Qosmos Network lntelligence for Lawful Interception

lntelligence a t Every Step of the lnterception System

Lawful lnterception (LI) solution vendors require the capability to see inside protocols and IP-based applications used by subscribers in many functions of a system including:

At the interception point In the Monitoring Center

m In traffic filtering and cleansing devices

Qosmos expertise in real-time parsing of all popular IP-based applications is crystallized in 2 products used by LI solution vendors at critical steps of the interception process:

l ) ixMachine LI Edition probes: For laser sharp interception up to 20 Gbps

2) ixEngine Software Development Kit: Software libraries embedded in monitoring centers to extract communication attributes and content from IP flows. Also used to filter intercepted traffic.

Qosmos Technologie in a U System

'!A QOSMOS I ixMachine L1 Edition

- IRI Monitoring

L

I Probes

Interception Traffic IP Flows Filtering Parsing

Benefits: lnterception of all services operated by Telcos (VolP, email) and over-the-top services (webmails, Instant Messaging, etc.) ldentification of users on any IP-based application ID (login, address, etc.)

m Support interception at very high throughputs: monitoring of 20 Gbps per probe, up to 160 000 sessions intercepted simultaneously Passive probes, no impact on the network

Qosmos Network lntelligence in the Monitoring Center

Product: ixEngine Software Development Kit for IP flow parsing

Benefits: m Parses all existing and popular new protocols

and applications Decodes unclean traffic (non H13, partial, etc.) Extracts communication metadata to index intercepted traffic

m Less storage and faster data access by working with application metadata instead of packets

Qosmos Network lntelligence for Layer 7 Traffic Filtering

, . . Product: . .

, .

ixEngine embedded into a layer7 traffic filtering device

, . . . Benefits:

Qosmos Network Intelligence at the m Enables Monitoring Center to scale by Interception Point discarding irrelevant packets (IPTV, ads, etc.) Product: . . . . ,

: , - . Optimized storage

. . ixMachine LI Edition probes . . . . . Lower risk of information overload among

. . , , . analysts

Product: ixMachine LI Probes and ixEngine SDK I Applications: Interception, H13 Filtering, Monitoring Center I Users: Suppliers of LI and lntelligence Solutions, Law Enforcement Agencies, Systems Integrators I Key Features: ldentification of targets and interception o f IP communications I For More Info: www.qosmos.com

"The proliferation of new /P-based applications and the exponential growth of traffic volumes are the key issues faced by LEAS and lnterception Solution Vendors. Our product strategy is designed to address these challenges. "

Jerome Tollet CTO, Qosmos

% QOSMOS Your Network is Information

.! QOSMOS Case Study of LI Solution Embedding Qosmos Technology

Overview Interception system for a whole country This reduces the number of packets

processed and stored by the monitoring Monitoring of 550 Gbps in real time center by 90% Qosmos ixMachine LI Edition at the instant upgrade of the monitoring center interception point for IP traffic capability from 100 simultaneous targets to Qosmos ixEngine used in H13 filtering and 900 users while keeping the same hardware in a monitoring center developed by a LI solution vendor 3) ixEngine in the Monitoring

Center 1) lnterception with ixMachine LI Edition ixEngine embedded in the Monitoring

Center accepts Ethernet, IP and H13 formats 21 X ixMachine LI Edition 10 031 probes with ixEngine parses the flows in real-time to 4 X l0 GE links each extract metadata and content for Each probe monitors up to 20 Gbps of - Standardized protocols: email sender, traffic and intercepts 120 000 simultaneous receiver, messaoe text, VolP caller and sessions Unlimited number of interception rules 47 X ixMachine LI Edition 1041 with 8 X l GE links Each probe monitors up to 5 Gbps of traffic and intercepts 60 000 simultaneous sessions Unlimited number of interception rules

callee. etc

Monitoring Center

Interface

Place of Qosmos technology in LI System ,-- -7- 4 L.

1 BF@?* - Instant Complex Messaging IP-based applications and webmails such as

L,' - Correlating communication attributes and content decreases storaqe requirements

LI Edition Probe I

- . compared to storing the entire data flows (full packet capture) by a factor of up to

Passive probes plugged in TAP mode has no impact on the network Space required to store a Yahoo! Mail message

lnterception on any application ID (login, email address, etc.) for all popular IP-based sewices

.- -h.- --- m Advanced interception on keywords - - , --- --I_ - .--. ---- ..-- J L

2) H13 Filtering with ixEngine H13 filtering device embedding Qosmos ixEngine developed by a LI solution vendor

Full Packet Capture ixEngine Metadata m ixEngine accepts H13 packets, parses H13

flows in real-time to identify applications (email, webmail, video streaming, etc.) Global System Performance Based on the application identification 550 Gbps monitored in real time provided by Qosmos ixEngine, the H13 filter selects only relevant packets (e.g. IPTV, ads UP to 5.3 Million simultaneous sessions and Youtube packets are discarded) and intercepted forwards them to the Monitoring Center Usage of Qosmos metadata and

content allows LEA to store 2 years of 1- communications instead of 6 months

Contacts EMEA 5 Impasse Chalabre 75017 Paris - France Phone: +33 1 78 09 14 40

Americas Germantown. MD. USA Phone: +l 301 528 8301

APAC S~ngapore Phony t65 63 56 60 10

www.qosmos.com