Summary of the invention
For cannot monitor do not possess standard monitor interface switching equipment on user and cannot realize whole network short message monitor problem and the present invention is proposed, for this reason, main purpose of the present invention is to provide a kind of short message monitor method and device, to solve the problem one of at least.
To achieve these goals, according to an aspect of the present invention, a kind of short message monitor method is provided.
Short message monitor method according to the present invention comprises: receive the signaling from Signalling Transfer Point STP; The information of the signaling from the controlled user in the signaling of STP is monitored interface by standard and reports to Lawful interception gateway LIG.
Preferably, the information of the signaling of controlled user is reported to LIG by standard monitoring interface to comprise: the Intercept related information IRI that the information package of the signaling of controlled user becomes to meet ETSI's etsi standard is reported; IRI report is reported to LIG by HI2 link.
Preferably, before the information of the signaling of controlled user is reported to LIG by standard monitoring interface, said method also comprises: receive establishing control to order and storing the information of controlled user from LIG, wherein, if control order comprises the information of controlled user; The control of removing received from LIG is ordered and the information of deleting the user cancelling control, wherein, removes the information that control order comprises the user cancelling control.
Preferably, after receiving the signaling from STP, said method also comprises: separate code signaling, from signaling, the signaling of controlled user is filtered out according to the information of controlled user, and essential information is extracted from the signaling of controlled user, wherein, essential information comprise following one of at least: calling number, called number, transmitting time, content of short message.
Preferably, separate code signaling and comprise: read the data parameters pointer in SCCP SCCP head, utilize the data length in data parameters pointer reading SCCP bag and message body.
Preferably, from signaling, the signaling of controlled user is filtered out according to the information of controlled user, from the signaling of controlled user, extract essential information comprise: when judging that signaling belongs to the signaling of controlled user, judge that signaling is begin type signaling or continue type signaling: if begin type signaling, then retrieve in buffer area and whether there is continue type signaling corresponding to signaling, if exist, then from begin type signaling and continue type signaling corresponding to begin type signaling, extract essential information, otherwise, buffer memory begin type signaling in buffer area, if continue type signaling, then retrieve in buffer area and whether there is begin type signaling corresponding to signaling, if exist, then from continue type signaling and begin type signaling corresponding to continue type signaling, extract essential information, otherwise, buffer memory continue type signaling in buffer area.
To achieve these goals, according to a further aspect in the invention, a kind of short message monitoring device is provided.
Short message monitoring device according to the present invention comprises: receiver module, for receiving the signaling from STP; Reporting module, reports to Lawful interception gateway LIG for the information of the signaling from the controlled user in the signaling of STP is monitored interface by standard.
Preferably, reporting module comprises: packing submodule, and the information package for the signaling by controlled user becomes to meet the IRI report of etsi standard; Send submodule, for IRI report is reported to LIG by HI2 link.
Preferably, said apparatus also comprises: the first receiver module, for receiving establishing control to order and storing the information of controlled user from LIG, wherein, if control order comprises the information of controlled user; Second receiver module, orders and the information of deleting the user cancelling control for the control of removing received from LIG, wherein, removes the information that control order comprises the user cancelling control.
Preferably, said apparatus also comprises: decoder module, for separating code signaling; Filtering module, for filtering out the signaling of controlled user from signaling according to the information of controlled user; Extraction module, for extracting essential information in the signaling from controlled user, wherein, essential information comprise following one of at least: calling number, called number, transmitting time, content of short message.
Pass through the present invention, adopt and the information of the signaling from the controlled user in the signaling of STP is reported to LIG by standard monitoring interface, solve the user that cannot monitor on the switching equipment not possessing standard monitoring interface and the problem that cannot realize the monitoring of whole network short message, short message Intercept related information (the Interception Related Information of GSM and cdma network can be provided for LIG simultaneously, referred to as IRI) report, and the Lawful Interception of short message also can be realized when network element does not possess and monitors standard interface, the whole network can be realized monitor, extend the practical range of Lawful Interception, improve the comprehensive of Lawful Interception.
Embodiment
Functional overview
Consider problems of the prior art, embodiments provide a kind of short message Monitor scheme, the treatment principle of the program is: receive the signaling from Signalling Transfer Point STP; The information of the signaling from the controlled user in the signaling of STP is monitored interface by standard and reports to Lawful interception gateway LIG.The program can provide the short message IRI of GSM and cdma network to report for LIG simultaneously, and the Lawful Interception of short message also can be realized when network element does not possess and monitors standard interface, extend the practical range of Lawful Interception, improve the comprehensive of Lawful Interception.
