Title of Invention	METHODS AND SYSTEMS FOR SURVEILLANCE MONITORING IN A COMMUNICATION NETWORK BASED ON A NATIONAL SURVEILLANCE DATABASE
Abstract	Methods, systems, and computer program products are disclosed for providing surveillance monitoring in a communication networl< based on a national surveillance database. Communication-related information is received from a national surveillance database that includes communication-related information relating to individuals under surveillance. The received communication-related information is used to screen signaling messages relating to communications associated with the individuals.

Title of Invention

METHODS AND SYSTEMS FOR SURVEILLANCE MONITORING IN A COMMUNICATION NETWORK BASED ON A NATIONAL SURVEILLANCE DATABASE

Abstract

Methods, systems, and computer program products are disclosed for providing surveillance monitoring in a communication networl< based on a national surveillance database. Communication-related information is received from a national surveillance database that includes communication-related information relating to individuals under surveillance. The received communication-related information is used to screen signaling messages relating to communications associated with the individuals.

Full Text	DESCRIPTION METHODS. SYSTEMS, AND COMPUTER PROGRAM PRODUCTS FOR SURVEILLANCE MONITORING IN A COMMUNICATION NETWORK BASED ON A NATIONAL SURVEILLANCE DATABASE RELATED APPLICATIONS This application claims the benefit of U.S. Patent Application Serial No. 11/116,089, filed April 27,2005, the disclosure of which is incorporated herein by reference in its entirety. TECHNICAL FIELD The subject matter described herein relates to communication monitoring. More particularly, the subject matter described herein relates to providing surveillance monitoring in a communication network based on a national surveillance database. BACKGROUND Security has become an ever-growing concern in today's society. As security threats continue to increase, the perpetrators of crimes are enjoying the benefit of increased mobility and the ability to communicate anonymously using modern communication technologies. In order to better combat such security threats, it would be helpful to have the infrastructure and functionality in place to monitor the use of communication resources, such as the public switched telephone network (PSTN), by target individuals based on information collected and stored on a national level. That is, it would be helpful to law enforcement if a national master list of individuals under sun^eillance that may be administered, for example, by law enforcement was available to be used to monitor subscriber communication attempts / communications in a communication network. For example, call patterns and call-associated information, such as called party identification information and calling party identification information, for target individuals under surveillance may be monitored. Such information would prove helpful to law enforcement while limiting the exposure of law enforcement personnel to dangerous situations. In addition, it would be desirable that such information be provided to communication service providers real time or near real time, so that law enforcement can respond swiftly to developing events. Currently, such a national sun/eiliance database does not exist. Another problem with surveillance in modern communication networks is that subscribers have multiple communication identities. For example, a single subscriber may have several directory numbers, correspond to home, work, and mobile phones. In addition, with the advent of IP telephony, subscribers. may also have a IP telephony identities, such as session initiation protocol (SIP) uniform resource indicators (URIs). Even if a national surveillance database existed there would still be a need to correlate the identities of a subscriber for surveillance purposes. Accordingly, there exists a need for methods, systems, and computer program products for providing surveillance monitoring In a communication network based on a national surveillance database and for correlating identities of a subscriber under sun/eillance. SUMMARY In one aspect of the subject matter disclosed herein, a method is disclosed for providing surveillance monitoring in a communication network based on a national surveillance database. The method includes receiving,. from a national surveillance database that includes communication-related information relating to individuals under surveillance, communication-related Information relating to the Individuals. The received communication-related information is used to screen signaling messages relating to communications associated with the individuals. In another aspect of the subject matter disclosed herein, a system is disclosed for providing surveillance monitoring in a communication network based on a national surveillance database. The system includes a communications node that includes a surveillance database function for receiving, from a national sun/eillance database that includes communication-related information relating to individuals under surveillance, communication- related information relating to the individuals and for storing the communication-related information. The communication node also includes a surveillance screening function for using the received communication-related information to screen signaling messages relating to communications associated with the individuals. In another aspect of the subject matter disclosed herein, a computer program product is disclosed. The computer program product includes computer executable instructions embodied in a computer-readable medium. The computer executable instructions are for performing steps Including receiving, from a national sun^eillance database that includes communication-related information relating to individuals under surveillance, communication-> related information relating to the individuals and using the received communication-related information to screen signaling messages relating to communications associated with the individuals. BRIEF DESCRIPTION OF THE DRAWINGS Objects and advantages of the present invention will become apparent to those skilled in the art upon reading this description in conjunction with the accompanying drawings, in which like reference numerals have been used to designate like elements, and in which: Figure 1 is a block diagram illustrating a system for providing surveillance monitoring in a communication network based on a national surveillance database according to an aspect of the subject matter disclosed herein; Figure 2 is a block diagram illustrating a system for providing surveillance monitoring in a communication network based on a national sun/eillance database according to another aspect of the subject matter disclosed herein; Figure 3 is a block diagram illustrating a system for providing surveillance monitoring in a communication network based on a national surveillance database according to an aspect of the subject matter disclosed herein; Figure 4 is a flow diagram illustrating a method for providirig surveillance monitoring in a communication network based on a national surveillance database according to an aspect of the subject matter described herein; and Figure 5 is a flow diagram illustrating a method for providing surveillance monitoring in a communication network based on a national surveillance database according to another aspect of the subject matter described herein. DETAILED DESCRIPTION To facilitate an understanding of exemplary embodiments, many aspects are described in terms of sequences of actions that can be performed by elements of a computer system. For example, it will be recognized that in each' of the embodiments, the various actions can be performed by specialized circuits or circuitry (e.g., discrete logic gates interconnected to perform a specialized function), by program instructions being executed by one or more processors, or by a combination of both. Moreover, the sequences of actions can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor containing system, or other system that can fetch the instructions from a computer-readable medium and execute the instructions. As used herein, a "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-readable medium can be, for example but not limited to, an" electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. More specific examples (a non-exhaustive list) of the computer-readable medium can include the following: an electrical connection having one or more wires, a portable computer diskette, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, and