7  Invocation of Lawful Interception for GSN Packet Data services  Word‑p. 54

7.0  General |R12|

Figure 18 shows the extract from the reference configuration which is relevant for the invocation of the Lawful Interception of the packet data GSN network.

[not reproduced yet]

Figure 18: Functional model for Packet Data GSN Network Lawful Interception invocation

The HI2 and HI3 interfaces represent the interfaces between the LEA and two delivery functions. Both interfaces are subject to national requirements. They are included for completeness, but are beyond the scope of this specification. The delivery functions are used:

• to convert the information on the X2-interface to the corresponding information on the HI2 interface;
• to distribute the intercept related information to the relevant LEA(s);
• to distribute the intercept product to the relevant LEA(s).

For the delivery of the CC and IRI the 3G SGSN and/or, per national option 3G GGSN provides correlation number and target identity to the DF2 and DF3 which is used there in order to select the different LEAs where the product shall be delivered. When the SGSN connects an UE to a S-GW through the S4 interface (TS 23.060, see also note 3), the SGSN is not required to provide CC for that communication (see note 4).

The correlation number is unique in the whole PLMN and is used to correlate CC with IRI and the different IRI's of one PDP context.

The correlation number shall be generated by using existing parameters related to the PDP context.

When the SGSN connects an UE to a S-GW through the S4 interface (TS 23.060, see also note 3), the SGSN is not required to provide IRIs for PDP contexts associated with CC and correlation for that communication (see note 4).

If interception has been activated for both parties of the Packet Data communication both CC and IRI shall be delivered for each party as separate intercept activity.

In case of location dependent interception:

• for each target, the location dependency check occurs at each Packet Data session establishment or release and at each Routing Area (RA) update to determine permanently the relevant IAs (and deduce, the possible LEAs within these IAs);
• concerning the IRI:
  • when an IA is left, either a Mobile Station Detach event is sent when changing servicing 3G GSNs, or an RA update event is sent;
  • RA update event is sent to DF2 when changing IAs inside the same servicing 3G SGSN;
  • when a new IA is entered a RA update event is sent to DF2 and, optionally, a "Start of interception with PDP context active" event for each PDP context;
• concerning the CC, when crossing IAs, the CC is not sent anymore to the DF3 of the old IA but sent to the DF3 of the new IA.

Both in case of location dependent and location independent interception:

"Start of interception with PDP context active" event is sent by the new SGSN if an Inter-SGSN RA update procedure, which involves different PLMNs, takes place for a target, which has at least one active PDP context.

Optionally, it is possible to send "Start of interception with PDP context active" for all cases of inter- SGSN RA update when at least one PDP context is active.

When the SGSN connects an UE to a S-GW through the S4 interface, the S-GW provides IRI, CC and correlation for the EPS bearer associated to the PDP context, as specified in clause 12.

National regulations on a per interception basis may limit delivery of communications (CC and IRI) of an outbound international roaming target by the HPLMN as described in clause 5.1.4 of TS 33.106.

If roaming interception is not allowed in the HPLMN and it is determined that the target is outside the country, the HPLMN shall not report IRI and CC for the target's.

Non-communications-associated IRI (e.g. those identified by the HSS) are not affected by this requirement.

7.1  Provision of Intercept Product - Short Message Service  Word‑p. 55

Figure 19 shows an SMS transfer from the 3G SGSN node to the LEA. Quasi-parallel to the delivery from / to the mobile subscriber a SMS event, which contains the content and header of the SMS, is generated and sent via the Delivery Function 2 to the LEA in the same way as the Intercept Related Information. National regulations and warrant type determine if a SMS event shall contain only SMS header, or SMS header and SMS content. Non-Local ID targeting is optional and may require traffic analysis.

The IRI will be delivered to the LEA:

• for a MO-SMS. Dependent on national requirements, delivery shall occur in the following cases:
  • when the 3G SGSN receives the SMS from the target MS, or when the 3G SGSN detects that an SMS is to the Non-Local ID target.
  • when the 3G SGSN receives notification that the SMS-Centre successfully received the SMS that was originated from the target MS, or sent to the Non-Local ID target;
• for a MT-SMS. Dependent on national requirements, delivery shall occur in the following cases:
  • when the 3G SGSN receives the SMS from the SMS-Centre when the SMS was originated from a Non-Local ID target, or will have to be sent to a target MS.
  • when the 3G SGSN receives notification that recipient MS has received the SMS successfully. The recipient MS is the target MS when the SMS is sent to the target. The recipient MS may not be the target when the SMS was originating from a Non-Local ID target.

