# Patent

## Title
IP voice call surveillance through use of non-dedicated IP phone with signal alert provided to indicate content of incoming call prior to an answer as being a monitored call

## Abstract

Surveillance of IP telephony may be performed through the use of conventional telephone equipment, according to principles of the invention while preventing giving indication to the monitored phone by alerting the user of the monitoring phone to such surveillance use prior to pick up by an agent for engagement of the monitoring phone in response to the alert. Such alerts may assume many forms such as ringing, visual indicators, data readouts, activating ancillary equipment, various flags, etc. This alert prior to surveillance is distinct from alerts used for normal non-surveillance calls, which the monitoring phone is capable of receiving.

## Background
This application is a continuation of and claims priority to U.S. patent application Ser. No. 09/376,454, now U.S. Pat. No. 6,563,797, filed Aug. 18, 1999, and issued May 13, 2003, incorporated herein in its entirety.


FIELD OF THE INVENTION
This invention relates to surveillance of telephone calls over a public communications link and is particularly concerned with providing assistance for such surveillance to law enforcement agencies. It particularly concerns surveillance of voice over IP (i.e., cable) networks.
BACKGROUND OF THE INVENTION
Requirements for enabling surveillance of electronic communications have been enacted into public law (e.g., Public Law 103-414 enacted Oct. 25, 1994; CALEA Communications Assistance for Law Enforcement Act) reciting requirements for assuring law enforcement access to electronic communications. Such access is required to be in real time, have full time monitoring capabilities, simultaneous intercepts, and feature service descriptions. The requirements specifically include capacity requirements and function capability. It is incumbent upon communication carriers to provide such capability and capacity.
While initially limited in scope, at present, to certain communications technology it is almost assured that it will be extended to new forms of communication. New technologies require extension of CALEA to the new phone system technologies. With the advent of IP telephony it is desirable to provide surveillance capabilities for application to IP telephony.
One of the impediments to surveillance is the necessity of having dedicated equipment to perform the monitoring function. It would be useful to perform such surveillance of a targeted phone with non-dedicated telephone equipment. With use of such non-dedicated equipment it is desirable to distinguish normal calls from surveillance calls.
SUMMARY OF THE INVENTION
Surveillance of IP telephony may be performed through the use of conventional telephone equipment, according to principles of the invention while preventing giving indication to the monitored phone of the monitoring activity. The user of the monitoring phone is alerted to such surveillance use prior to pick up, by an agent for engagement of the monitoring phone, in response to the alert. Such alerts may assume many forms such as ringing, visual indicators, data readouts, activating ancillary equipment, various flags, etc. This alert prior to surveillance is distinct from alerts used for normal non-surveillance calls, which the monitoring phone is capable of receiving.
In an IP telephone environment, a cable modem bank (CMB) or an IP Phone intercept List (IP-PIL) lists the IP phones to be monitored and responds when one of those listed phones to be monitored becomes active. In response to notification by an IP Address Mapping Check Point with the IP-PIL, a distinctive alert is delivered to the monitoring phone, which indicates the call's existence and the monitoring purpose to be performed. The IP Address Mapping Check Point and associated WatchDog program alerts the monitoring phone when the monitored phone is in the process of receiving a call. In both instances the monitoring phone is controlled not to be active until both parties of the monitored call are connected and active.



BRIEF DESCRIPTION OF THE DRAWING
FIG. 1 is a block schematic of a surveillance system incorporating the principles of the invention; and
FIG. 2 is a flow chart of the process by which the invention is performed in the system of FIG. 1.



