7.14 LI at EES

33.1283GPPProtocol and procedures for Lawful Interception (LI)Release 18SecurityStage 3TS

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

7.14.1 Provisioning over LI_X1

7.14.1.1 Provisioning of IRI-POI in EES

The IRI-POI present in the EES is provisioned over LI_X1 by the LIPF using the X1 protocol as described in clause 5.2.2.

The POI in the EES shall support the identifier types given in table 7.14.1-1.

Table 7.14.1-1: TargetIdentifier Types for Edge Computing

Identifier	Owner	ETSI TS 103 221-1 [7] TargetIdentifier type	Definition
gPSIMSISDN	ETSI	GPSIMSISDN	See ETSI TS 103 221-1 [7]
gPSINAI	ETSI	GPSINAI	See ETSI TS 103 221-1 [7]
eECID	3GPP	TargetIdentifierExtension	See XSD schema

Table 7.14.1-2 shows the minimum details of the LI_X1 ActivateTask message used for provisioning the IRI-POI in the EES.

If the IRI-POI in the EES receives an ActivateTask message and the ListOfServiceTypes parameter contains a ServiceType that is not supported, the IRI-POI in the EES shall reject the task with an appropriate error as described in ETSI TS 103 221-1 [7] clause 6.2.1.2.

Table 7.14.1-2: ActivateTask message for the IRI-POI in the EES

ETSI TS 103 221-1 [7] field name	Description	M/C/O
XID	XID assigned by LIPF.	M
TargetIdentifiers	One of the target identifiers listed in the paragraph above.	M
DeliveryType	Set to “X2Only”.	M
ListOfDIDs	Delivery endpoints for LI_X2 for the IRI-POI in the EES. These delivery endpoints are configured using the CreateDestination message as described in ETSI TS 103 221-1 [7] clause 6.3.1 prior to the task activation.	M
ListOfServiceTypes	Shall be included when the task should only intercept specific CSP service types as described in clause 5.2.4. This parameter is defined in ETSI TS 103 221-1 [7], clause 6.2.1.2, table 4.	C

7.14.1.2 Provisioning of the MDF2

The MDF2 listed as the delivery endpoint over LI_X2 for xIRI generated by the EES shall be provisioned over LI_X1 by the LIPF.

The target identities listed in clause 7.14.1.1 shall apply for the provisioning of MDF2.

Table 7.14.1-3 shows the minimum details of the LI_X1 ActivateTask message used for provisioning the MDF2.

Table 7.14.1-3 ActivateTask message for MDF2

ETSI TS 103 221-1 [7] field name	Description	M/C/O
XID	XID assigned by LIPF.	M
TargetIdentifiers	One or more of the target identifiers listed in clause 7.14.1.1.	M
DeliveryType	Set to “X2Only”. (Ignored by the MDF2).	M
ListOfDIDs	Delivery endpoints of LI_HI2. These delivery endpoints shall be configured using the CreateDestination message as described in ETSI TS 103 221-1 [7] clause 6.3.1 prior to first use.	M
ListOfMediationDetails	Sequence of Mediation Details. See table 7.14.1-3.	M

Table 7.14.1-3: Mediation Details for MDF2

ETSI TS 103 221-1 [7] field name	Description	M/C/O
LIID	Lawful Intercept ID associated with the task.	M
DeliveryType	Set to “HI2Only”.	M
ListOfDIDs	Details of where to send the IRI for this LIID. Shall be included if deviation from the ListofDIDs in the ActivateTask message is necessary. If included, the ListOfDIDs in the Mediation Details shall be used instead of any delivery destinations authorised by the ListOfDIDs field in the ActivateTask Message.	C
ServiceScoping	Using the format defined in ETS TS 103 221 [7] include the service scoping as applicable to this LIID based on the service scoping listed above the table.	C

When an additional warrant is activated on a target UE and the LIPF uses the same XID for the additional warrant, the MDF2 shall be able to generate and deliver IRI message for each additional warrant without receiving a corresponding xIRI.

