Keysight Technologies Network Monitoring Content Intercept Manager Enabling Lawful Intercept agencies to keep pace with evolving cellular networks Data Sheet CIM is a flexible tool allowing precise and secure lawful interception in both tactical and sustained deployments 02 | Keysight | Network Monitoring Content Intercept Manager - Data Sheet Overview Intercept agencies face the extreme challenge of maintaining effective operations in a constantly changing telecommunications technology landscape. In mobile communications GSM remains the dominant technology with approximately 66% of the world’s mobile subscribers. The vast majority of GSM network operators have evolved their networks by introducing UMTS, HSPA and LTE access. While GSM is the dominant technology CDMA remains an important technology and with the advent of LTE CDMA operators at last have a route to high speed data services. As of Fall 2013 there are 406 telecoms operators in 123 countries who have committed to commercial LTE network deployments or are engaged on trials, technology testing or studies, with 213 commercial networks live around the world. These networks are delivering services to over 63 million subscribers around the globe. Keysight Technologies, Inc. has evolved with the networks and is in a position to ensure that those with the legal right to monitor communications can maintain effective operations in the new and legacy domains. Keysight expertize In common with all Network Monitoring solutions, CIM is totally independent of the network equipment vendor and does not interact with network equipment. It leverages Keysight’s proven skills and expertise in wireless test to provide tightly-specified intelligence information, cost-effectively, reliably and efficiently. It can be scaled as required for use in passive, single or multi-point access applications. Tageting key technologies In order to be effective CIM must be able to support a wide range of cellular technologies and the key links/interfaces within them as follows: Content Intercept Manager (CIM) is part of Keysight’s powerful portfolio of Network Monitoring solutions targeted at the global security and safety market. CIM allows personnel to quickly and easily intercept cellular communications based upon pre-defined and legal targeting information. The solution is based upon high density passive probes and is totally independent of the telecoms network elements. It handles a high volume of call intercepts and supports many complex combination of call filters. Configuration and operation has been designed to be fast, flexible and productive, with automatic discovery of all relvant control and user plane information plus an easy-to-use graphical interface for creating, viewing and editing points of interest. Cellular technology Key link/interface GSM (voice/SMS/Fax) Abis (uplink and downlink only or both) GSM (voice/SMS/Fax) A-interface UMTS (voice/SMS/Fax) IuCS GSM/UMTS (data) GPRS Gn CDMA (voice/SMS/Fax) A1 LTE (data) S1, S6a Easy targeting, usage and system set-up The CIM solution reconstructs and records voice, SMS (text), Fax, DTMF (inband tones) and mobile data from cellular networks. It can handle a large volume of points of interest – potentially 5000 per system – and supports many complex call filtering scenarios including the actual telephone number (MSISDN), the network number for the subscriber (IMSI), the identity number for the mobile station (IMEI) or calling and called numbers. These filters may be prioritized and updated dynamically. easy and intuitive. A simple graphical user interface helps to visualize the data captured, update and track details of suspects and reprioritize them. Filters for handsets or numbers of interest can be quickly created and dynamically edited, allowing voice communications, SMS and mobile data to be monitored in real time or stored for later analysis. Users listening to calls in real time can be alerted by the system when calls with higher priority start and are given the option to switch between them. Cellular networks constantly change their configuration parameters in real-time. CIM automatically discovers the required control and user plane parameters from cellular networks, which means that users need little or no prior network knowledge. Operating the system is also The CIM user interface runs on a standard PC/Laptop and up to ten users may use the system simultaneously. The product scales from tactical point solutions to solutions covering an entire cellular network. 03 | Keysight | Network Monitoring Content Intercept Manager - Data Sheet Real time status screen view UMTS Real time view and audio playback of active voice and SMS communications – Listen to target calls in real-time – Decoded SMS displayed in native language – Users can quickly and easily customize the screen to show the data most pertinent to their needs – In addition to providing call view and audio playback in real-time all calls matching target criteria are stored for later analysis and play-back 04 | Keysight | Network Monitoring Content Intercept Manager - Data Sheet Real time status screen view UMTS Real time view illustrating some of the additional fields available when monitoring LTE networks – Capture data sessions in real time – View/filter LTE Global Unique Temporary id – View EUTRAN CGI (Cell id) – Detach mode, how did the session terminate? 05 | Keysight | Network Monitoring Content Intercept Manager - Data Sheet Detailed view screen Drill down on selected call of interest: – Examine individual events for each phase of a selected call in detail – V iew more esoteric fields of interest (e.g. Mobile Station classmark) to gain greater insight into your targets behaviour (point of interest groups may choose handsets with specific capabilities) Multi-level security access procedures Access to CIM is controlled via rigorous protocols and procedures, so that only authorized users are able to set up targets or view the data generated by CIM. Usernames and password authentications are required whenever users log on to the system. Additional restrictions can be imposed by setting up user permissions that restrict the viewing of certain points of interest to a subset of users. Encypted VPN data communication methods are supported. 