5 Service conditions

22.0313G Security3GPPFraud Information Gathering System (FIGS)Service descriptionStage 1TS

5.1 Control of monitoring of subscriber activities

The HPLMN can request a VPLMN to begin monitoring the activities of a subscriber when the subscriber has registers on that VPLMN or at any time after registration. If the VPLMN is able to monitor a subscriber as requested it shall send a confirmation of monitoring message to the HPLMN.

The HPLMN does not need to know the status of the target subscriber before initiation or subsequent termination of fraud information gathering.

Fraud information cannot be switched on or off by the subscriber or other (unauthorised) party.

Subscribers upon which fraud information gathering has been set shall not be able by interrogating the network to determine that they are subject to fraud information gathering.

Subscribers upon which fraud information gathering has been set shall not be able, for example by significant changes to normal call set up times, speech quality or general transmission characteristics, to determine that they are subject to fraud information gathering.

If the VPLMN receives a request to monitor the activities of a subscriber and an activity to be monitored is already ongoing it is not necessary for the VPLMN to send information on this particular activity to the HPLMN.

If the VPLMN receives a request to cease monitoring the activities of a subscriber and an activity is already ongoing and being monitored, the VPLMN shall immediately cease sending information on this activity to the HPLMN.

5.2 Number of calls monitored by a VPLMN

If the VPLMN has to monitor the activities of a large number of subscribers for FIGS this may degrade the performance of the VPLMN. Each VPLMN (in reality, each network entity involved in FIGS monitoring) will therefore have a maximum number of subscribers that it can monitor.

If the number of monitored subscribers has reached this upper limit the VPLMN shall reject requests for monitoring of subscribers from HPLMNs until the number of monitored subscribers decreases below the limit.

Each VPLMN may have a limit per HPLMN on the number of subscribers from that HPLMN that it will monitor. When an HPLMN has requested a VPLMN to monitor a number of subscribers equal to the limit for that HPLMN, the VPLMN can refuse any subsequent requests for FIGS monitoring from that PLMN, until the number of monitored subscribers drops below the limit. The principles behind the setting of these limits are outside the scope of this specification.

In order to minimise the number of subscribers that a VPLMN has to monitor, the HPLMN should ideally limit itself to requesting information about subscriber’s monitored activities in:

– the current VPLMN;

– the last previously served VPLMN.

5.3 Interworking with non-supporting networks

If the HPLMN does not receive a positive acknowledgement to the request for FIGS monitoring sent to a VPLMN, it shall assume that the VPLMN does not support FIGS. The HPLMN may then act as appropriate (e.g. put appropriate ODB categories in place).

5.4 Information Delivery Time

The need for up to date information is a critical part of any fraud information system. The sooner data is transferred to the HPLMN, the sooner fraud can be stopped. Therefore the prescribed information shall be transferred from the VPLMN network to the HPLMN within two minutes of the occurrence of a FIGS-monitored event, if real time implementations of FIGS are used.

The information should be transferred from the VPLMN to the HPLMN over appropriate communication links.