a portable compact disc read-only memory (CDROM). Thus, the subject matter described herein can be ernbodied in many different forms, and alt such fomns are contemplated to be within the scope of what is claimed. Figure 1 is a block diagram illustrating a system for providing sun/eillance monitoring in a communication network based on a national sun/eillance database according to an aspect of the subject matter disclosed herein. In Figure 1, the system includes one or more communications nodes 100 that receive communication-related information relating to individuals under sun/eillance from a national surveillance database 102. Communication nodes 100 use the received communication-related information to screen signaling, messages relating to communications associated with the individuals, as discussed further below. Some or all of the received communication-related information may be stored locally on communication node 100 in a local database 103. The signaling messages may be received, for example, from an end office 104 in a public switched telephone network (PSTN) according to signaling system 7 (SS7) protocol. End office 104 is connected to one or more telephones 106 and facilitates calls over the PSTN. Each communication node 100 can t>e an SS7 signal transfer point (STP), an SS7-lnternet protocol (IP) signaling gateway, SS7 service control point, a router, a session initiation protocol (SIP) proxy node, an IP multimedia subsystem (IMS) node, a media gateway controller (MGC), a Softswitch, a media gateway (MG), a mobile switching center (MSC), a home location register (HLR), an equipment identity register (EIR) node, an authentication, center (AuC), a radio access network (RAN) node, or any other communication node. According to one aspect, national surveillance database 102 includes communication-related information for individuals under surveillance. The communication-related information is downloaded to each communication node 100 using any known communication method. For example, the communication- related information may be provided to each communication node 100 over an IP network via an IP link, either directly or indirectly. For example, according to one implementation, the national surveillance database distributes the communication-related information to one or more regional databases 108, which provide the communication-related information to communication nodes 100. The communication-related information in regional databases 108 may be a copy of the information contained in a national surveillance database 102 or may be a subset of the information that corresponds to a specific region. For example, a regional database may include communication-related information that corresponds to a specific service provider or to a specific region. According to another aspect, an electronic numbering (ENUM) database 110 provides additional subscriber identities that correspond to a subscriber once one subscriber ID is provided. ENUM database 110 may access a domain name system (DNS) server that includes one or more additional subscriber identifiers that correspond to a subscriber ID. For example, the subscriber ID may be a subscriber's telephone number and the corresponding subscriber identifiers may be one or more SIP URIs. ENUM database generally correlates an E.164 formatted telephone number such as a home number, pager number, mobile number, or fax number, or dialable short code identifier to one or more SIP URIs that can identify an IP address, an e-mail address, a network alias identifier (e.g., a screen name), and other like information associated with the subscriber. Other infomiation may be contained in ENUM database 110 as well, such as phone numbers. National surveillance database 102 may query ENUM database 110 to obtain the corresponding subscriber identifiers associated with a subscriber identifier in a national surveillance database 102. For example, when a sun/eillance authority places a subscriber ID, such as phone number "9193803814", under surveillance, a surveillance application in national surveillance database 102 can query ENUM database 110 using the "9193803814" identifier to obtain all other identifiers to which the number has been associated. National surveillance database 102 may query ENUM database 110 periodically for updates or as information is needed. In one aspect, ENUM database 110 is adapted to receive a subscription request that is associated with a "watched" subscriber ID and to report to the national surveillance database all ENUM information corresponding to the watched subscriber ID. ENUM database 110 may also be adapted to report all changes to ENUM Information. In one implementation, ENUM database 110 is adapted to respond to queries by national surveillance database 102 with a set of one or more naming authority pointer (NAPTR) records, which contain one or more unifomn resource identifier (URI) values associated with the subscriber identifier. The phone number "9193803814" may be transformed into a hostname by reversing the numbers, separating them with dots, and adding an e164.arpa suffix, to yield 4.1.8.3.0.8.3.9.1.9.e164.arpa. A DNS server can then be used to look up Internet addresses for services such as SIP telephony. NAPTR records may be used to translate E. 164 addresses to SIP addresses. An exemplary NAPTR record is shown below: $ORIGIN 2.4.2.4.5.5.5.1.e164.arpa. IN NAPTR 10010 "u" "sip+E2U" "IVSIslpiphonemeeexample.netl". The above example specifies that sip:[email protected] is the address for the "sip+E2U" sen/ice. The expression provides the ability to map corresponding SIP addresses to subscribers. The surveillance application receives the NAPTR records and incorporates the URI values into the sunireillance database. Alternatively, or in addition, ENUM database 110 may respond to queries by regional databases 108. According to another aspect of the subject matter disclosed herein, communication nodes 100 are adapted to query ENUM database 110 for ENUM information. Rgure 2 is a block diagram illustrating a system for providing surveillance monitoring in a communication network based on a national sun/eillance database according to another aspect of the subject matter disclosed herein. In Figure 2, communication nodes 100 are adapted to query ENUM database 110 to receive ENUM Infonnation corresponding to the communication-related information received from national surveillance database 102. For example, communication node 100 may send a request message to ENUM database 110 that includes a subscriber ID, such as a phone number. ENUM database 110 may send a response message that includes corresponding subscriber identifiers, such as a SIP URI. Whether the information is provided directly to communication node 100 by ENUM database 110 or via national surveillance database 102, communication node 100 may use the received ENUM information to screen signaling messages relating to communications associated with the individuals. National surveillance database 102 preferably includes a master list of individuals under surveillance, with regional databases 108 and/or communication nodes 100 being updated to match corresponding information in national sun/eillance database 102. For example, updated communication-related information may be provided to the regional databases and/or. communication nodes as a periodic update. Communication node 100 may include a data audit function to confirm that the communication-related information in communication node 100 is current and matches the corresponding communication-related permission in the national surveillance database 102 and/or regional databases 108. The communication-related information may also be encrypted and/or transferred to communication node 100 using a secure connection. For example, a secure connection may be established by using one or more security protocols for transferring the communication-related information over an IP network. Examples of security protocols include Internet protocol security protocol (IPSec), secure sockets layer (SSL), private communications technology (PCT), hypertext transport protocol secure (HTTPS), and secure hypertext transport protocol (SHTTP). National surveillance database 102 is preferably administered by a law enforcement agency or other authority to provide secure centralized control of the communication-related information. According to one implementation, the communication-related Information is not directly accessible or othenA^ise viewable at communication node 100 for added security. Exemplary communication-related information that may be received by communication node 100 from national surveillance database 108 is