[not reproduced yet]

Figure 19: Provision of Intercept Product - Short Message Service

7.2  Provision of Intercepted Content of Communications - Packet data GSN services  Word‑p. 56

7.2.0  General |R12|

The access method for the delivering of Packet Data GSN Intercept Product is based on duplication of packets without modification at 3G GSN. The duplicated packets with additional information in a header, as described in 7.2.1, are sent to DF3 for further delivery to the LEA.

[not reproduced yet]

Figure 20: Configuration for interception of Packet Data GSN product data

7.2.1  X3-interface

In addition to the intercepted content of communications, the following information needs to be transferred from the 3G GSN to the DF3 in order to allow the DF3 to perform its functionality:

• target identity;
• correlation number;
• time stamp - optional;
• direction (indicates whether T-PDU is MO or MT) - optional;
• the target location (if available) or the IAs in case of location dependent interception;
• date/time of location (if target location provided).

As a national option, in the case where the 3G GGSN is performing interception of the content of communications, the target is handed off to another SGSN and the same 3G GGSN continues to handle the content of communications subject to roaming agreements, the 3G GGSN shall continue to perform the interception of the content of communication.

If 3G direct tunnel functionality with the GGSN, as defined in TS 23.060, is used in the network, then the GGSN shall perform the interception of the content of communications.

7.3  Provision of Intercept Related Information  Word‑p. 57

7.3.0  General |R12|

Intercept Related Information (Events) are necessary at the Mobile Station Attach, Mobile Station Detach, PDP Context Activation, Start of intercept with PDP context active, PDP Context Deactivation, RA update, Serving System, Packet Data Header Information, and SMS events.

Other HLR, Non-Local ID targeting for SMS (e.g. based on traffic analysis), LI LCS Client related and Serving System events reporting are national options.

Packet Data Header Information reporting is a national option.

Figure 21 shows the transfer of intercept related information to the DF2. If an event for / from a mobile subscriber occurs, the 3G GSN, LI LCS Client or the Home Location Register (HLR) sends the relevant data to the DF2. For Packet Data Header Information reporting, a 3G GSN either isolates the relevant data and sends it to the DF2 or sends the packet stream to another entity in the network (e.g., DF3) for isolation which then provides the relevant data to the DF2.

See clause 7A for multi-media Intercept Related Information produced at the CSCF.

[not reproduced yet]

Figure 21: Provision of Intercept Related Information

7.3.1  X2-interface  Word‑p. 58

The following information needs to be transferred from the 3G GSN, LI LCS Client or the HLR to the DF2 in order to allow a DF2 to perform its functionality:

• target identity (MSISDN or E. 164 number for Non-Local ID, IMSI, IMEI);
• events and associated parameters as defined in clauses 7.3.2 and 7.4 may be provided;
• the target location (if available) or the IAs in case of location dependent interception;
• date/time of location (if target location provided);
• Correlation number;
• Quality of Service (QoS) identifier;
• Encryption parameters (keys and associated parameters for decrypting CC), if available and necessary.

The IRI should be sent to DF2 using a reliable transport mechanism.

The 3G GSN detects packets containing packet data header information in the communications path but the information needed for Packet Data Header Information reporting may need to be transferred from the 3G GSN either directly to the DF2 or via another entity in order to allow the DF2 to perform its functionality.

7.3.2  Structure of the events

There are several different events in which the information is sent to the DF2 if this is required. Details are described in the following clause. The events for interception are configurable (if they are sent to DF2) in the 3G GSN, LI LCS Client or the HLR and can be suppressed in the DF2.

The following events are applicable to 3G SGSN:

• Mobile Station Attach;
• Mobile Station Detach;
• PDP context activation;
• Start of interception with mobile station attached (national option);
• Start of intercept with PDP context active;
• PDP context modification;
• PDP context deactivation;
• RA update;
• SMS;
• Packet Data Header Information.