Hereinafter also describe the present invention in detail with reference to accompanying drawing in conjunction with the embodiments.It should be noted that, when not conflicting, the embodiment in the application and the feature in embodiment can combine mutually.
Embodiment of the method
According to embodiments of the invention, provide a kind of short message monitor method, Fig. 1 is the flow chart of the short message monitor method according to the embodiment of the present invention, and as shown in Figure 1, the method comprises following step S102 to step S104:
Step S102, receives the signaling from Signalling Transfer Point STP;
Step S104, monitors interface by the information of the signaling from the controlled user in the signaling of STP by standard and reports to Lawful interception gateway LIG.
Preferably, the information of the signaling of controlled user is reported to LIG by standard monitoring interface comprise: the IRI report information package of the signaling of controlled user being become to meet ETSI (European Telecommunications Standards Institute, referred to as ETSI) standard; IRI report is reported to LIG by HI2 link.
And to be monitored before interface reports to LIG by standard in the information of the signaling by controlled user, said method can also comprise: receive establishing control order and storing the information of controlled user from LIG, wherein, if control order comprises the information of controlled user; The control of removing received from LIG is ordered and the information of deleting the user cancelling control, wherein, removes the information that control order comprises the user cancelling control.
Preferably, after receiving the signaling from STP, said method can also comprise: separate code signaling, from signaling, the signaling of controlled user is filtered out according to the information of controlled user, and essential information is extracted from the signaling of controlled user, wherein, essential information comprise following one of at least: calling number, called number, transmitting time, content of short message.Wherein, the process of separating code signaling comprises: read the data parameters pointer in SCCP head, utilizes the data length in data parameters pointer reading SCCP bag and message body.From signaling, the signaling of controlled user is filtered out according to the information of controlled user, the process extracting essential information from the signaling of controlled user comprises: when judging that signaling belongs to the signaling of controlled user, judge that signaling is begin type signaling or continue type signaling: if begin type signaling, then retrieve in buffer area and whether there is continue type signaling corresponding to signaling, if exist, then from begin type signaling and continue type signaling corresponding to begin type signaling, extract essential information, otherwise, buffer memory begin type signaling in buffer area, if continue type signaling, then retrieve in buffer area and whether there is begin type signaling corresponding to signaling, if exist, then from continue type signaling and begin type signaling corresponding to continue type signaling, extract essential information, otherwise, buffer memory continue type signaling in buffer area.
Be described in detail below in conjunction with the implementation procedure of example to the embodiment of the present invention.
Example 1
Illustrate the course of work of the short message monitor method that the embodiment of the present invention provides below, Fig. 2 is the detail flowchart of the short message monitor method according to example 1 of the present invention, and as shown in Figure 2, the method comprises the following steps 200 to step 240:
Step 200, receives STP and forwards the short message signaling of coming, trigger signalling analysis forward process flow process;
Step 210, decodes to the signaling received, that is, resolve signaling code stream, determines the content with the relevant each field of monitoring in code stream;
Step 220, according to the essential information of establishing control number, filter out signaling after the parsing that step 210 generates and do not establish control number or inactive signaling (preferably, first can filter out inactive signaling, control number is not established after filtering), then from efficient signaling, extract monitoring essential information (that is, above-mentioned essential information), such as, calling and called, time and content etc.Afterwards these effective informations (that is, essential information) are organized into IRI message one by one, are transmitted to lower layer procedure, are transmitted to LIG by them;
Step 230, IRI message coding step 220 generated becomes to meet the code stream of etsi standard;
Step 240, forwards the IRI report of step 230 generation to LIG.
In above-mentioned flow process, the key of the execution efficiency of the present case that step 210 is decoded.Here in order to improve execution efficiency, the analyzing step of SCCP (Signaling ConnectionControl Part, referred to as SCCP) head is eliminated; And while decoding (that is, decoding), judge the validity of signaling, if inactive signaling, then directly abandon, save decoding time.
Fig. 3 is according to the information decoding of example 1 of the present invention and the detail flowchart of filtration, and as shown in Figure 3, the specific operation process of information decoding and filtration comprises the following steps:
Step 310, reads MTP OPC Origination Point Code OPC in front;
Step 320, judges that this signaling is UDT or XUDT type.If UDT, enter step 330, if XUDT, then enter step 380;
Step 330, reads data parameters pointer in SCCP head, the data length in directly utilizing this pointer extracting SCCP to wrap and message body.Here not field parsing one by one as regular decode, this is because this example does not need SCCP information in front, only needs the message body of SCCP, has therefore directly skipped the parsing to SCCP head here, decoding speed can be made faster;
Step 340, judges whether the TCAP type of message of signaling, component type and command code are required types.If need, then enter step 350, if invalid, then abandon, decoding terminates.