Illustrated in Table 1. Table 1 includes a subscriber identifier, corresponding ENUM information, a communication mode identifier, a sun^elllance action instruction, a surveillance authority contact identifier, a surveillance authority contact mode identifier, a sun/eillance tap identifier, a sun/eillance start time indicator, and a surveillance end time indicator. Table 1 may also include other information not shown, such as a text-to-voice conversion preference and a language translation preference. The subscriber identifier may include, for example, a mobile subscriber identifier (e.g., MSISDN, IMSI, MIN), an E.164 fomriatted telephone number, a dialable short code identifier, an IP address, an electronic mail address, a networi The corresponding ENUM-based infomnation may similarly include, for example, a mobile subscriber identifier, an E.164 formatted telephone number, a dialable short code identifier, an IP address, an electronic mail address, a network alias identifier, and/or a SIP URI. The ENUM-based information corresponds to the subscriber ID and is originated by ENUM database 110. The communication mode identifier is used to specify a particular mode or communication medium. The communication mode identifier may include, for example, a voice sen^ice mode identifier, a short message service mode identifier, multimedia message service mode identifier, instant message sen/ice mode identifier, and/or an electronic mail service mode identifier. The surveillance action Instruction specifies actions that are to be taken if the associated subscriber is involved in a call or a call setup attempt. The surveillance action instruction may include, for example, providing a notification message to a surveillance authority, generating a tog entry in surveillance log, generating a call detail record (CDR), redirecting the call, and/or blocking the call. The surveillance authority contact identifier may be used for sending notification messages or other required communications with a surveillance authority. The sun^eillance authority contact Identifier may include, for example, a mobile subscriber Identifier, a plain old telephone service telephone number, a dialable short code identifier, an IP address, an electronic mail address, a network alias identifier, or a SIP URI. The surveillance authority contact mode Identifier may be used to specify a particular mode of contact with a designated surveillance authority. The sun^eillance authority contact mode identifier may include, for example, electronic mail, instant message, short message service, multimedia message service, voice, and volcemail. The surveillance tap identifier Identifies a second communication node to route a call to for monitoring. A surveillance tap identifier may be included with respect to calls that require a real-time tap of the bearer stream, where a bearer stream may include audio, video, or other streaming data (e.g., WEB browsing session). The surveillance tap identifier may be used to Identify a particular node in the network through which a watched call is to be forcibly routed / re-routed. Examples of a sun/eillance tap ID may include an IP address, an SS7 point code address, or a network alias routing address, such as an SS7 location routing number. The surveillance tap ID may, for instance, identify a law enforcement equipped tandem office, or media gateway. The surveillance start date and end date may include date and/or time information indicating when surveillance should start and end. Additional parameters not shown In exemplary Table 11nclude a text-to-voice conversion preference and a language translation preference. The text-to-voice conversion preference may be specified with respect to the surveillance of messaging service messages (e.g., SMS, IM, MMS). The text-to-voice conversion preference identifies whether to translate an intercepted text message from text to voice prior to communicating the message contents to a surveillance authority. The language translation preference identifies whether to translate an intercepted text message Into a language required by a sun^illance authority. More particularly, with respect to Intematlonal applications, it may be useful for the database to associate a language preference with a surveillance authority, such that an intercepted text message may be translated into a language required by a sun/eillance authority. For example, a text message that is written in German may be translated into French, so that a French surveillance authority may quickly and easily review / interpret the contents of the intercepted Gennan text message. The same language translation preference may be specified with respect to text-to-voice conversions. Figure 3 is a block diagram illustrating a system for providing, surveillance monitoring in a communication network based on a national surveillance database according to one aspect of the subject matter disclosed herein. The system includes communications node 100. Communication node 100 includes a sun/eillance database function 300, a sun/eillance screening function 302, and a surveillance action function 304. Surveillance database function 300 receives communication-related information from national surveillance database 102 relating to communications associated with individuals under surveillance and stores the communication-related information in local database 103. The communication-related information may include ENUM information either from national surveillance database 102 or from ENUM database 110, as discussed above. Surveillance screening function 302 uses the received communication-related information to screen signaling messages, such as SS7 message, signaling units (MSUs) relating to communications associated with the individuals. Sun/eiliance screening function screens signaling messages to determine, for example, whether a called party and/or a calling party associated with the signaling message corresponds to a subscriber ID included in the communication-related information. The signaling messages that may be screened Include, for example, SS7 integrated services user part (ISUP), SS7 signaling connection control part (SCCP), transaction capabilities application part (TCAP), signaling transport (SIGTRAN) message transfer part 3 user adaptation layer (M3UA), SIGTRAN SCCP user adaptation layer (SUA), SIP, and H.323 signaling messages. Surveillance screening function 302 communicates with surveillance database function 300 to determine if the called and/or calling party associated with a screened signaling message is in local database 103. Surveillance action function 304 performs a surveillance action in response to sun/eillance screening function 302 to determine whether the called party and/or the calling party associated with the screened signaling message corresponds to a subscriber identifier included in the communication-related information. For example, surveillance action function 304 may provide a notification message to a surveillance authority, generate a log entry in" surveillance log, generate a call detail record (CDR), redirect a call associated with the screen signaling message, and/or block a call associated with the screen signaling message. Surveillance action function 304 may send a sun/eillance action message to another network entity to carry out the sun/eillance action or may perform the surveillance action at communication node 100. The subject matter described herein is not limited to performing surveillance screening using functions associated with a communication node. In an alternative implementation, some or all of the screening functions illustrated in Figure 3 may be located on elements of a network data collection system that is separate from or partially separate from communication node 100. One example of a commercially available network data collection platform suitable for implementing the subject matter described herein is the Sentinel^^" system available from Tekelec of Calabasas California. Briefly, the Sentinel^^ system includes message copy functions located internal to a communication node, such as a signal transfer point. The message copy functions copy signaling messages and forward the signaling message copies to a data collection platform. In addition, the Sentiner^ system may include link monitoring probes that non-intrusively copy signaling messages from signaling links external to the communication node. The probes also fonward the fonward the signaling message copies to the data collection platform. The network data collection platform store copies of the signaling messages and forward the message copies to regional message copying site collectors. The site collectors