Abstract: Systems and methods for detecting a subscriber permanent identifier (SUPI) from a subscriber concealed identifier (SUCI) include steps of receiving the SUCI that is a representative of user equipment (UE) of interest and that is encrypted; checking association data with the received SUCI to determine a corresponding SUPI, wherein the association data includes a mapping of a plurality of SUCIs to a plurality of SUPIs and is maintained over time based on monitoring messages in a 5G core network; and providing the corresponding SUPI. The steps can further include updating the association data based on monitoring exchanges on both sides of an access and mobility management function (AMF) associated with the 5G core network.

Abstract: Systems and methods for call direction detection on Session Initiation Protocol (SIP) Internet Protocol (IP) Multimedia Subsystem (IMS) include monitoring SIP register messages, such as “401 UNAUTHORIZED” messages inside the IMS core to detect and log the IP addresses of the Proxy-Call Session Control Function (P-CSCF). The systems and methods include monitoring SIP registration messages; determining and storing addresses of P-CSCFs based on the monitoring of the SIP registration messages, wherein P-CSCF addresses are determined from any SIP registration messages having cipher or encryption keys therein; monitoring SIP INVITE messages; and, for a specific call associated with a SIP INVITE message, determining a direction of the specific call based on a comparison of address in the SIP INVITE messages with the stored addresses of the P-CSCFs.

Abstract: Systems and methods for call direction detection on Session Initiation Protocol (SIP) Internet Protocol (IP) Multimedia Subsystem (IMS) include monitoring SIP register messages, such as “401 UNAUTHORIZED” messages inside the IMS core to detect and log the IP addresses of the Proxy-Call Session Control Function (P-CSCF). The systems and methods include monitoring SIP registration messages; determining and storing addresses of P-CSCFs based on the monitoring of the SIP registration messages, wherein P-CSCF addresses are determined from any SIP registration messages having cipher or encryption keys therein; monitoring SIP INVITE messages; and, for a specific call associated with a SIP INVITE message, determining a direction of the specific call based on a comparison of address in the SIP INVITE messages with the stored addresses of the P-CSCFs.