DETAILED DESCRIPTION
A monitoring station/location 101 is shown, in the FIG 1, as connected, via a broadband gateway 121, to a backbone Internet Protocol (IP) network 103 via the connection provided by an Hybrid Fiber Coax (HFC) distribution plant 105. HFC distribution plant 105 is a distribution cabling arrangement employing both optical fiber and coaxial cable. Optical fiber is connected to he backbone and coaxial cable is connected to the terminating devices. The optical fiber and coaxial cable are joined by an electro-optical connection. The objective is to provide higher bandwidth to the terminating devices at a lower cost then by using optical fiber alone.
The target telephone/DN 111 to be monitored is also connected, via a broadband gateway 131, to the backbone IP network 103 via the same HFC distribution plant 105. Included with the backbone IP network is an IP address mapping Check Point (IP-AMCP) 125, which provides numbers for various devices, connected to the backbone network 103. The IP-AMCP 125 may be embodied in a server within or connected to the network. It has the capability, through programming, of examining packet contents and authenticating users of the network. With specific WatchDog software 127 the IP-AMCP identifies specific activity from certain designated telephone stations 112 and/or 113 at a specified DN or IP address and can replicate/duplicate the packets of that phone and the IP target telephone 111 which replicated/duplicated packets are forwarded to the monitoring station 101.
The designated telephone stations 112 and 113 may be connected to the IP network 103 or to the Public Switched Telephone Network (PSTN) 115, as shown, and be connected to the target DN 111. The monitoring station 101 may not be dedicated to the surveillance function and hence some indication of its use is provided. The IP-AMCP 125 through its WatchDog 127 determines when an incoming call to the monitoring station is a surveillance call of the target DN 111. It uses this determination to provide an alerting signal to the monitoring station 101 so that the answerer is knowledgeable that the incoming call is a monitoring of a target IP telephone. In one aspect the gateway coupling the monitoring IP telephone to the IP network is a source of distinctive ringing signals or in the alternative provides an audio announcement.
The procedure in providing such an indicating alert is shown in the flow chart of FIG. 2. It starts, as indicted in block 203, with the initiation of a call to an IP telephone having a known DN. A WatchDog program associated with the IP-AMCP notes that the call is being initiated as per block 205. In decision block 207 an inquiry asks if the called DN is one of a list of IP telephone under surveillance. If it is not the flow proceeds per the instructions of block 209 to handle the call as a non-monitored call and the process ends at terminal 219.
If the DN called is on the surveillance list the process as per block 211 locates the addresses of the calling and called DNs in the IP-AMCP. According to the instructions of block 213 the IP-AMCP sends a distinctive alert message to a gateway terminal connecting the target IP telephone to the IP network and also to the gateway serving the monitoring IP telephone. In the instance of the gateway of the monitoring IP telephone the gateway in one embodiment rings the monitoring IP telephone with a distinctive ring, as per block 215, to indicate to the party answering the phone that this is a call connection for the purpose of eavesdropping in on the target IP telephone. In an alternative arrangement the gateway may have a facility to provide this information by means of an audio input. The monitoring process then proceeds, as per block 217, until termination of the call where upon the process ends at terminal 219.
The following applications are being filed concurrently with the present application and are incorporated herein by reference. All applications have the same inventors (e.g., Kung, Russell, Sankalia and Wang):
U.S. Pat. No. 6,381,220, entitled, Monitoring Selected IP Voice Calls Through Activity of a WatchDog Program at an IP-Addressing Mapping Checking Point, filed Aug. 18, 1999, and issued Apr. 30, 2002;
U.S. patent application Ser. No. 09/375,750, entitled, Monitoring IP Voice Calls Under Command of a PSTN Phone, filed Aug. 18, 1999;
U.S. Pat. No. 6,501,752, entitled, Flexible Packet Technique for Monitoring Calls Spanning Different Backbone Networks, filed Aug. 18, 1999, and issued Dec. 31, 2002;
U.S. Pat. No. 6,553,025, entitled, Multiple Routing and Automatic Network Detection of a Monitored Call from an Intercepted Targeted IP Phone to Multiple Monitoring Locations, filed on Aug. 18, 1999, and issued on Aug. 22, 2003;
U.S. Pat. No. 6,496,483, entitled, Secure Detection of an Intercepted Targeted IP Phone from Multiple Monitoring Locations, filed on Aug. 18, 1999, and issued on Dec. 17, 2002; and
U.S. Pat. No. 6,560,224, entitled, Automatic IP Directory Number Masking and Dynamic Packet Routing for IP Phone Surveillance, filed on Aug. 18, 1999, and issued on May 6, 2003.
While exemplary systems and methods embodying the present inventions are shown by way of example, it will be understood, of course, that the invention is not limited to these embodiments. Modifications may be made by those skilled in the art which differ from the specific details disclosed here, but which are still within the scope of the invention. Further elements of one invention may be readily included as elements of one of the other inventions. Those skilled in the art may combine or distribute the elements in many different ways without departing from the spirit and scope of the invention.