fonvard messages that meet predetermined filter criteria to a data gateway server. According to an exemplary implementation of the subject matter described herein, surveillance database function 300, surveillance screening function 302, sun/eillance action function 304, and local database 103 may be located on the data gateway server. Figure 4 is a flow diagram illustrating a method for providing surveillance monitoring in a communication network based on a national surveillance database according to an aspect of the subject matter described herein. In step 400, communication-related information relating to individuals under surveillance is received from national surveillance database 102. In step 402, the received communication-related information Is used to screen signaling messages relating to communications associated with the individuals. Figure 5 is a flow diagram illustrating a method for providing surveillance monitoring in a communication network based on a national surveillance database according to another aspect of the subject matter described herein. In step 500, communication-related information relating to individuals under surveillance is received from national surveillance database 102. As discussed above, the Information may t>e received directly or via regional surveillance database 108. In step 502, ENUN^ information corresponding to the communication-related information is received. The corresponding ENUM information may be received from national surveillance database 102, regional surveillance database 108, or directly from ENUM database 110, as described above. A signaling message is received in step 504. The signaling message is screened to determine whether called party and/or calling party associated with message corresponds to a subscriber ID in the communication-related information in step 506. In response to determining that a called party and/or calling party associated with the message corresponds to the subscriber ID in step 508, a sun/eillance action is performed in step 510. As discussed above, surveillance actions include providing a notification message to a sun^eillance authority, generating a log entry in surveillance log, generating a call detail record (CDR), redirecting a call associated with the screen signaling message, and blocking a call associated with the screen signaling message. In response to determining that a called party and/or calling party associated with the message corresponds to the subscriber ID in step 508, the message is processed normally. In either case, the next message is received and processed accordingly. It will be understood that various details of the invention may be changed without departing from the scope of the claimed subject matter. Furthermore, the foregoing description is for the purpose of illustration only, and not for the purpose of limitation, as the scope of protection sought is defined by the claims as set forth hereinafter together with any equivalents, thereof entitled to. CLAIMS What is claimed is: 1. A method for providing surveillance monitoring in a communication netwoi^k based on a national surveillance database, the method comprising: (a) receiving, from a national surveillance database that includes communication-related information relating to Individuals under sun/eillance, communication-related information relating to the individuals; and (b) using the received communication-related infomiation to screen signaling messages relating to communications associated v^th the individuals. 2. The method of claim 1 wherein receiving communication-related information relating to the individuals includes receiving at least one of a subscriber identifier, corresponding electronic numbering (ENUM) based information, a communication mode identifier, a surveillance action instruction, a surveillance authority contact identifier, a surveillance authority contact mode identifier, a text-to-voice conversion preference, a language translation preference, a surveillance tap identifier, a surveillance start indicator, and a surveillance end indicator. 3. The method of claim 1 wherein using the received communication-related information to screen signaling messages relating to communications associated v\rith the individuals includes screening a signaling message to detemnine whether at least one of a called party and a calling party associated with the message coresponds to a subscriber identifier included in the communication-related information. 4. The method of daim 3 comprising perfonning a sun/eillance action in response to determining that at least one of the called party and the calling party associated with the screened signaling message corresponds to the subscriber identifier included in the communication-related infomiation 5. The method of claim 1 comprising providing ENUM-database-origihated information to the national surveillance database, the ENUM infomiation including at least one additional subscriber identifier corresponding to a subscriber ID in the communication-related information, wherein the ENUM information is included in the received communication-related information. The method of claim 1 comprising: (a) querying an ENUM database for ENUM infomnatlon including at least one additional subscriber identifier corresponding to a subscriber ID in the communication-related infomiation; (b) receiving the ENUM infonmation; and (c) using the received ENUM Information to screen signaling messages relating to communications associated with the individuals. A computer program product comprising computer executable instnjctions embodied in a computer-readable medium for performing steps comprising: (a) receiving, from a national surveillance database that includes communication-related infomiation relating to individuals under sun/eillance. communication-related infomnation relating to the indtviduais; and (b) using the received communication-related information to screen signaling messages relating to communications associated with the individuals. A system for providing surveillance monitoring in a communication network based on a national surveillance database, the system comprising: (a) a surveillance database function for receiving, from a national surveillance database that includes communication-related information relating to individuals under surveillance, communication-related Information relating to the ir»divlduals and for storing the communication-related infomiation; and (b) a surveillance screening function for using the received communication-related information to screen signaling messages relating to communications associated with the individuals. The system of claim 8 wherein the surveillance database function is adapted to receive at least one of a subscriber identifier, con^esponding ENUM-based information, a communication mode identifier, a surveillance action instruction, a surveillance authority contact identifier, a surveillance authority contact mode identifier, a text-to-voice conversion preference, a language t^nslation preference^ a sun^eillance tap identifier, a surveillance stari: indicator, and a surveillance end indicator. The system of claim 8 >where}n the surveillance screening function screens signaling messages relating to communications associated v\rith the individuals to detemiine whether at least one of a called party and a catimg party associated with the message con^esponds to a subscriber identifier included in the communication-related infonnnation. The system of claim 8 comprising a surveillance action function for perfomning a surveillance action in response to the surveillance screening function detennining U^at at least one of the called party and the calling party associated with the screened signaling message corresponds to the subscriber identifier included in the communication-related information. The system of claim 8 comprising an ENUM database for providing ENUM infonnation to the national surveillance database, the ENUM infomnation including at least one additional subscriber identifier con^esponding to a subscriber ID in the communication-related information, wherein the ENUM information is included in the communication-related Infomiation received at the communication node. The system of claim 8 wherein the surveillance database function is adapted to query an ENUM database for ENUM infonmation including at least one additional subscriber identifier conresponding to a subscriber ID in the communication-related information and receive the ENUM infomiation, and the surveillance screening function is adapted to use the received ENUM information to screen signaling messages relating to communications associated with the individuals.

