Patent ID: 7979529

Claim:
A method for monitoring a data stream in a data network between a first telecommunications terminal connected to the data network via at least one gateway, and a second telecommunications terminal, at least one authentication server being provided which is set up to perform access control to the data network, comprising: determining whether the first telecommunications terminal or the second telecommunications terminal is authorized to access the data network by checking a non-hidden administration database including data indicating whether each of the first and second telecommunications terminals is authorized to access the data network; in response to determining that the first telecommunications terminal or the second telecommunications terminal is authorized to access the data network, checking a hidden database for a monitoring designation assigned to the first or the second telecommunications terminal to determine whether the data stream between the first telecommunications terminal and the second telecommunications terminal is to be monitored; wherein the non-hidden administration database indicating whether each telecommunications terminal is authorized to access the data network and the hidden database indicating a monitoring designation for each telecommunications terminal are connected to each other for exchanging data with each other; if it is determined that the data stream is to be monitored, routing the data stream between the first and second telecommunications terminals via a monitoring server for copying the data stream; if it is determined that the data stream is not to be monitored, routing the data stream between the first and second telecommunications terminals without routing the data stream via said monitoring server; wherein during monitoring by the monitoring server, a copy of the data stream is created to which an identifying designation is added, wherein the identifying designation includes an IP address or an encrypted designation of the data stream as well as information relating to onward data transmission, and the copy together with the associated identifying designation is transmitted to at least one LI server and/or directly to an analyzer unit.