## Claims

1. A method of monitoring an Internet Protocol (IP) call in a network comprising:
detecting when a first communication device initiates the IP call with a second communication device;
determining if the IP call is to be monitored;
locating an IP address of a third communication device and an identifier associated with one of the first communication device or the second communication device; and
sending at least one data packet including an alert signal to an IP gateway serving the third communication device based on said locating step, said at least one data packet being associated with the IP call.

2. The method of claim 1 wherein the alert signal indicates an existence of the monitored call and a monitoring purpose to be performed.

3. The method of claim 2 wherein the alert signal indicates surveillance of the IP call.

4. The method of claim 3 further comprising the step of monitoring the IP call in response to receiving the alert signal at the IP gateway serving the third communication device.

5. The method of claim 1, wherein the identifier associated with one of the first communication device or the second communication device is compared with a plurality of identifiers.

6. The method of claim 5 wherein the step of sending comprises sending at least one data packet to the third communication device if said identifier matches at least one identifier in the plurality of identifiers.

7. The method of claim 5 wherein the plurality of identifiers comprises identifiers associated with communication devices connected to the network.

8. The method of claim 5 wherein the identifier is associated with the second communication device and the plurality of identifiers comprise identifiers associated with communication devices to be monitored.

9. The method of claim 5 wherein the identifier is associated with the first communication device and the plurality of identifiers comprise identifiers associated with communication devices to be monitored.

10. The method of claim 1, wherein an IP gateway annunciation alerts the third communication device with at least one of a distinct audible or visible announcement.

11. The method of claim 1 wherein said identifier associated with one of the first communication device or the second communication device is one of a phone number or an address.

12. A method of monitoring an Internet Protocol (IP) call in a network comprising:
storing a list of communication devices, said list comprising communication devices under surveillance;
detecting when an IP call is initiated by a call-initiating communication device to a target communication device in the network;
determining if the target communication device is on said list;
locating an IP address of a monitoring communication device;
receiving an alert signal at the IP gateway serving the monitoring communication device; and
sending, via a gateway annunciation, the alert signal to the monitoring communication device based on said locating step,
wherein the alert signal indicates an existence of the IP call and a monitoring purpose to be performed.

13. The method of claim 12 wherein said monitoring communication device generates a distinctive indicator in response to receiving said alert signal.

14. The method of claim 13 wherein said distinctive indicator comprises at least one of a distinctive ring or an audio announcement.

15. The method of claim 12 wherein said list of communication devices is provided by an IP address Mapping Check Point (IP-AMCP).

16. The method of claim 15 wherein the IP-AMCP is associated with a WatchDog program for detecting when a call is being initiated.

17. The method of claim 12 wherein the monitoring communication device is configured to be inactive until parties of the IP call are connected and active.

18. An apparatus for monitoring an Internet Protocol (IP) call in a network comprising:
a storage device for storing a list of identifiers associated with communication devices to be monitored;
a Watchdog processor for detecting when an IP call is initiated by a call-initiating communication device to a target communication device in the network and for determining if the IP call is to be monitored;
an IP gateway for receiving an alert signal, based on an IP address location of a monitoring communication device, wherein the IP gateway is associated with the monitoring communications device; and
an annunciator for sending an alert signal responsive to said Watchdog processor to the monitoring communication device,
wherein the alert signal indicates an existence of the IP call and a monitoring purpose to be performed.

19. The apparatus of claim 18, wherein the Watchdog processor is configured to locate the IP address for the monitoring communication device and the identifier of the communication device to be monitored.

20. The apparatus of claim 18 wherein the monitoring communication device generates an indication for call surveillance responsive to the alert signal.

21. The apparatus of claim 20 wherein said indication for call surveillance comprises one of a distinctive ring or an audible announcement.

22. The apparatus of claim 18 wherein the target communication device is associated with a target communication device identifier and the Watchdog processor compares said target communication device identifier with the list of identifiers associated with communication devices to be monitored.

23. The apparatus of claim 18 wherein the call-initiating communication device is associated with a call-initiating communication device identifier and the Watchdog processor compares said call-initiating communication device identifier with the list of identifiers associated with communication devices to be monitored.