7.14.2 Generation of xIRI at IRI-POI in EES over LI_X2

7.14.2.1 General

The IRI-POI present in the EES shall send the xIRIs over LI_X2 for each of the events listed in TS 33.127 [5] clause 7.14.4, the details of which are described in the following clauses.

NOTE: If GPSI is the target, then xIRIs shall be generated only if the GPSI is available.

7.14.2.2 EEC registration and deregistration

The IRI-POI in the EES shall generate an xIRI containing an EESEECRegistration record when the IRI-POI present in the EES detects that an EEC has registered, updated its registration or deregistered. The IRI-POI present in the EES shall generate the xIRI for the following events:

– EES returns Eees_EECRegistration_Request response towards the EEC confirming the registration of the EEC for the target UE to the EES (as defined in TS 24.558 [93] clause 5.2.2.2).

– EES returns Eees_EECRegistration_Update response towards the EEC confirming the update of the registration information of the EEC for the target UE at the EES (as defined in TS 24.558 [93] clause 5.2.2.3).

– EES returns Eees_EECRegistration_Deregister response towards the EEC confirming the deregistration of the EEC for the target UE from a given EES (as defined in TS 24.558 [93] clause 5.2.2.4).

Table 7.14.2-1: EESEECRegistration record

Field name	Description	M/C/O
registrationType	Types of registration. Possible values are: “Registration”, “Registration Update”, “Deregistration”.	M
eECID	Unique identifier of the EEC.	M
gPSI	GPSI of the target UE, if available.	C
aCProfiles	Profiles of application clients (ACs) for which the EEC provides edge enabling services, if available. See table 7.14.2-2.	C
eECServiceContSupport	ACR (Application Context Relocation) scenarios supported by the EEC for service continuity if any.	C
expirationTime	Expiration time for the registration. If absent for registration types “Registration” and “Registration Update”, registration of EEC never expires.	C
eECContextID	Unique identifier of the EEC context if available.	C
srcEESID	Identifier of the EES providing the EEC context identifier, if available.	C
unfulfilledACProfiles	If requirements indicated in the AC profile(s) cannot be fulfilled for some of the AC profile(s), the EES shall include “unfulfilledAcProfiles” attribute containing the list of ACIDs of such AC Profile(s) and appropriate reasons, if available.	C
failureResponse	Cause information when the registration, registration update or deregistration has failed, if available.	C

Table 7.14.2-2: Details of aCProfile parameter

Field name	Description	M/C/O
aCID	Application client identity.	M
aCType	Category or type of application client, if available.	C
aCSchedule	Expected operation schedule of the AC (e.g. time windows) if available.	C
expACGeoServArea	Expected location(s) of the hosting UE during the AC’s operation schedule, if available.	C
eASsInfo	List of EAS that serve the AC along with the service KPIs required by the AC if available. See table 7.14.2-3.	C
aCServiceContSupport	ACR scenarios supported by the AC for service continuity, if any.	C

Table 7.14.2-3: Details of eASInfo parameter

Field name	Description	M/C/O
eASId	EAS identity.	M
expectedSvcKPIs	KPIs expected in order for Acs to receive currently required services from the EAS. See table 7.14.2-4.	C
minimumReqSvcKPIs	Minimum KPIs required in order for Acs to receive meaningful services from the EAS. See table 7.14.2-4.	C

Table 7.14.2-4: Details of expectedSvcKPIs and minimumReqSvcKPIs parameters

Field name	Description	M/C/O
connectionBandwidth	Required connection bandwidth in Kbit/s for the application.	C
requestRate	Request rate to be generated by the AC.	C
responseTime	Response time required for the server servicing the requests.	C
requestedAvailability	Percentage of time the server is required to be available for the AC’s use.	C
requestedCompute	Compute resources required by the AC.	C
requestedGraphCompute	Graphical compute resources required by the AC.	C
requestedMemory	Memory resources required by the AC.	C
requestedStorage	Storage resources required by the AC.	C

7.14.2.3 EAS discovery

The IRI-POI in the EES shall generate an xIRI containing an EESEASDiscovery record when the IRI-POI present in the EES detects that an EEC has requested a one-time EAS discovery information. The IRI-POI present in the EES shall generate the xIRI for the following events:

– EES returns Eees_EASDiscovery_Request response to the EEC containing a one-time EAS discovery information (as defined in TS 24.558 [93] clause 5.3.2.2).

