Claims:WE CLAIM
1. A method of intent based Lawful Interception (LI) in a communication network, the method comprising:
interpreting, by a network device, an LI intent of a Law Enforcement Agency (LEA) based on LI intent information provided by the LEA;
determining, by the network device, LI content required by the LEA and at least one LI trigger associated with the LI content based on an analysis of the LI intent information;
monitoring, by the network device, ongoing communication session associated with an LI target user to detect matching of the at least one LI trigger;
processing, by the network device, duplicated LI content in response to matching of the at least one LI trigger, wherein the duplicated LI content captures at least a part of the LI content in the ongoing communication session of the LI target user;
inserting, by the network device, at least one marker tag in the duplicated LI content to generate marked LI content; and
sending, by the network device, the marked LI content and a notification comprising information associated with matching of the at least one LI trigger and the at least one marker tag to the LEA.
2. The method of claim 1 further comprising identifying at least one trigger detection network node to detect the at least one LI trigger based on a network node lookup table.
3. The method of claim 2 further comprising selecting a trigger detection network node from the at least one trigger detection node based on selection criteria comprising: location of the trigger detection node in the communication network, current load on the trigger detection node, and traffic conditions in network segments associated with the trigger detection node.
4. The method of claim 3, wherein the trigger detection node is selected when a content duplication node lacks capability to detect at least one of the at least one LI trigger.
5. The method of claim 1, wherein processing duplicated LI content comprises:
initiating sending at least a part of the duplicated LI content based on matching of at least one start LI trigger from the at least one LI trigger; and
terminating sending at least a part of the duplicated LI content based on matching of at least one stop LI trigger from the at least one LI trigger.
6. The method of claim 1 further comprising determining a confidence level associated with matching of the at least one LI trigger based on historical data associated with partial matching of the at least one LI trigger, the confidence level being determined in response to partial matching of the at least one LI trigger.
7. The method of claim 6 further comprising comparing the confidence level with a predefined confidence level, wherein the content duplication is selectively performed, when the confidence level is greater than the predefined confidence level.
8. The method of claim 1 further comprising receiving the LI intent information from the LEA at start of an LI session.
9. The method of claim 1, wherein the LI intent information comprises lookup tables, the lookup tables being used to determine the LI content required by the LEA and the at least one LI trigger.
10. The method of claim 1 further comprising performing auto-tuning of confidence levels for partial LI trigger matches and the lookup tables, based on LEA’s feedback and analysis of LI trigger matching events, wherein the LEA’s feedback comprises relevance of the duplicated LI content received by the LEA when compared with the intent of the LEA.
11. The method of claim 1, wherein each of the at least one LI trigger comprise at least one trigger condition, the content duplication being performed in response to matching of the at least one trigger.
12. The method of claim 1 further comprising sending a session ending report to the LEA, the session ending report comprising information associated with number of LI triggers that were matched, frequency and duration of matching of the LI triggers, delay between detection of matching of the LI triggers and initiation of content duplication.
13. A network device enabling intent based Lawful Interception (LI) in a communication network, the network device comprising:
a processor; and
a memory communicatively coupled to the processor, wherein the memory stores processor instructions, which, on execution, causes the processor to:
interpret an LI intent of a Law Enforcement Agency (LEA) based on LI intent information provided by the LEA;
determine LI content required by the LEA and at least one LI trigger associated with the LI content based on an analysis of the LI intent information;
monitor ongoing communication session associated with an LI target user to detect matching of the at least one LI trigger;
process duplicated LI content in response to matching of the at least one LI trigger, wherein the duplicated LI content captures at least a part of the LI content in the ongoing communication session of the LI target user;
insert at least one marker tag in the duplicated LI content to generate marked LI content; and
send the marked LI content and a notification comprising information associated with matching of the at least one LI trigger and the at least one marker tag to the LEA.
14. The network device of claim 13, wherein the processor is further configured to identify at least one trigger detection network node to detect the at least one LI trigger based on a network node lookup table.
15. The network device of claim 14, wherein the processor is further configured to select a trigger detection network node from the at least one trigger detection node based on selection criteria comprising: location of the trigger detection node in the communication network, current load on the trigger detection node, and traffic conditions in network segments associated with the trigger detection node.
16. The network device of claim 13, wherein to process duplicated LI content, the processor is further configured to:
initiate sending at least a part of the duplicated LI content based on matching of at least one start LI trigger from the at least one LI trigger; and
terminate sending at least a part of the duplicated LI content based on matching of at least one stop LI trigger from the at least one LI trigger.
17. The network device of claim 13, wherein the processor is further configured to determine a confidence level associated with matching of the at least one LI trigger based on historical data associated with partial matching of the at least one LI trigger, the confidence level being determined in response to partial matching of the at least one LI trigger.
18. The network device of claim 17, wherein the processor is further configured to compare the confidence level with a predefined confidence level, wherein the content duplication is selectively performed, when the confidence level is greater than the predefined confidence level.
19. The network device of claim 13, wherein the processor is further configured to perform auto-tuning of confidence levels for partial LI trigger matches and the lookup tables, based on LEA’s feedback and analysis of LI trigger matching events, wherein the LEA’s feedback comprises relevance of the duplicated LI content received by the LEA when compared with the intent of the LEA.
20. The network device of claim 13, wherein the processor is further configured to send a session ending report to the LEA, the session ending report comprising information associated with number of LI triggers that were matching, frequency and duration of matching of the LI triggers, delay between detection of matching of the LI triggers and initiation of content duplication.

Dated this 13th day of January 2017

Swetha SN
Of K&S Partners
Agent for the Applicant
, Description:TECHNICAL FIELD
This disclosure relates generally to Lawful Interception (LI) and more particularly to systems and methods of intent-based LI in communication networks.