Full Text

DESCRIPTION
METHODS. SYSTEMS, AND COMPUTER PROGRAM PRODUCTS FOR
SURVEILLANCE MONITORING IN A COMMUNICATION NETWORK
BASED ON A NATIONAL SURVEILLANCE DATABASE
RELATED APPLICATIONS This application claims the benefit of U.S. Patent Application Serial No. 11/116,089, filed April 27,2005, the disclosure of which is incorporated herein by reference in its entirety.
TECHNICAL FIELD The subject matter described herein relates to communication monitoring. More particularly, the subject matter described herein relates to providing surveillance monitoring in a communication network based on a national surveillance database.
BACKGROUND
Security has become an ever-growing concern in today's society. As security threats continue to increase, the perpetrators of crimes are enjoying the benefit of increased mobility and the ability to communicate anonymously using modern communication technologies. In order to better combat such security threats, it would be helpful to have the infrastructure and functionality in place to monitor the use of communication resources, such as the public switched telephone network (PSTN), by target individuals based on information collected and stored on a national level. That is, it would be helpful to law enforcement if a national master list of individuals under sun^eillance that may be administered, for example, by law enforcement was available to be used to monitor subscriber communication attempts / communications in a communication network.
For example, call patterns and call-associated information, such as called party identification information and calling party identification information, for target individuals under surveillance may be monitored. Such information would prove helpful to law enforcement while limiting the exposure of law

enforcement personnel to dangerous situations. In addition, it would be desirable that such information be provided to communication service providers real time or near real time, so that law enforcement can respond swiftly to developing events.
Currently, such a national sun/eiliance database does not exist. Another problem with surveillance in modern communication networks is that subscribers have multiple communication identities. For example, a single subscriber may have several directory numbers, correspond to home, work, and mobile phones. In addition, with the advent of IP telephony, subscribers. may also have a IP telephony identities, such as session initiation protocol (SIP) uniform resource indicators (URIs). Even if a national surveillance database existed there would still be a need to correlate the identities of a subscriber for surveillance purposes.
Accordingly, there exists a need for methods, systems, and computer program products for providing surveillance monitoring In a communication network based on a national surveillance database and for correlating identities of a subscriber under sun/eillance.
SUMMARY
In one aspect of the subject matter disclosed herein, a method is disclosed for providing surveillance monitoring in a communication network based on a national surveillance database. The method includes receiving,. from a national surveillance database that includes communication-related information relating to individuals under surveillance, communication-related Information relating to the Individuals. The received communication-related information is used to screen signaling messages relating to communications associated with the individuals.
In another aspect of the subject matter disclosed herein, a system is disclosed for providing surveillance monitoring in a communication network based on a national surveillance database. The system includes a communications node that includes a surveillance database function for receiving, from a national sun/eillance database that includes communication-related information relating to individuals under surveillance, communication-

related information relating to the individuals and for storing the communication-related information. The communication node also includes a surveillance screening function for using the received communication-related information to screen signaling messages relating to communications associated with the individuals.
In another aspect of the subject matter disclosed herein, a computer program product is disclosed. The computer program product includes computer executable instructions embodied in a computer-readable medium. The computer executable instructions are for performing steps Including receiving, from a national sun^eillance database that includes communication-related information relating to individuals under surveillance, communication-> related information relating to the individuals and using the received communication-related information to screen signaling messages relating to communications associated with the individuals.
BRIEF DESCRIPTION OF THE DRAWINGS
Objects and advantages of the present invention will become apparent to those skilled in the art upon reading this description in conjunction with the accompanying drawings, in which like reference numerals have been used to designate like elements, and in which:
Figure 1 is a block diagram illustrating a system for providing surveillance monitoring in a communication network based on a national surveillance database according to an aspect of the subject matter disclosed herein;
Figure 2 is a block diagram illustrating a system for providing surveillance monitoring in a communication network based on a national sun/eillance database according to another aspect of the subject matter disclosed herein;
Figure 3 is a block diagram illustrating a system for providing surveillance monitoring in a communication network based on a national surveillance database according to an aspect of the subject matter disclosed herein;

Figure 4 is a flow diagram illustrating a method for providirig surveillance monitoring in a communication network based on a national surveillance database according to an aspect of the subject matter described herein; and
Figure 5 is a flow diagram illustrating a method for providing surveillance monitoring in a communication network based on a national surveillance database according to another aspect of the subject matter described herein.
DETAILED DESCRIPTION
To facilitate an understanding of exemplary embodiments, many aspects are described in terms of sequences of actions that can be performed by elements of a computer system. For example, it will be recognized that in each' of the embodiments, the various actions can be performed by specialized circuits or circuitry (e.g., discrete logic gates interconnected to perform a specialized function), by program instructions being executed by one or more processors, or by a combination of both.
Moreover, the sequences of actions can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor containing system, or other system that can fetch the instructions from a computer-readable medium and execute the instructions.
As used herein, a "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-readable medium can be, for example but not limited to, an" electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. More specific examples (a non-exhaustive list) of the computer-readable medium can include the following: an electrical connection having one or more wires, a portable computer diskette, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, and a portable compact disc read-only memory (CDROM).

