My 4G lawful interception notes
Evolved Packet Systems (EPS)
- 3GPP TS 33.107
- 3GPP TS 33.108
EPS Data
IRI
The following events are applicable to the MME:
- Attach;
- Detach;
- Tracking Area/EPS Location Update;
- UE requested PDN connectivity;
- UE Requested PDN disconnection;
- Start of interception with E-UTRAN attached UE.
The following events are applicable to the Serving GW (S-GW) and PDN GW (P-GW):
- Bearer activation (valid for both Default and Dedicated bearer);
- Start of intercept with bearer active;
- Bearer modification;
- Bearer deactivation;
- UE Requested Bearer Resource Modification;
- Packet Data Header Information.
The following events are applicable to the HSS:
- Serving Evolved Packet System.
- HSS subscriber record change;
- Cancel location
- Register location;
- Location information request.
The following LALS Reports are applicable to the EPS (see Clause 19):
- Report for LALS Target Positioning;
- Report for LALS Enhanced Location for IRI.
Home Subscriber Server (HSS) IRI
Clause 10.5.1.1
- as a national option, a mobile terminal is authorized for service with another network operator or service provider; in that case, other related events are required as cancel location, register location, location information request from a third party’s node;
- as a national option, a REPORT record have to be generated when there is a HSS subscriber record change of IMSI or of MSISDN or IMEI triggered by a messages to or from the HSS;
IRI reports
- Table 10.5.1.1.12: Serving Evolved Packet System REPORT Record
- Table 10.5.1.1.17: HSS subscriber record change REPORT Record
- Table 10.5.1.1.18: Cancel location REPORT Record
- Table 10.5.1.1.19: Register location REPORT Record
- Table 10.5.1.1.20: Location information request REPORT Record
EPS Multimedia
This includes IMS-based voice (VoLTE) or other services.
33.108 12.1.4 Lawful intercept identifier (LIID) and Network identifier are same as data. The correlation number is unique per VoIP session.
For IMS-based VoIP, the S-CSCF and optionally, the P-CSCF provide the IRI events. For IMS-based VoIP, the functional element that provides the communication content (CC) interception depends on the call scenario and network configuration.
As described in 33.107, CC interception is done by one of the following functional elements (referred to as CC Intercept Function)
- PDN-GW/GGSN
- IMS-AGW
- TrGW
- IM-MGW
- MRF
The trigger to perform the CC interception at the above functional elements may be provided by the following functional elements (referred to as CC Interception Triggering Function)
| CC Interception Triggering Function | CC Intercept Function |
|---|---|
| P-CSCF | PDN-GW/GGSN |
| P-CSCF | IMS-AGW |
| IBCF | TrGW |
| MGCF | IM-MGW |
| S-CSCF | MRF |