Table 7.14.2-5: EESEASDiscovery record

Field name	Description	M/C/O
eECID	Unique identifier of the EEC.	M
gPSI	GPSI of the target UE, if available.	C
eASDiscoveryFilter	Set of characteristics to determine required EASs, if available.	C
eECServiceContSupport	ACR scenarios supported by the EEC for service continuity if any.	C
locationInfo	Location information of the target UE, if available.	C
eASTargetDNAIs	Target DNAI information which can be associated with potential target EAS(s), if available.	C
discoveredEAS	List of discovered EAS(s), if available.	C
failureResponse	Cause information when the discovery request has failed, if available.	C

Table 7.14.2-6: Details of eASDiscoveryFilter parameterendpoint

Field name	Description	M/C/O
aCCharacteristics	Acs for which a matching EAS is needed. See Table 7.14.2-2.	C
eASCharacteristics	Characteristics of required EASs. See table 7.14.2-7.	C
NOTE: Either aCCharacteristics or eASCharacteristics shall be present.

Table 7.14.2-7: Details of eASCharacteristics parameter

Field name	Description	M/C/O
eASID	EAS Identity, if available.	C
aSPID	Identity of the ASP which provides the EAS, if available.	C
eASType	EAS type or category, if available.	C
eASSchedule	Availability schedule of the EAS (e.g. time windows), if available.	C
eASProfile	Profiles of the discovered EASs, if available. See table 7.14.2-8.	C
eASServiceArea	List of geographical and topological service areas that the EAS serves, if available.	C
eASServicePermLevel	Level of service permissions (e.g. trial, gold-class) supported by the EAS, if available.	C

Table 7.14.2-8: Details of discoveredEAS parameter

Field name	Description	M/C/O
eASProfile	Profiles of the discovered EASs. See table 7.14.2-9.	C
lifetime	Time duration in seconds for which the EAS information is valid and supposed to be cached in the EEC.	C

Table 7.14.2-9: Details of eASProfile parameter

Field name	Description	M/C/O
eASID	EAS Identity.	M
eASEndpoint	Endpoint information (e.g. URI, FQDN, IP address) used to communicate with the EAS.	M
aCIDs	Identities of the AC(s) that can be served by the EAS, if available.	C
aSPID	Identity of the ASP which provides the EAS, if available.	C
eASType	EAS type or category, if available.	C
eASDescription	Human-readable description of the EAS.	C
eASSchedule	Availability schedule of the EAS (e.g. time windows), if available.	C
eASServiceArea	List of geographical and topological service areas that the EAS serves, if available.	C
eASServiceKPIs	Service characteristics provided by the EAS.	C
eASServicePermLevel	Level of service permissions (e.g. trial, gold-class) supported by the EAS, if available.	C
eASServiceFeatures	Service features e.g. single vs. multi-player gaming service supported by the EAS, if available.	C
eASServiceContSupport	ACR scenarios supported by the EAS for service continuity if any.	C
appLocs	List of DNAI(s) and the corresponding N6 traffic routing information/routing profile ID, associated with the EAS, if available.	C
eASStatus	EAS status (e.g. Enabled, Disabled etc.), if available.	C

7.14.2.4 EAS discovery subscription

The IRI-POI in the EES shall generate an xIRI containing an EESEASDiscoverySubscription record when the IRI-POI present in the EES detects that an EEC has requested to subscribe, update subscription and unsubscribe to EAS discovery information reporting. The IRI-POI present in the EES shall generate the xIRI for the following events:

– EES returns Eees_EASDiscovery_Subscribe response to the EEC confirming its subscription to EAS discovery information reporting (as defined in TS 24.558 [93] clause 5.3.2.3).

– EES returns Eees_EASDiscovery_UpdateSubscription response to the EEC confirming the update of its subscription at the EES for EAS discovery information reporting (as defined in TS 24.558 [93] clause 5.3.2.5).

– EES returns Eees_EASDiscovery_Unsubscribe response to the EEC confirming the deletion of an existing subscription at the EES to EAS discovery information reporting (as defined in TS 24.558 [93] clause 5.3.2.6)

Table 7.14.2-10: EESEASDiscoverySubscription record

Field name	Description	M/C/O
eECID	Unique identifier of the EEC.	M
gPSI	GPSI of the target UE, if available.	C
subscriptionType	Subscription type, i.e., “Subscription”, “Subscription Update” or “Unsubscription”.	M
eASEventType	Event type for which the EEC shall be notified	M
eASDiscoveryFilter	Set of characteristics to determine required EASs, if available.	C
eASDynamicInfoFilter	List of EAS dynamic information required by the EEC per EAS, if available. See table 7.14.2-11.	C
eECServiceContSupport	ACR scenarios supported by the EC for service continuity if any.	C
expirationTime	Expiration time for the subscription. If absent for subscription types “Subscription” and Subscription Update”, EAS discovery subscription from EEC never expires.	C
subscriptionId	Subscription identity, if available.	C
failureResponse	Cause information when the discovery request has failed, if available.	C

Table 7.14.2-11: Details of eASDynamicInfoFilter parameter

Field name	Description	M/C/O
eASId	EAS identifier.	M
eASStatus	Notify if EAS status changed.	C
eASACIDs	Notify if list of AC identifiers changed.	C
eASDescription	Notify if EAS description changed.	C
eASEndpoint	Notify if EAS endpoint changed.	C
eASFeature	Notify if EAS feature changed.	C
eASSchedule	Notify if EAS schedule changed.	C
eASServiceArea	Notify if EAS service area changed.	C
eASServiceKPIs	Notify if EAS KPIs changed.	C
eASServiceContinuity	Notify if EAS supported ACR changed.	C

7.14.2.5 EAS discovery notification

The IRI-POI in the EES shall generate an xIRI containing an EESEASDiscoveryNotification record when the IRI-POI present in the EES detects that the EES has notified a previously subscribed EEC on EAS discovery information. The IRI-POI present in the EES shall generate the xIRI for the following events:

– EES receives an Eees_EASDiscovery_Notify response from an EEC confirming that the subscribed EEC has received EAS discovey information (as defined in TS 24.558 [93] clause 5.3.2.4).

NOTE: Because it is HTTP-based transaction the notification request is always supposed to be received by the EEC which needs to answer with the reponse.

Table 7.14.2-12: EESEASDiscoveryNotification record

Field name	Description	M/C/O
subscriptionID	Identity of the individual subscription for which the notification is delivered.	M
eventType	Event type for which the notification is delivered;	M
discoveredEAS	List of EAS discovery information. See table 7.14.2-8.	M
failureResponse	Cause information when the discovery notification request has failed, if available.	C

7.14.2.6 Application context relocation

The IRI-POI in the EES shall generate an xIRI containing an EESAppContextRelocation record when the IRI-POI present in the EES detects that an EEC has requested ACR (Application Context Relocation) determination.or ACR initiation. The IRI-POI present in the EES shall generate the xIRI for the following events:

– EES returns Eees_AppContextRelocation_Determine response to the EEC confirming that EEC has carried out ACR determination (as defined in TS 24.558 [93] clause 5.5.2.2). EEC requests that the EES evaluates if ACR is needed and subsequently initiate the ACR procedure if required.

– EES returns Eees_AppContextRelocation_Initiate response to the EEC confirming that EEC has carried out ACR initiation (as defined in TS 24.558 [93] clause 5.5.2.3). EEC requests initiation of an ACR procedure.