Thus, the subject matter described herein can be ernbodied in many different forms, and alt such fomns are contemplated to be within the scope of what is claimed.
Figure 1 is a block diagram illustrating a system for providing sun/eillance monitoring in a communication network based on a national sun/eillance database according to an aspect of the subject matter disclosed herein. In Figure 1, the system includes one or more communications nodes 100 that receive communication-related information relating to individuals under sun/eillance from a national surveillance database 102. Communication nodes 100 use the received communication-related information to screen signaling, messages relating to communications associated with the individuals, as discussed further below. Some or all of the received communication-related information may be stored locally on communication node 100 in a local database 103. The signaling messages may be received, for example, from an end office 104 in a public switched telephone network (PSTN) according to signaling system 7 (SS7) protocol. End office 104 is connected to one or more telephones 106 and facilitates calls over the PSTN.
Each communication node 100 can t>e an SS7 signal transfer point (STP), an SS7-lnternet protocol (IP) signaling gateway, SS7 service control point, a router, a session initiation protocol (SIP) proxy node, an IP multimedia subsystem (IMS) node, a media gateway controller (MGC), a Softswitch, a media gateway (MG), a mobile switching center (MSC), a home location register (HLR), an equipment identity register (EIR) node, an authentication, center (AuC), a radio access network (RAN) node, or any other communication node.
According to one aspect, national surveillance database 102 includes communication-related information for individuals under surveillance. The communication-related information is downloaded to each communication node 100 using any known communication method. For example, the communication- related information may be provided to each communication node 100 over an IP network via an IP link, either directly or indirectly. For example, according to one implementation, the national surveillance database distributes the communication-related information to one or more regional

databases 108, which provide the communication-related information to communication nodes 100. The communication-related information in regional databases 108 may be a copy of the information contained in a national surveillance database 102 or may be a subset of the information that corresponds to a specific region. For example, a regional database may include communication-related information that corresponds to a specific service provider or to a specific region.
According to another aspect, an electronic numbering (ENUM) database 110 provides additional subscriber identities that correspond to a subscriber once one subscriber ID is provided. ENUM database 110 may access a domain name system (DNS) server that includes one or more additional subscriber identifiers that correspond to a subscriber ID. For example, the subscriber ID may be a subscriber's telephone number and the corresponding subscriber identifiers may be one or more SIP URIs. ENUM database generally correlates an E.164 formatted telephone number such as a home number, pager number, mobile number, or fax number, or dialable short code identifier to one or more SIP URIs that can identify an IP address, an e-mail address, a network alias identifier (e.g., a screen name), and other like information associated with the subscriber. Other infomiation may be contained in ENUM database 110 as well, such as phone numbers.
National surveillance database 102 may query ENUM database 110 to obtain the corresponding subscriber identifiers associated with a subscriber identifier in a national surveillance database 102. For example, when a sun/eillance authority places a subscriber ID, such as phone number "9193803814", under surveillance, a surveillance application in national surveillance database 102 can query ENUM database 110 using the "9193803814" identifier to obtain all other identifiers to which the number has been associated.
National surveillance database 102 may query ENUM database 110 periodically for updates or as information is needed. In one aspect, ENUM database 110 is adapted to receive a subscription request that is associated with a "watched" subscriber ID and to report to the national surveillance database all ENUM information corresponding to the watched subscriber ID.

ENUM database 110 may also be adapted to report all changes to ENUM Information.
In one implementation, ENUM database 110 is adapted to respond to queries by national surveillance database 102 with a set of one or more naming authority pointer (NAPTR) records, which contain one or more unifomn resource identifier (URI) values associated with the subscriber identifier. The phone number "9193803814" may be transformed into a hostname by reversing the numbers, separating them with dots, and adding an e164.arpa suffix, to yield 4.1.8.3.0.8.3.9.1.9.e164.arpa. A DNS server can then be used to look up Internet addresses for services such as SIP telephony. NAPTR records may be used to translate E. 164 addresses to SIP addresses. An exemplary NAPTR record is shown below: $ORIGIN 2.4.2.4.5.5.5.1.e164.arpa. IN NAPTR 10010 "u" "sip+E2U" "IVSIslpiphonemeeexample.netl".
The above example specifies that sip:[email protected] is the address for the "sip+E2U" sen/ice. The expression provides the ability to map corresponding SIP addresses to subscribers.
The surveillance application receives the NAPTR records and incorporates the URI values into the sunireillance database. Alternatively, or in addition, ENUM database 110 may respond to queries by regional databases 108.
According to another aspect of the subject matter disclosed herein, communication nodes 100 are adapted to query ENUM database 110 for ENUM information. Rgure 2 is a block diagram illustrating a system for providing surveillance monitoring in a communication network based on a national sun/eillance database according to another aspect of the subject matter disclosed herein. In Figure 2, communication nodes 100 are adapted to query ENUM database 110 to receive ENUM Infonnation corresponding to the communication-related information received from national surveillance database 102. For example, communication node 100 may send a request message to ENUM database 110 that includes a subscriber ID, such as a phone number. ENUM database 110 may send a response message that includes corresponding subscriber identifiers, such as a SIP URI.

Whether the information is provided directly to communication node 100 by ENUM database 110 or via national surveillance database 102, communication node 100 may use the received ENUM information to screen signaling messages relating to communications associated with the individuals.
National surveillance database 102 preferably includes a master list of individuals under surveillance, with regional databases 108 and/or communication nodes 100 being updated to match corresponding information in national sun/eillance database 102. For example, updated communication-related information may be provided to the regional databases and/or. communication nodes as a periodic update. Communication node 100 may include a data audit function to confirm that the communication-related information in communication node 100 is current and matches the corresponding communication-related permission in the national surveillance database 102 and/or regional databases 108.
The communication-related information may also be encrypted and/or transferred to communication node 100 using a secure connection. For example, a secure connection may be established by using one or more security protocols for transferring the communication-related information over an IP network. Examples of security protocols include Internet protocol security protocol (IPSec), secure sockets layer (SSL), private communications technology (PCT), hypertext transport protocol secure (HTTPS), and secure hypertext transport protocol (SHTTP).
National surveillance database 102 is preferably administered by a law enforcement agency or other authority to provide secure centralized control of the communication-related information. According to one implementation, the communication-related Information is not directly accessible or othenA^ise viewable at communication node 100 for added security.
Exemplary communication-related information that may be received by communication node 100 from national surveillance database 108 is Illustrated in Table 1. Table 1 includes a subscriber identifier, corresponding ENUM information, a communication mode identifier, a sun^elllance action instruction, a surveillance authority contact identifier, a surveillance authority contact mode identifier, a sun/eillance tap identifier, a sun/eillance start time indicator, and a

surveillance end time indicator. Table 1 may also include other information not shown, such as a text-to-voice conversion preference and a language translation preference.