06 | Keysight | Network Monitoring Content Intercept Manager - Data Sheet Content Intercept Manager Platform Content Intercept Manager consists of: Metadata/Voice Acquisition Platform Media Server System Probes extract data from the appropriate cellular network interfaces. The probes are able to automatically discover all required network data and run IMSI/TMSI mapping so that the system can constantly track and update the allocation of a TMSI for a particular IMSI within a cellular network. The Media Server System handles the storage of user and control plane files for user-defined targets. The probe then needs to discover the relationship between the path ID in the signaling and the channels carrying the AMR encoded voice in order to capture and reconstruct both sides of the conversation. Probes are remotely accessible and controllable, allowing extended operation and data forwarding to the Media Server or an external storage and analysis platform. The data format is compatible with legacy database systems and can be readily integrated with many existing solutions. As soon as a user creates a new target, the Media Server immediately requests the probe to capture the call or SMS from the network links. It records this data and updates the status and details of all monitored calls in real time, correlating call data from multiple probes if necessary. It consolidates all the information associated with a call into a single call record, converting the data into a format that is easy to understand and use: – V oice is extracted and converted to 2-channel .WAV files (one channel for each direction). Active voice calls can be played live on the user interface – SMS data is extracted and decoded for user viewing – In band DTMF tone analysis and decoding on voice calls is provided – S upplementary services (call forwarding, call waiting, three way calling etc) are identified, captured and dispayed – User data capture for PCAP decoding The user interface displays the current call status for all calls matching filtered POIs. Up to ten users can connect to the Media Server System simultaneously. Besides examining calls matching monitored POI filters in real time, they can easily retrieve and view the history of all calls of interest. Defining new tagets or editing existing is fast and easy. 07 | Keysight | Network Monitoring Content Intercept Manager - Data Sheet Key CIM benefits – R eal time view illustrating some of the additional fields available when monitoring LTE networks – Easy to use with minimal operator training required – Non-intrusive to the network and standards-based – M inimum interaction with the mobile network operator – S elf-configuring – little or no network information required – Network equipment vendor independent – Mobile handset type independent – Capable of handling high volumes intercepts – Multi-level security access procedures 08 | Keysight | Network Monitoring Content Intercept Manager - Data Sheet myKeysight www.keysight.com/find/mykeysight A personalized view into the information most relevant to you. www.axiestandard.org AdvancedTCA® Extensions for Instrumentation and Test (AXIe) is an open standard that extends the AdvancedTCA for general purpose and semiconductor test. Keysight is a founding member of the AXIe consortium. ATCA®, AdvancedTCA®, and the ATCA logo are registered US trademarks of the PCI Industrial Computer Manufacturers Group. www.lxistandard.org LAN eXtensions for Instruments puts the power of Ethernet and the Web inside your test systems. Keysight is a founding member of the LXI consortium. www.pxisa.org PCI eXtensions for Instrumentation (PXI) modular instrumentation delivers a rugged, PC-based high-performance measurement and automation system. Three-Year Warranty www.keysight.com/find/ThreeYearWarranty Keysight’s commitment to superior product quality and lower total cost of ownership. The only test and measurement company with three-year warranty standard on all instruments, worldwide. Keysight Assurance Plans www.keysight.com/find/AssurancePlans Up to five years of protection and no budgetary surprises to ensure your instruments are operating to specification so you can rely on accurate measurements. www.keysight.com/quality Keysight Technologies, Inc. DEKRA Certified ISO 9001:2008 Quality Management System Keysight Channel Partners www.keysight.com/find/channelpartners Get the best of both worlds: Keysight’s measurement expertise and product breadth, combined with channel partner convenience. For more information on Keysight Technologies’ products, applications or services, please contact your local Keysight office. The complete list is available at: www.keysight.com/find/contactus Americas Canada Brazil Mexico United States (877) 894 4414 55 11 3351 7010 001 800 254 2440 (800) 829 4444 Asia Pacific Australia China Hong Kong India Japan Korea Malaysia Singapore Taiwan Other AP Countries 1 800 629 485 800 810 0189 800 938 693 1 800 112 929 0120 (421) 345 080 769 0800 1 800 888 848 1 800 375 8100 0800 047 866 (65) 6375 8100 Europe & Middle East Austria Belgium Finland France Germany Ireland Israel Italy Luxembourg Netherlands Russia Spain Sweden Switzerland United Kingdom 0800 001122 0800 58580 0800 523252 0805 980333 0800 6270999 1800 832700 1 809 343051 800 599100 +32 800 58580 0800 0233200 8800 5009286 0800 000154 0200 882255 0800 805353 Opt. 1 (DE) Opt. 2 (FR) Opt. 3 (IT) 0800 0260637 www.keysight.com/find/monitoring For other unlisted countries: www.keysight.com/find/contactus (BP-07-10-14) This information is subject to change without notice. © Keysight Technologies 2013 - 2014 Published in USA, August 3, 2014 5991-3310EN www.keysight.com