Patent ID: 7865944

Claim:
A method performed by a firewall for intercepting GPRS tunneling protocol (GTP) packets, the method comprising: receiving, at a tunnel request engine of the firewall, a GTP tunnel request from a first GTP tunnel endpoint; identifying, by the tunnel request engine, a user identifier associated with the GTP tunnel request; identifying, by the tunnel request engine, a GTP tunnel over which GTP tunnel packets, that are to be intercepted, will travel based on the user identifier and a list of interception identifiers; adding, by the tunnel request engine, a tunnel identifier for the GTP tunnel to a list of GTP tunnel identifiers recognized for interception; forwarding, by the tunnel request engine, the GTP tunnel request to a second GTP tunnel endpoint; after the adding the tunnel identifier to the list of GTP tunnel identifiers, receiving, at a tunnel packet engine of the firewall that is different than the tunnel request engine, GTP tunnel packets associated with the GTP tunnel, each of the GTP tunnel packets including tunnel identification information; determining, by the tunnel packet engine, whether each of the GTP tunnel packets is to be intercepted based on a comparison of the tunnel identification information to the list of GTP tunnel identifiers, where the determining comprises comparing a user identifier in a header of one of the GTP tunnel packets with the list of interception identifiers, when the list of interception identifiers has been updated to include a new entry after the GTP tunnel over which the GTP tunnel packets that are to be intercepted has been created; intercepting, by the tunnel packet engine, each of the GTP tunnel packets when there is a match between the tunnel identification information and the list of GTP tunnel identifiers; intercepting, by the tunnel packet engine, the one of the GTP tunnel packets when there is a match between the user identifiers in the header of the one of the GTP tunnel packet and the list of interception identifiers; and processing, by the tunnel packet engine, each of the intercepted GTP tunnel packets.