The subscriber identifier may include, for example, a mobile subscriber identifier (e.g., MSISDN, IMSI, MIN), an E.164 fomriatted telephone number, a dialable short code identifier, an IP address, an electronic mail address, a networi The corresponding ENUM-based infomnation may similarly include, for example, a mobile subscriber identifier, an E.164 formatted telephone number, a dialable short code identifier, an IP address, an electronic mail address, a network alias identifier, and/or a SIP URI. The ENUM-based information corresponds to the subscriber ID and is originated by ENUM database 110.
The communication mode identifier is used to specify a particular mode or communication medium. The communication mode identifier may include, for example, a voice sen^ice mode identifier, a short message service mode identifier, multimedia message service mode identifier, instant message sen/ice mode identifier, and/or an electronic mail service mode identifier.
The surveillance action Instruction specifies actions that are to be taken if the associated subscriber is involved in a call or a call setup attempt. The surveillance action instruction may include, for example, providing a notification message to a surveillance authority, generating a tog entry in surveillance log, generating a call detail record (CDR), redirecting the call, and/or blocking the call.

The surveillance authority contact identifier may be used for sending notification messages or other required communications with a surveillance authority. The sun^eillance authority contact Identifier may include, for example, a mobile subscriber Identifier, a plain old telephone service telephone number, a dialable short code identifier, an IP address, an electronic mail address, a network alias identifier, or a SIP URI.
The surveillance authority contact mode Identifier may be used to specify a particular mode of contact with a designated surveillance authority. The sun^eillance authority contact mode identifier may include, for example, electronic mail, instant message, short message service, multimedia message service, voice, and volcemail.
The surveillance tap identifier Identifies a second communication node to route a call to for monitoring. A surveillance tap identifier may be included with respect to calls that require a real-time tap of the bearer stream, where a bearer stream may include audio, video, or other streaming data (e.g., WEB browsing session). The surveillance tap identifier may be used to Identify a particular node in the network through which a watched call is to be forcibly routed / re-routed. Examples of a sun/eillance tap ID may include an IP address, an SS7 point code address, or a network alias routing address, such as an SS7 location routing number. The surveillance tap ID may, for instance, identify a law enforcement equipped tandem office, or media gateway.
The surveillance start date and end date may include date and/or time information indicating when surveillance should start and end.
Additional parameters not shown In exemplary Table 11nclude a text-to-voice conversion preference and a language translation preference. The text-to-voice conversion preference may be specified with respect to the surveillance of messaging service messages (e.g., SMS, IM, MMS). The text-to-voice conversion preference identifies whether to translate an intercepted text message from text to voice prior to communicating the message contents to a surveillance authority.
The language translation preference identifies whether to translate an intercepted text message Into a language required by a sun^illance authority. More particularly, with respect to Intematlonal applications, it may be useful for

the database to associate a language preference with a surveillance authority, such that an intercepted text message may be translated into a language required by a sun/eillance authority. For example, a text message that is written in German may be translated into French, so that a French surveillance authority may quickly and easily review / interpret the contents of the intercepted Gennan text message. The same language translation preference may be specified with respect to text-to-voice conversions.
Figure 3 is a block diagram illustrating a system for providing, surveillance monitoring in a communication network based on a national surveillance database according to one aspect of the subject matter disclosed herein. The system includes communications node 100. Communication node 100 includes a sun/eillance database function 300, a sun/eillance screening function 302, and a surveillance action function 304. Surveillance database function 300 receives communication-related information from national surveillance database 102 relating to communications associated with individuals under surveillance and stores the communication-related information in local database 103. The communication-related information may include ENUM information either from national surveillance database 102 or from ENUM database 110, as discussed above.
Surveillance screening function 302 uses the received communication-related information to screen signaling messages, such as SS7 message, signaling units (MSUs) relating to communications associated with the individuals. Sun/eiliance screening function screens signaling messages to determine, for example, whether a called party and/or a calling party associated with the signaling message corresponds to a subscriber ID included in the communication-related information. The signaling messages that may be screened Include, for example, SS7 integrated services user part (ISUP), SS7 signaling connection control part (SCCP), transaction capabilities application part (TCAP), signaling transport (SIGTRAN) message transfer part 3 user adaptation layer (M3UA), SIGTRAN SCCP user adaptation layer (SUA), SIP, and H.323 signaling messages. Surveillance screening function 302 communicates with surveillance database function 300 to determine if the

called and/or calling party associated with a screened signaling message is in local database 103.
Surveillance action function 304 performs a surveillance action in response to sun/eillance screening function 302 to determine whether the called party and/or the calling party associated with the screened signaling message corresponds to a subscriber identifier included in the communication-related information. For example, surveillance action function 304 may provide a notification message to a surveillance authority, generate a log entry in" surveillance log, generate a call detail record (CDR), redirect a call associated with the screen signaling message, and/or block a call associated with the screen signaling message. Surveillance action function 304 may send a sun/eillance action message to another network entity to carry out the sun/eillance action or may perform the surveillance action at communication node 100.
The subject matter described herein is not limited to performing surveillance screening using functions associated with a communication node. In an alternative implementation, some or all of the screening functions illustrated in Figure 3 may be located on elements of a network data collection system that is separate from or partially separate from communication node 100. One example of a commercially available network data collection platform suitable for implementing the subject matter described herein is the Sentinel^*^" system available from Tekelec of Calabasas California. Briefly, the Sentinel^^ system includes message copy functions located internal to a communication node, such as a signal transfer point. The message copy functions copy signaling messages and forward the signaling message copies to a data collection platform. In addition, the Sentiner*^ system may include link monitoring probes that non-intrusively copy signaling messages from signaling links external to the communication node. The probes also fonward the fonward the signaling message copies to the data collection platform. The network data collection platform store copies of the signaling messages and forward the message copies to regional message copying site collectors. The site collectors fonvard messages that meet predetermined filter criteria to a data gateway server. According to an exemplary implementation of the subject

