My 4G lawful interception notes

Evolved Packet Systems (EPS)

• 3GPP TS 33.107
• 3GPP TS 33.108

EPS Data

IRI

The following events are applicable to the MME:

• Attach;
• Detach;
• Tracking Area/EPS Location Update;
• UE requested PDN connectivity;
• UE Requested PDN disconnection;
• Start of interception with E-UTRAN attached UE.

The following events are applicable to the Serving GW (S-GW) and PDN GW (P-GW):

• Bearer activation (valid for both Default and Dedicated bearer);
• Start of intercept with bearer active;
• Bearer modification;
• Bearer deactivation;
• UE Requested Bearer Resource Modification;
• Packet Data Header Information.

The following events are applicable to the HSS:

• Serving Evolved Packet System.
• HSS subscriber record change;
• Cancel location
• Register location;
• Location information request.

The following LALS Reports are applicable to the EPS (see Clause 19):

• Report for LALS Target Positioning;
• Report for LALS Enhanced Location for IRI.

Home Subscriber Server (HSS) IRI

Clause 10.5.1.1

• as a national option, a mobile terminal is authorized for service with another network operator or service provider; in that case, other related events are required as cancel location, register location, location information request from a third party’s node;
• as a national option, a REPORT record have to be generated when there is a HSS subscriber record change of IMSI or of MSISDN or IMEI triggered by a messages to or from the HSS;

IRI reports

• Table 10.5.1.1.12: Serving Evolved Packet System REPORT Record
• Table 10.5.1.1.17: HSS subscriber record change REPORT Record
• Table 10.5.1.1.18: Cancel location REPORT Record
• Table 10.5.1.1.19: Register location REPORT Record
• Table 10.5.1.1.20: Location information request REPORT Record

EPS Multimedia

This includes IMS-based voice (VoLTE) or other services.

33.108 12.1.4 Lawful intercept identifier (LIID) and Network identifier are same as data. The correlation number is unique per VoIP session.

For IMS-based VoIP, the S-CSCF and optionally, the P-CSCF provide the IRI events. For IMS-based VoIP, the functional element that provides the communication content (CC) interception depends on the call scenario and network configuration.

The term "CC Intercept Function" is a generic term used to denote a network function that has access to the voice media of an intercepted call. The term "CC Interception Triggering Function" is a generic term used to denote a network function that provides a trigger to intercept the CC.

As described in 33.107, CC interception may be done by one of the following functional elements (referred to as CC Intercept Function)

• PDN-GW/GGSN
• IMS-AGW
• TrGW
• IM-MGW
• MRF

The trigger to perform the CC interception at the above functional elements may be provided by the following functional elements (referred to as CC Interception Triggering Function)

CC Interception Triggering Function	CC Intercept Function
P-CSCF	PDN-GW/GGSN
P-CSCF	IMS-AGW
IBCF	TrGW
MGCF	IM-MGW
S-CSCF	MRF

My lawful interception notes