3G GGSN interception is a national option. Location information may not be available in this case. If interception is performed at the 3G GGSN, then Packet Data Header Information reporting shall also be performed at the 3G GGSN and not at the 3G SGSN.

If 3G direct tunnel functionality with the GGSN, as defined in TS 23.060, is used in the network, then both the SGSN and the GGSN shall perform the interception of intercept related information.

When the SGSN connects an UE to a S-GW through the S4 interface (TS 23.060), the SGSN is not required to report events PDP context activation (successful), Start of intercept with PDP context active, PDP context modification, PDP context deactivation; the SGSN shall report unsuccessful PDP context activation event.

The following events are applicable to the 3G GGSN:

• PDP context activation;
• PDP context modification;
• PDP context deactivation;
• Start of interception with PDP context active;
• Packet Data Header Information.

The following events are applicable to the HLR:

• Serving System;
• HLR subscriber record change;
• Cancel location;
• Register location;
• Location information request.

The following LALS Reports are applicable to Packet Data services (see Clause 19):

• Report for LALS Target Positioning;
• Report for LALS Enhanced Location for IRI.

A set of elements as shown below can be associated with the events. The events trigger the transmission of the information from 3G GSN, LI LCS Client or HLR to DF2, perhaps via a MF in the case of Packet Data Header Information. Available IEs from this set of elements as shown below can be extended in the 3G GSN or HLR, if this is necessary as a national option. DF2 can extend available information if this is necessary as a national option e.g. a unique number for each surveillance warrant.

Table 2: Information Elements for Packet Data Event Records

Element

Description

---

Observed MSISDN

MSISDN of the target.

Observed IMSI

IMSI of the target.

Observed IMEI

IMEI of the target, it shall be checked for each activation over the radio interface.

Old observed MSISDN

Old MSISDN of the target before a change.

Old observed IMSI

Old IMSI of the target before a change.

Observed Non-Local ID

Event type

Description which type of event is delivered: MS attach, MS detach, PDP context activation, Start of intercept with PDP context active, PDP context deactivation, SMS, Serving System, Packet Data Header Information, Cell and/or RA update, HLR subscriber record change, Cancel location, Register location, Location information request. In case of LALS report the event type is absent.

Event date

Date of the event generation in the 3G GSN or the HLR, or the report generation in the LI LCS Client.

Event time

Time of the event generation in the 3G GSN or the HLR, or the report generation in the LI LCS Client. Timestamp shall be generated relative to GSN or HLR internal clock.

PDP address

The PDP address of the target. Note that this address might be dynamic. In case the PDP type is IPv4v6, the parameter may carry two IP addresses.

Access Point Name

The APN of the access point. (Typically the GGSN of the other party).

Location Information

Location Information is the Service Area Identity (SAI), RAI and/or location area identity that is present at the GSN or present in the LI LCS Client at the time of event record production. Country and network IDs can be considered as location information.

Time of Location

Date/Time of location. The time when location was obtained by the location source node.

Old Location Information

Location Information of the subscriber before Routing Area Update

PDP Type

The used PDP type.

Correlation Number

The correlation number is used to correlate CC and IRI.

SMS

The SMS content with header which is sent with the SMS-service. The header also includes the SMS-Centre address.

Network Element Identifier

Unique identifier for the element reporting the ICE.

Failed attach reason

Reason for failed attach of the target.

Failed context activation reason

Reason for failed context activation of the target.

IAs

The observed Interception Areas.

Initiator

The initiator of the PDP context activation, deactivation or modification request either the network or the 3G MS.

SMS Initiator

SMS indicator whether the SMS is MO or MT or undefined.

Deactivation / termination cause

The termination cause of the PDP context.

QoS

This field indicates the Quality of Service associated with the PDP Context procedure.

Serving System Address

Information about the serving system (e.g. serving SGSN number or serving SGSN address).

NSAPI

Network layer Service Access Point Identifier

The NSAPI information element contains an NSAPI identifying a PDP Context in a mobility management context specified by the Tunnel Endpoint Identifier Control Plane.

This is an optional parameter to help DF/MF and LEA's to distinguish between the sending mobile access networks when the GGSN is used as element of the PDG according TS 23.234, Annex F.

ULI Timestamp

Indicates the time when the User Location Information was acquired.

The parameter is specified in TS 29.060.

Destination IP Address

The IP address, including type IPv4 or IPv6, of the destination of the IP packet.