matter described herein, surveillance database function 300, surveillance screening function 302, sun/eillance action function 304, and local database 103 may be located on the data gateway server.
Figure 4 is a flow diagram illustrating a method for providing surveillance monitoring in a communication network based on a national surveillance database according to an aspect of the subject matter described herein. In step 400, communication-related information relating to individuals under surveillance is received from national surveillance database 102. In step 402, the received communication-related information Is used to screen signaling messages relating to communications associated with the individuals.
Figure 5 is a flow diagram illustrating a method for providing surveillance monitoring in a communication network based on a national surveillance database according to another aspect of the subject matter described herein. In step 500, communication-related information relating to individuals under surveillance is received from national surveillance database 102. As discussed above, the Information may t>e received directly or via regional surveillance database 108. In step 502, ENUN^ information corresponding to the communication-related information is received. The corresponding ENUM information may be received from national surveillance database 102, regional surveillance database 108, or directly from ENUM database 110, as described above. A signaling message is received in step 504. The signaling message is screened to determine whether called party and/or calling party associated with message corresponds to a subscriber ID in the communication-related information in step 506. In response to determining that a called party and/or calling party associated with the message corresponds to the subscriber ID in step 508, a sun/eillance action is performed in step 510.
As discussed above, surveillance actions include providing a notification message to a sun^eillance authority, generating a log entry in surveillance log, generating a call detail record (CDR), redirecting a call associated with the screen signaling message, and blocking a call associated with the screen signaling message. In response to determining that a called party and/or calling party associated with the message corresponds to the subscriber ID in

step 508, the message is processed normally. In either case, the next message is received and processed accordingly.
It will be understood that various details of the invention may be changed without departing from the scope of the claimed subject matter. Furthermore, the foregoing description is for the purpose of illustration only, and not for the purpose of limitation, as the scope of protection sought is defined by the claims as set forth hereinafter together with any equivalents, thereof entitled to.

CLAIMS What is claimed is:
1. A method for providing surveillance monitoring in a communication
netwoi^k based on a national surveillance database, the method
comprising:
(a) receiving, from a national surveillance database that includes communication-related information relating to Individuals under sun/eillance, communication-related information relating to the individuals; and
(b) using the received communication-related infomiation to screen signaling messages relating to communications associated v^th the individuals.

2. The method of claim 1 wherein receiving communication-related information relating to the individuals includes receiving at least one of a subscriber identifier, corresponding electronic numbering (ENUM) based information, a communication mode identifier, a surveillance action instruction, a surveillance authority contact identifier, a surveillance authority contact mode identifier, a text-to-voice conversion preference, a language translation preference, a surveillance tap identifier, a surveillance start indicator, and a surveillance end indicator.
3. The method of claim 1 wherein using the received communication-related information to screen signaling messages relating to communications associated v\rith the individuals includes screening a signaling message to detemnine whether at least one of a called party and a calling party associated with the message coresponds to a subscriber identifier included in the communication-related information.
4. The method of daim 3 comprising perfonning a sun/eillance action in response to determining that at least one of the called party and the calling party associated with the screened signaling message corresponds to the subscriber identifier included in the communication-related infomiation
5. The method of claim 1 comprising providing ENUM-database-origihated information to the national surveillance database, the ENUM infomiation

including at least one additional subscriber identifier corresponding to a
subscriber ID in the communication-related information, wherein the
ENUM information is included in the received communication-related
information.
The method of claim 1 comprising:
(a) querying an ENUM database for ENUM infomnatlon including at least one additional subscriber identifier corresponding to a subscriber ID in the communication-related infomiation;
(b) receiving the ENUM infonmation; and
(c) using the received ENUM Information to screen signaling messages relating to communications associated with the individuals.
A computer program product comprising computer executable instnjctions embodied in a computer-readable medium for performing steps comprising:
(a) receiving, from a national surveillance database that includes communication-related infomiation relating to individuals under sun/eillance. communication-related infomnation relating to the indtviduais; and
(b) using the received communication-related information to screen signaling messages relating to communications associated with the individuals.
A system for providing surveillance monitoring in a communication network based on a national surveillance database, the system comprising:
(a) a surveillance database function for receiving, from a national surveillance database that includes communication-related information relating to individuals under surveillance, communication-related Information relating to the ir»divlduals and for storing the communication-related infomiation; and
(b) a surveillance screening function for using the received communication-related information to screen signaling messages relating to communications associated with the individuals.

The system of claim 8 wherein the surveillance database function is adapted to receive at least one of a subscriber identifier, con^esponding ENUM-based information, a communication mode identifier, a surveillance action instruction, a surveillance authority contact identifier, a surveillance authority contact mode identifier, a text-to-voice conversion preference, a language t^nslation preference^ a sun^eillance tap identifier, a surveillance stari: indicator, and a surveillance end indicator.
The system of claim 8 >where}n the surveillance screening function screens signaling messages relating to communications associated v\rith the individuals to detemiine whether at least one of a called party and a catimg party associated with the message con^esponds to a subscriber identifier included in the communication-related infonnnation. The system of claim 8 comprising a surveillance action function for perfomning a surveillance action in response to the surveillance screening function detennining U^at at least one of the called party and the calling party associated with the screened signaling message corresponds to the subscriber identifier included in the communication-related information.
The system of claim 8 comprising an ENUM database for providing ENUM infonnation to the national surveillance database, the ENUM infomnation including at least one additional subscriber identifier con^esponding to a subscriber ID in the communication-related information, wherein the ENUM information is included in the communication-related Infomiation received at the communication node. The system of claim 8 wherein the surveillance database function is adapted to query an ENUM database for ENUM infonmation including at least one additional subscriber identifier conresponding to a subscriber ID in the communication-related information and receive the ENUM infomiation, and the surveillance screening function is adapted to use the received ENUM information to screen signaling messages relating to communications associated with the individuals.

METHODS AND SYSTEMS FOR SURVEILLANCE MONITORING IN A COMMUNICATION NETWORK BASED ON A NATIONAL SURVEILLANCE DATABASE

Documents:

Inventors:

PCT Conventions: