On Identities in Modern Networks

Communicating parties inside computer networks use different kind of identifiers. Some of these identifiers are stable, e.g., logins used to access a specific service, some are only temporary, e.g., dynamically assigned IP addresses. This paper tackles several challenges of lawful interception that emerged in modern networks. The main contribution is the graph model that links identities learnt from various sources distributed in a network. The inferred identities result into an interception of more detailed data in conformance with the issued court order. The approach deals with network address translation, short-lived identifiers and simultaneous usage of different identities. The approach was evaluated to be viable during real network testing based on various means to learn identities of users connected to a network

Additions to Lawful Interception System

V rámci projektu Moderní prostředky pro boj s kybernetickou kriminalitou na internetu nové generace byl vytvořen prototyp systému pro zákonné odposlechy. Tato práce popisuje rozšíření systému, které poskytuje možnost odposlechu aplikačních protokolů (např. e-mailové komunikace) přímo v síti poskytovatele Internetového připojení. Tato nová funkcionalita umožňuje automaticky detekovat a filtrovat související TCP spojení. Odposlech je možné realizovat i v situacích, kdy dosud neznáme identitu (IP adresu) cílového uživatele, nebo v situacích, kdy není jednoduché tuto identitu zjistit (probíhá překlad adres - NAT, uživatel je v Internetové kavárně, za bránou firewall, apod.). Jedním z nejdůležitějších požadavků na vyvíjený prototyp je schopnost rychlého zpracování paketů s maximální propustností a minimálními ztrátami. Z těchto důvodů práce zahrnuje také profilaci výkonnosti, identifikaci kritických míst a jejich následnou optimalizaci.As a part of the Modern Tools for Detection and Mitigation of Cyber Criminality on the New Generation Internet project, a Lawful Interception System was developed. This thesis describes additions to the system, which provide a capability to intercept application protocols (eg. an e-mail communication) directly in a network of an Internet service provider. This new functionality enables automatic detection and filtering of a related TCP transfer. It is also able to handle situations, in which the identity (an IP address) of a target user is not known yet, or when it is difficult to detect it (NAT is in progress, user is at an Internet café, behind the firewall, etc.). One of the most important requirements for the developed prototype is the ability of a fast packet proccessing with maximum throughput and minimal packet loss. Therefore, this thesis also consists of a performance profiling, an identification of critical points and their optimalization.

On Identities in Modern Networks

Communicating parties inside computer networks use different kind of identifiers. Some of these identifiers are stable, e.g., logins used to access a specific service, some are only temporary, e.g., dynamically assigned IP addresses. This paper tackles several challenges of lawful interception that emerged in modern networks. The main contribution is the graph model that links identities learnt from various sources distributed in a network. The inferred identities result into an interception of more detailed data in conformance with the issued court order. The approach deals with network address translation, short-lived identifiers and simultaneous usage of different identities. The approach was evaluated to be viable during real network testing based on various means to learn identities of users connected to a network