Table 7.14.2-13: EESAppContextRelocation record

Field name	Value	M/C/O
eECID	Unique identifier of the EEC.	M
gPSI	GPSI of the target UE, if available.	C
aCRDetermineReq	See table 7.14.2-14.	C
aCRInitiateReq	See table 7.14.2-15.	C

Table 7.14.2-14: Details of aCRDetermineReq parameter

Field name	Description	M/C/O
eASID	Identifier of the EAS, if available.	C
aCID	Identifier of the AC, if available.	C
sEASEndpoint	Endpoint information of the selected S-EAS.	M

Table 7.14.2-15: Details of aCRInitiateReq parameter

Field name	Description	M/C/O
eASID	Identifier of the EAS, if available.	C
aCID	Identifier of the AC, if available.	C
tEASEndpoint	Endpoint information of the T-EAS (target EAS).	M
sEASEndpoint	Endpoint information of the S-EAS (serving EAS).	C
previousTEASEndpoint	Endpoint information of the previous T-EAS.	C
routeReq	T-EAS’s DNAI information and corresponding N6 traffic routing information and/or routing profile ID, if available.	C

7.14.2.7 Application context relocation information subscription

The IRI-POI in the EES shall generate an xIRI containing an EESACRSubscription record when the IRI-POI present in the EES detects that an EEC has requested to subscribe, update subscription and unsubscribe to ACR events. The IRI-POI present in the EES shall generate the xIRI for the following events:

– EES returns Eees_ACREvents_Subscribe response to the EEC confirming its subscription for reporting of ACR information notification (as defined in TS 24.558 [93] clause 5.4.2.2).

– EES returns Eees_ACREvents_UpdateSubscription response to the EEC confirming the update of its subscription for reporting of ACR information notification (as defined in TS 24.558 [93] clause 5.4.2.4).

– EES returns Eees_ACREvents_Unsubscribe response to the EEC confirming the deletion of an existing subscription at the EES to ACR events (as defined in TS 24.558 [93] clause 5.4.2.5)

Table 7.14.2-16: EESACRSubscription record

Field name	Description	M/C/O
eECID	Unique identifier of the EEC.	M
gPSI	GPSI of the target UE, if available.	C
subscriptionType	Subscription type, i.e., “Subscription”, “Subscription Update” or “Unsubscription”.	M
expirationTime	Expiration time for the subscription. If absent for subscription types “Subscription” and Subscription Update”, application context relocation subscription from EEC never expires.	C
eASIDs	List of identifier of the EASs, if available.	M
aCIDs	List of identifier of the ACs, if available.	C
eventIDs	Specifies the events for which EEC is subscribing.	M
subscriptionId	Subscription identity, if available	C
failureResponse	Cause information when the discovery request has failed, if available.	C

7.14.2.8 Application context relocation information notification

The IRI-POI in the EES shall generate an xIRI containing an EESACRNotification record when the IRI-POI present in the EES detects that the EES has notify a previously subscribed EEC on EAS discovery information. The IRI-POI present in the EES shall generate the xIRI for the following events:

– EES receives an Eees_ACREvents_Notify response from an EEC confirming that the subscribed EEC has received a notification of the ACR information events from EES (as defined in TS 24.558 [93] clause 5.4.2.2).

Table 7.14.2-17: EESACRNotification record

Field name	Description	M/C/O
subscriptionID	Identity of the individual subscription for which the notification is delivered.	M
eASID	Identifier of the EAS.	M
eventIDs	Specifies the events for which notification is sent.	M
targetInfo	Details of the selected T-EAS and the T-EES. It is present when EventID indicates “TARGET_INFORMATION” event.	C
aCRRes	Indicates whether the ACR is successful or has failed. It is present when EventID indicates “ACR_COMPLETE” event.	C
failReason	Indicates the cause information for the failure when the ACRRes attribute is present and indicates failure, if available.	C

7.14.2.9 EEC context relocation

The IRI-POI in the EES shall generate an xIRI containing an EESEECContextRelocation record when the IRI-POI present in the EES detects that the EES has sent or received the EEC context relocation information. The IRI-POI present in the EES shall generate the xIRI for the following events according to its new serving EE (referred to as target EES in TS 24.558 [93] or current serving EES (referred to as source EES in TS 24.558 [93]) role:

– Target EES (T-EES) receives an Eees_EECContextRelocation_Pull response from a Source EES (S-EES) upon request from the T-EES to S-EES (as defined in TS 29.558 [94] clause 5.10.2.2).

