6.2.2A Identifier Reporting for AMF

33.1273GPPLawful Interception (LI) architecture and functionsRelease 18TS

6.2.2A.1 General

The AMF shall provide IEF capabilities. The IEF present in the AMF shall support LI_XEM1 interface and upon activation shall provide IEF events to the ICF over LI_XER interface.

The IEF shall not generate events prior to UEs being successfully registered by the AMF onto the network.

6.2.2A.2 IEF Events

The IEF present in the AMF shall generate report records, when it detects the following specific events or information for any UE:

– Association of a 5G-GUTI to a SUPI (this may also include SUCI to SUPI association).

– De-association of a 5G-GUTI from a SUPI.

NOTE1: The de-association event is only generated if a new 5G-GUTI is not allocated to a SUPI to update a previous association (e.g. at inter-AMF handover).

NOTE 2: For SUCIs seen during registration, they shall only be reported if UE registration is successfully completed.

The association event shall be generated by the IEF in the AMF whenever the AMF initiates any action or procedure for which a new allocated 5G-GUTI is sent to the UE regardless of whether the action or procedure is completed successfully.

6.2.2A.3 IEF Event parameters

The list of event parameters is specified in TS 33.128 [15]. Each event shall include at the minimum the following information:

– Subscription permanent identifier.

– Observed temporary identifier(s).

– Cell identity (see clause 7.3).

– Time stamp of event.

– AMF identifier (including Region and Set Identifiers).

– Tracking area identifier.

– Registration area (including tracking area identifier list).

The following additional information shall be included if it is available in the AMF when the event is reported to the ICF:

– Permanent equipment identifier.

6.2.2A.4 Network topologies

Since the IEF generates events independently of network topology for individual service usage UEs, no specific network topology handling is provided by the IEF. The IQF shall be responsible for handling any network topology requirements that may be applied by the LEA in an individual warrant.