Wherein, the TCAP type of message needed refers to: for cdma network be QueryWith Permission, Query Without Permission, Conversation WithPermission know one of this several types of Conversation Without Permission, Begin, Continue for GSM network.
The component type needed refers to: be Invoke Last for CDMA, is Invoke for GSM.
The command code needed refers to: be SMS Delivery Point toPoint for cdma network, is one of MO-FORWARD-SHORT-MESSAGE and MT-FORWARD-SHORT-MESSAGE for GSM network.
Step 350, decoding composition parameter.GSM network solution is to the type of message son field of BearData parameter, and cdma network solution is to the type of message son field of UI parameter;
Step 360, whether the type of message that determining step 340 generates is Submit or Delivery, if yes then enter step 370, is not, abandons, and decoding terminates;
Step 370, continues decoding until extract point-to-point short message to monitor relevant all fields, comprises calling and called, the time, content, end of decoding afterwards.
Step 380, judges whether that collecting this XUDT wraps, and if yes then enter step 330, otherwise enters step 390;
Step 390, XUDT wraps stored on the node of corresponding buffering area by the index set up with OPC and things ID.
Fig. 4 is the flow chart generating IRI report according to the extraction signaling information of example 1 of the present invention, as shown in Figure 4, extracts and monitor essential information and the process generating IRI report comprises the following steps in above-mentioned steps 220 from efficient signaling:
Step 410, judges that the network at this signaling place is GSM or CDMA.If GSM, enter step 420, if CDMA, then enter step 450.Here why distinguish GSM or CDMA, be because GSM signaling is more special, its calling and called number that only had the signaling band of Begin type complete, and continue message, only with main or called number.Meanwhile, be identical with the OPC of a collection of Begin, continue message and things ID;
Step 420, judges whether it is Begin message, if enter step 430, otherwise enters step 460;
Step 430, buffer memory begin message;
Step 440, finds corresponding continue and end message in buffering area (that is, above-mentioned buffering area);
Step 450, from each bar message being buffered in this node, extracts one by one and monitors relevant field, organize HI2 to report, be transmitted to and monitor LEA;
Step 460, judges in message buffer, whether have corresponding Begin message, just enter step 450 if had, directly organize IRI message and forward; If there is no begin message, then enter step 470;
Step 470, utilizes OPC and things ID computation index, according to this indexed cache on corresponding node.
Wherein, the method for building up of buffering area index is using OPC and Transaction ID as keyword, and the former displacement and the latter's sum are as index.First such index ensure that same a collection of Begin and the continue signaling of GSM network can be placed in the node of same data field, and index sets up algorithm simply, and uniformity is good.
In sum, above-mentionedly the information of the signaling of the controlled user in the signaling of Signalling Transfer Point is monitored by standard method that interface reports to LIG solve the LIG existed in prior art and can not monitor and do not possess the problem that standard monitors the signaling on the switching equipment of interface, meanwhile, said method coordinates the mechanism of message buffering to solve the problem that cannot realize whole network monitoring.
Device embodiment
According to embodiments of the invention, provide a kind of short message monitoring device, Fig. 5 is the structured flowchart of the short message monitoring device according to the embodiment of the present invention, and as shown in Figure 5, this device comprises: receiver module 52, for receiving the signaling from STP; Reporting module 54, is connected to receiver module 52, reports to Lawful interception gateway LIG for the information of the described signaling from the controlled user in the signaling of STP is monitored interface by standard.
Fig. 6 is the detailed block diagram of the short message monitoring device according to the embodiment of the present invention, and as shown in Figure 6, on the basis of Fig. 5, reporting module comprises: packing submodule 61, and the information package for the signaling by controlled user becomes to meet the IRI report of etsi standard; Send submodule 62, be connected to packing submodule 61, for described IRI report is reported to described LIG by HI2 link.This device also comprises: the first receiver module 63, for receiving establishing control order and storing the information of controlled user from described LIG, wherein, described in establish control order to comprise the information of controlled user; Second receiver module 64, order for the control of removing received from described LIG and deletes the information of the user cancelling control, wherein, described in remove control order comprise described in cancel the information of the user of control.Decoder module 65, is connected to receiver module 52, for described signaling of decoding; Filtering module 66, is connected to the first receiver module 63, second receiver module 64 and decoder module, for filtering out the signaling of controlled user from described signaling according to the information of controlled user; Extraction module 67, is connected to filtering module 66, for extracting essential information in the signaling from described controlled user, wherein, described essential information comprise following one of at least: calling number, called number, transmitting time, content of short message.
Be described in detail below in conjunction with the implementation procedure of example to the embodiment of the present invention.
Example 2
This example describes the detailed construction of short message monitoring device and the function of each module.
This device receives the short message signaling of Signalling Transfer Point (STP), resolves after filtering and is transmitted to Lawful interception gateway LIG by standard interface.Short message analyzer (namely, the short message monitoring device that the embodiment of the present invention provides) receive the MTP3 signaling that Signalling Transfer Point (STP) sends, Decoding Analysis signaling content, leach the content of short message of the user establishing control, be organized into the IRI report meeting etsi standard and report LIG by HI2 link.Meanwhile, short message analyzer provides HI1 interface, and that sends under process LIG establishes control order, and stores controlled object information.
In addition, due to the signaling enormous amount through Signalling Transfer Point, and decoding itself needs very large operand, therefore, has incorporated the fast decoding thinking of signaling in the apparatus, on the other hand, due to the own characteristic of GSM network short message signaling, this device adds message buffering mechanism when processing signaling, utilizes the reasonable combination of OPC Origination Point Code (OPC) and things ID to set up index, buffer memory numbers of calling and called parties, guarantees that the substance that IRI reports is comprehensive.
Fig. 7 shows in actual applications, and the composition structured flowchart of the monitoring system of the short message monitoring device that the application embodiment of the present invention provides, as shown in Figure 7, this system comprises short message Analysis server 101, Signalling Transfer Point 102, motoring gateway LIG 103.Introduce the function of each several part below.
Short message Analysis server 101: for receiving the signaling that STP sends here, analyze its content, filters and extracts essential information wherein, organizing IRI to report, finally forward; On the other hand, receive receive that LIG issues by HI1 link establish control, remove control order, and store the Back ground Information of controlled number.Fig. 6 has also indicated the several main function sub-modules of short message analyzer, comprising:
Communication module 110: be responsible for communicating with STP, LIG;
Coding/decoding module 111: be responsible for resolving signaling and coding;
Information extraction and molded tissue block 112: be responsible for filtering signaling, and from efficient signaling, extract essential information and organize IRI to report;
HI1 command processing module 113: be responsible for the HI1 order that process LIG issues, the information of monitored target be stored in local data base (that is, the monitor information database 114 hereafter will mentioned);
Monitor information database 114: for storing the essential information of monitored target, as number, network type, the type of number, the signaling that information extraction and molded tissue block 112 will utilize these information to filter out controlled number from a large amount of signalings.
Signalling Transfer Point 102: be responsible for the short message related signaling of process to be forwarded to short message Analysis server.
Motoring gateway LIG103: be responsible for issuing to short message Analysis server establishing control and removing control order; Receive the IRI report reported from short message Analysis server.
In sum, the scheme that the embodiment of the present invention provides achieves and utilizes a network element namely to can be LIG to provide the short message IRI of GSM and cdma network to report simultaneously, and also can realize the Lawful Interception of short message when network element does not possess and monitors standard interface, extend the practical range of Lawful Interception.
It should be noted that, can perform in the computer system of such as one group of computer executable instructions in the step shown in the flow chart of accompanying drawing, and, although show logical order in flow charts, but in some cases, can be different from the step shown or described by order execution herein.
Obviously, those skilled in the art should be understood that, above-mentioned of the present invention each module or each step can realize with general calculation element, they can concentrate on single calculation element, or be distributed on network that multiple calculation element forms, alternatively, they can realize with the executable program code of calculation element, thus, they can be stored and be performed by calculation element in the storage device, or they are made into each integrated circuit modules respectively, or the multiple module in them or step are made into single integrated circuit module to realize.Like this, the present invention is not restricted to any specific hardware and software combination.
The foregoing is only the preferred embodiments of the present invention, be not limited to the present invention, for a person skilled in the art, the present invention can have various modifications and variations.Within the spirit and principles in the present invention all, any amendment done, equivalent replacement, improvement etc., all should be included within protection scope of the present invention.