Destination Port Number

The port number of the destination of the IP packet.

Flow Label (IPv6 only)

The field in the IPv6 header that is used by a source to label packets of a flow (see RFC 3697 [41]).

Packet Count

The number of packets detected and reported (for a particular summary period).

Packet Data Summary Reason

The reason for a Packet Data Summary message being sent to the LEMF (e.g., timed out, counter expiration, end of session)

Packet Size

The size of the packet. (i.e. Total Length Field in IPv4 or Payload Length field in IPv6)

Source IP Address

The IP address, including type IPv4 or IPv6, of the source of the IP packet.

Source Port Number

The port number of the source of the IP packet.

Sum of Packet Sizes (for a particular summary period)

The sum of values contained in the Total Length fields of the IPv4 packets or the sum of the values contained in the Payload Length fields of the IPv6 packets.

Summary Period

Includes the dates and times of the first and last packets in a particular packet data interval.

Transport Protocol (e.g. TCP)

The identification of the transport protocol of the packet or packet flow being reported.

Other update:

Carrier specific information related to its implementation or subscription process on its HLR.

IMSI or MSISDN or IMEI change type

Identifies the type of subscriber information change in the HLR.

Previous serving system identifier

The VPLMN ID of the previous serving system.

Current serving system identifier

The VPLMN ID of the current serving system.

Requesting network identifier

Is the identifier (including country identifier) of the network requesting the target's location.

Requesting node type

Identifies the type of node in the requesting network that is requesting the target's location.

location error code

LALS positioning error identification code

---

7.4  Packet Data related events  Word‑p. 61

7.4.1  Mobile Station Attach

For attach an attach-event is generated. When an attach activation is generated from the mobile to serving 3G G SN this event is generated. These elements will be delivered to the DF2 if available:

• Observed MSISDN
• Observed IMSI
• Observed IMEI
• Event Type
• Event Time
• Event Date
• Network Element Identifier
• Location Information
• Time of Location
• Failed attach reason
• IAs (if applicable)

7.4.2  Mobile Station Detach  Word‑p. 62

For detach a detach-event is generated, this is for the common (end) detach. These elements will be delivered to the DF2 if available:

• Observed MSISDN
• Observed IMSI
• Observed IMEI
• Event Type
• Event Time
• Event Date
• Network Element Identifier
• Location Information
• Time of Location
• IAs (if applicable)

7.4.3  Packet Data PDP context activation

When a PDP context activation is generated a PDP context activation-event is generated. These elements will be delivered to the DF2 if available:

• Observed MSISDN
• Observed IMSI
• Observed IMEI
• PDP address of observed party
• Event Type
• Event Time
• Event Date
• Correlation number
• Access Point Name
• PDP Type
• Network Element Identifier
• Location Information
• Time of Location
• Failed context activation reason
• IAs (if applicable)
• Initiator (optional)
• QoS (optional)
• NSAPI (optional)

7.4.4  Start of interception with PDP context active  Word‑p. 63

This event will be generated if interception for a target is started and if the target has at least one PDP context active. If more than one PDP context is open, for each of them an event record is generated. These elements will be delivered to the DF2 if available:

• Observed MSISDN
• Observed IMSI
• Observed IMEI
• PDP address of observed party
• Event Type
• Event Time
• Event Date
• Correlation number
• Access Point Name
• PDP Type
• Network Element Identifier
• Location Information
• Time of Location
• Old Location Information (optional)
• IAs (if applicable)
• QoS (optional)
• Initiator (optional)
• NSAPI (optional)

Presence of the optional Old Location Information field indicates that PDP context was already active, and being intercepted. However, the absence of this information does not imply that interception has not started in the old location SGSN for an active PDP context.

Start of interception with PDP context active shall be sent regardless of whether a Start of interception with mobile station attached has already been sent.