– T-EES sends an Eees_EECContextRelocation_Push response to a S-EES upon request from the S-EES to T-EES (as defined in TS 29.558 [94] clause 5.10.2.3).

– S-EES sends an Eees_EECContextRelocation_Pull response to a T-EES.

– S-EES receives an Eees_EECContextRelocation_Push response from a T-EES.

NOTE : The term target EES is used in TS 29.558[94] referring the new serving EES and the term serving EES is referring to the old serving EES.

Table 7.14.2-17: EESEECContextRelocation record

Field name	Description		M/C/O
eECID	Unique identifier of the EEC.		M
gPSI	GPSI of the target UE, if available.		C
cntxtID	Unique identifier of the EEC context.		M
uELoc	Latest location information of the target UE, that is available at the EES, if available.		C
aCProfiles	Profiles of application clients (ACs) for which the EEC provides edge enabling services, if available. See table 7.14.2-2.	C

7.14.2.10 Start of interception with registered EEC

The IRI-POI in the AES shall generate an xIRI containing an EESStartOfInterceptionWithRegisteredEEC record when the IRI-POI present in the EES detects that interception is activated on a UE which EEC has already registered with an EES.

Table 7.14.2-18: EESStartOfInterceptionWithRegisteredEEC record

Field name	Description	M/C/O
eECID	Unique identifier of the EEC.	M
gPSI	GPSI of the target UE, if available.	C
aCProfiles	Profiles of application clients (ACs) for which the EEC provides edge enabling services, if available. See table 7.14.2-2.	C
eECServiceContSupport	ACR scenarios supported by the EEC for service continuity if any.	C
expirationTime	Expiration time for the registration. If absent for registration types “Registration” and “Registration Update”, registration of EEC never expires.	C
eECContextID	Unique identifier of the EEC context, if available.	C
srcEESID	Identifier of the EES providing the EEC context identifier, if available.	C
unfulfilledACProfiles	If requirements indicated in the AC profile(s) cannot be fulfilled for some of the AC profile(s), the EES shall include "unfulfilledAcProfiles" attribute containing the list of ACIDs of such AC Profile(s) and appropriate reasons, if available.	C
timeOfRegistration	Time at which the last registration occurred, if available.	C

7.14.2.11 Generation of IRI over LI_HI2

When an xIRI is received over LI_X2 from the IRI-POI in the EES, the MDF2 shall send the IRI message over LI_HI2 without undue delay. The IRI message shall contain a copy of the relevant record received from LI_X2. The record may be enriched by other information available at the MDF (e.g. additional location information).

The timestamp field of the ETSI TS 102 232-1 [9] PSHeader structure shall be set to the time at which the EES event was observed (i.e. the timestamp field of the xIRI).

The IRI type parameter (see ETSI TS 102 232-1 [9] clause 5.2.10) shall be included and coded according to table 7.14.2-19.

Table 7.14.2-19: IRI type for IRI messages

Record type	IRI Type
EESEECRegistration	REPORT
EESEASDiscovery	REPORT
EESEASDiscoverySubscription	REPORT
EESEASDiscoveryNotification	REPORT
EESAppContextRelocation	REPORT
EESACRSubscription	REPORT
EESACRNotification	REPORT
EESEECContextRelocation	REPORT
EESStartOfInterceptionWithRegisteredEEC	REPORT

The threeGPP33128DefinedIRI field (see ETSI TS 102 232-7 [10] clause 15) shall be populated with the BER-encoded IRIPayload.

When an additional warrant is activated on a target UE and the LIPF uses the same XID for the additional warrant, the MDF2 shall be able to generate and deliver the IRI message containing the EESStartOfInterceptionWithRegisteredEEC record to the LEMF associated with the additional warrant without receiving a corresponding xIRI. The payload of the EESStartOfInterceptionWithRegisteredEEC record is specified in table 7.14.2-18. The MDF2 shall generate and deliver the IRI message containing the EESStartOfInterceptionWithRegistered record for each of the registrations to the LEMF associated with the new warrant.

MDF2 delivers the IRI to the LEMF with GPSI as the target identity if and only if GPSI is present in the xIRI.