSCF; the S-CSCF sends it back to the calling terminal according to the normal route;

Note: If the 180 ringing message contains the change information of the called SDP, you need to modify the original called address information in the port address mapping table;

Steps 416-420: After the called terminal responds, it sends a 200 OK response to the S-CSCF, and the S-CSCF forwards the response message to the LIG AS; after receiving the message, the LIG AS modifies the address information according to the port address mapping table. The SDP information of the called proxy port replaces the called SDP information, and then sends the modified ringing message back to the S-CSCF; the S-CSCF sends it back to the calling terminal according to the normal route;

Note: If the 200OK message contains the change information of the called SDP, the original called address information in the port address mapping table needs to be modified;

Steps 421, 422: After receiving the 200OK response message, the S-CSCF will generate an X2 report based on the relevant information in the 200OK message and send it to LIG AS, the report type is CONTINUE; after receiving the report, the LIG AS will perform interface conversion, Convert the report into a standard HI2 interface message IRI-CONTINUE and pass it to LEMF(IRI);

Steps 423-427: After receiving the 200OK response, the calling user responds with an ACK message for confirmation; the ACK message is passed to the called terminal via the S-CSCF and LIG AS;

Step 428: For the media stream received from the internal associated port, the LIG AS forwards it to the corresponding calling user port on the network element side through the proxy port. In this way, the detour and traversal of the media in the LIG AS are sent to the peer user. At the same time of media traversal, LIG copies the uplink and downlink media streams of the call branch respectively, performs standard encapsulation on the HI3 interface, and forwards them to the monitoring center.

Steps 429-433: The called party wants to terminate the session, and sends a BYE request to the other party through the S-CSCF; the BYE message is passed to the calling terminal through the S-CSCF and LIG AS;

Steps 434-438: After receiving the BYE request, the calling user responds with a 200OK message for confirmation; the 200OK message is passed to the called terminal via the S-CSCF and LIG AS;

Steps 439 and 440: After receiving the release confirmation message, the LIG AS will initiate the release operation of the HI3 channel to the LEMF, and delete the port address mapping table corresponding to the call.

Steps 441, 442: After receiving the 200OK message, the S-CSCF will generate an X2 report based on the relevant information in the 200OK message and send it to LIG AS, and the report type is END; The report is converted into a standard HI2 interface message IRI-END and passed to LEMF (IRI).

The present invention proposes a legal monitoring method for IMS communication network. Based on LIG AS equipment, it provides functions of monitoring gateway and monitoring application server, receives X2 information from network elements, and converts it into standard HI2 information; simultaneously controls the controlled user The media detours through the proxy port of the LIG AS device, and completes the copy output on the LIG AS device, so as to realize the legal monitoring function of the IMS communication. Those skilled in the art should understand that without exceeding the scope of the present invention, various changes, modifications and homogeneous replacement of parts can be implemented, and the above transformations and other equivalent transformations should be within the protection scope of the present invention Inside.

Claims (10)

1. A method for legally monitoring an IP multimedia subsystem network, comprising the steps of: (a) The call session control function CSCF receives the session initiation protocol SIP message, and if monitoring is required, the SIP message is forwarded to the monitoring gateway application server; (b) After receiving the SIP message, the monitoring gateway application server distributes the calling proxy port and the called proxy port on the monitoring gateway application server for this call, revises the SIP message in this calling, and calls the The port information is changed to the calling agent port information and sent to the called party, and the called port information is changed to the called agent port information and sent to the calling party; (c) The media streams communicated between the calling party and the called party are respectively sent to the called proxy port or the calling proxy port of the monitoring gateway application server, and the monitoring gateway application server copies the media streams and sends them to the legally enforced Monitoring equipment LEMF. 2. The method according to claim 1, wherein in the step (a), after the CSCF receives the SIP message, it judges whether monitoring is required by querying the initial filtering criteria, and after querying the initial filtering criteria, If the monitoring trigger condition is met, the monitoring is triggered. 3. The method according to claim 1, wherein in the step (a), after the CSCF receives the SIP message, it judges whether monitoring is required by querying the initial filtering criteria, and after querying the initial filtering criteria, If the monitoring trigger condition is satisfied, it is further determined whether the SIP message route has passed through the monitoring gateway application server, and if not, monitoring is triggered. 4. The method according to claim 1, wherein in the step (b), if the listening gateway application server fails to allocate the calling and/or called agent ports or fails to establish the HI3 channel to LEMF, The monitoring gateway application server performs processing according to the user's monitoring setting condition. If the user's monitoring setting condition is necessary to monitor, the monitoring gateway application server returns a failure indication to the CSCF, and the call fails. 5. The method according to claim 1, characterized in that, in the step (c), there are one or more LEMFs, and the monitoring gateway application server assembles the media stream into the required LEMF The format of the media packet is sent to the LEMF through the HI3 interface. 6. The method according to claim 1, characterized in that, in the step (b), after the monitoring gateway application server modifies the SIP message, it sends it to the CSCF, and then the CSCF sends it to the Describe the calling or called. 7. The method according to claim 1, wherein in the step (b), the monitoring gateway application server adds the routing information of the monitoring gateway application server in the message header of the SIP message, and the The modified SIP message is sent to the CSCF. 8. The method according to claim 6, characterized in that, after receiving the SIP message returned by the monitoring gateway application server, the CSCF generates a monitoring related information X2 report and sends it to the monitoring gateway application server, the The listening gateway application server converts it into a HI2 interface message and sends it to the LEMF. 9. The method according to claim 1, characterized in that in the step (b), after the monitoring gateway application server allocates the calling proxy port and the called proxy port, the port address of this call is established locally The mapping table includes the information of the calling port and the calling agent port, and the information of the called port and the called agent port. During this call, when the calling or called port changes, the port address mapping table is updated. 10. An IP multimedia subsystem network lawful interception system, comprising CSCF and LEMF, characterized in that it also includes an interception gateway application server, wherein, The CSCF receives the Session Initiation Protocol SIP message, judges whether monitoring is required, and if monitoring is required, forwards the SIP message to the monitoring gateway application server; The monitoring gateway application server is used to receive the SIP message sent by the CSCF, allocate a calling agent port and a called agent port on the monitoring gateway application server for the call, modify the SIP message in the call, and modify the calling port information Send the calling agent port information to the called party, modify the called port information to the called agent port information and send it to the calling party, receive the calling party and the called party and send it to the called party port or calling party of the monitoring gateway application server. Proxy the media stream of the port, and copy the media stream, and send it to the legally enforced monitoring device LEMF; The LEMF receives the media stream sent by the listening gateway application server.

Images