7.4.5  Packet Data PDP context deactivation

At PDP context deactivation a PDP context deactivation-event is generated. These elements will be delivered to the DF2 if available:

• Observed MSISDN
• Observed IMSI
• Observed IMEI
• PDP address of observed party
• Event Type
• Event Time
• Event Date
• Correlation number
• Access point name
• Network Element Identifier
• Location Information
• Time of Location
• IAs (if applicable)
• Deactivation cause
• Initiator (optional)
• NSAPI (optional)
• ULI Timestamp

7.4.6  RA update  Word‑p. 64

For each RA update an update-event with the elements about the new location is generated. New SGSN shall send the event, and the old SGSN may optionally send the event as well. These elements will be delivered to the DF2 if available:

• Observed MSISDN
• Observed IMSI
• Observed IMEI
• Event Type
• Event Time
• Event Date
• Network Element Identifier
• Location Information (only for the new SGSN)
• Time of Location
• Old Location Information (only for the old SGSN)
• IAs (if applicable)

7.4.7  SMS

For SMS-MO, the event is generated in the 3G SGSN. Dependent on national requirements, event generation shall occur in the following cases:

• when the 3G SGSN receives the SMS from the target MS, or when the 3G SGSN detects that an SMS is to the Non-Local ID target.
• when the 3G SGSN receives notification that the SMS-Centre successfully received the SMS that was originated from the target MS, or sent to the Non-Local ID target.

For SMS-MT, the event is generated in the 3G SGSN. Dependent on national requirements, event generation shall occur in the following cases:

• when the 3G SGSN receives the SMS from the SMS-Centre when the SMS was originated from a Non-Local ID target, or will have to be sent to a target MS.
• when the 3G SGSN receives notification that recipient MS has received the SMS successfully. The recipient MS is the target MS when the SMS is sent to the target. The recipient MS may not be the target when the SMS was originating from a Non-Local ID target.

These elements will be delivered to the DF2 if available:

• Observed MSISDN
• Observed IMSI
• Observed IMEI
• Observed Non-Local ID
• Event Type
• Event Time
• Event Date
• Network Element Identifier
• Location Information
• Time of Location
• SMS
• SMS Initiator
• IAs (if applicable)

7.4.8  Packet Data PDP context modification |R5|

This event will be generated if an active PDP context for the target is modified. These elements will be delivered to the DF2 if available:

• Observed MSISDN
• Observed IMSI
• Observed IMEI
• PDP address of observed party
• Event Type
• Event Time
• Event Date
• Correlation number
• Access Point Name
• PDP Type
• Network Element Identifier
• Location Information
• Time of Location
• IAs (if applicable)
• Initiator
• QoS

7.4.9  Serving System |R5|  Word‑p. 65

The Serving System report event is generated at the HLR, when the HLR has detected that the target has roamed. The elements will be delivered to the DF2 if available:

• Observed MSISDN
• Observed IMSI
• Observed IMEI
• Event Type
• Event Time
• Event Date
• Network Element Identifier
• Serving System Address

7.4.10  Start of interception with mobile station attached |R7|

This event will be generated if interception has started for the already attached target. These elements will be delivered to the DF2 if available:

• Observed MSISDN
• Observed IMSI
• Observed IMEI
• Event Type
• Event Time
• Event Date
• Network Element Identifier
• Location Information
• Time of Location
• IAs (if applicable)

7.4.11  Packet Data Header Information |R12|

7.4.11.0  Introduction

Packet Data Header Information reporting can be done either on a per-packet (i.e., non-summarized) basis or in a summary report.

7.4.11.1  Packet Data Header Report

This event is used to provide packet header reports on a per packet basis (non-summarized reporting) and is triggered by each packet sent or received by the target. These elements will be delivered either directly to DF2 or via another network entity if available:

• Observed MSISDN
• Observed IMSI
• Observed IMEI
• PDP address of observed party
• Event Type
• Event Time
• Event Date
• Correlation Number
• Access Point Name
• PDP Type
• Network Element Identifier
• Source IP Address
• Source Port Number
• Destination IP Address
• Destination Port Number
• Transport Protocol (e.g., TCP)
• Packet Size
• Flow Label (IPv6 only)

7.4.11.2  Packet Data Summary Report  Word‑p. 66

This event is used to report:

1. the source and destination information derived from the packet headers, including:
   1. source and destination IP Addresses,
   2. IP next-layer protocol,
   3. Layer-4 ports, and
   4. Flow label, if the packet is IPv6
2. summary information for the number of packets and bytes transmitted or received by the target for each unique packet flow within a PDP context, and
3. the date and the time of the first and last packets associated with that packet flow. A packet flow is defined as the 6-tuple of source/destination IP address/port number and the layer 4 protocol, and PDP Context.
   IP addresses and the IP next-layer protocol are always reported, the flow label is reported if the packet is IPv6, and the layer-4 ports are reported.

The event provides packet summary reports for each unique packet data session (PDP context) and packet flow, and is triggered by one of the following:

• start of a packet flow associated with a PDP Context
• an interim report for a packet flow associated with a PDP Context is to be reported
• end of a packet flow associated with a PDP Context (including end of the PDP Context itself).

An interim report can be triggered by

• The expiration of a configurable timer per intercept (called a Summary Timer). The Summary Timer is configurable in units of seconds;
• A per-intercept configurable count threshold is reached.

These elements will be delivered either directly to DF2 or via an MF for each packet flow if available:

• Observed MSISDN
• Observed IMSI
• Observed IMEI
• PDP address of observed party
• Event Type
• Event Time
• Event Date
• Correlation Number
• Access Point Name
• PDP Type
• Network Element Identifier
• Source IP Address
• Source Port Number
• Destination IP Address
• Destination Port Number
• Transport Protocol (e.g., TCP)
• Flow Label (IPv6 only)
• Summary Period
• Packet Count (for this summary period)
• Sum of Packet Sizes (for this summary period)

If the packets are IPv4, the sum of all observed packet sizes is the sum of the values contained in the Total Length field of each packet as specified in IETF RFC 791[39].

If the packet is IPv6, the sum of all observed packet sizes is the sum of the values contained in the Payload Length field for each packet as specified in IETF RFC 2460 [40].

If no packets were detected for the duration of the Summary Timer, then the Packet Data Summary Report shall not be sent.

7.4.12  HLR subscriber record change |R13|  Word‑p. 67

This event will be used to report any change of association between IMSI or MSISDN of the target.

The following elements, such as old and new IMSI or MSISDN will be delivered to DF2, if available:

• New observed MSISDN
• New observed IMSI
• New observed IMEI
• Observed MSISDN
• Observed IMSI
• Observed IMEI
• Event Type
• Event Time
• Event Date
• Network Element Identifier (HLR id...)
• IMSI or MSISDN or IMEI change type
• Other update: carrier specific

7.4.13  Cancel location |R13|  Word‑p. 68

This event "Cancel Location" will be used to report to DF2 when HLR send to SGN one cancel location or purge to serving system.

The following elements such as the previous serving system of the target will be delivered to DF2:

• Observed MSISDN
• Observed IMSI
• Event Type
• Event Time
• Event Date
• Network Element Identifier (HLR Id...)
• Previous serving system identifier (VPLMN id…)

7.4.14  Register location |R13|

This event will be used to report one update location message to the HLR for a target. The elements of previous and current serving system ID will be delivered to DF2, if available:

• Observed MSISDN
• Observed IMSI
• Event Type
• Event Time
• Event Date
• Network Element Identifier (HLR id...)
• Previous serving system identifier (Previous VPLMN id)
• Current serving system identifier (Current VPLMN id)

7.4.15  Location information request |R13|

This event will be used to report any location information of the target request activity.

The elements, observed IMSI, MSISDN, the identifier of the requesting node type and network, will be delivered to DF2, if available:

• Observed MSISDN
• Observed IMSI
• Requesting network identifier (country identifier included)
• Requesting node type
• Event Type
• Event Time
• Event Date
• Network Element Identifier (HLR id...)

7.4.16  Void

7.5  Void

7.6  Interception of the Multimedia Messaging Service (MMS) |R6|  Word‑p. 69

The Multimedia Messaging Service (MMS) is a service running over the 3GPP PS-domain. Both mobile originating and mobile terminating MMS messages shall pass through PS domain GSN nodes en route to or from Multimedia Message Service Centres (MMSCs). Therefore, interception of MMS messages shall be performed at the GSN in exactly the same way as for other PS-domain bearer services.

The GSN is not responsible for recovering individual MMS messages from the user PDP context IP stream.

No MMS specific HI2 records are defined to be delivered to the LEMF over the DF2 other than those listed in clause 7.4 of this specification. CC records shall be sent to the LEMF over the DF3 as specified in clause 7.3.

Interception of a user PDP context IP stream will occur as described in clause 7.2. Such a stream may or may not contain MMS messages.

---