Lawful interception in a communication network

Abstract

An LI administrative device (140), a network device (150), methods, and computer programs are disclosed. The LI administrative device (140) is configured to be used in a communication network (100). The LI administrative device (140) is configured to: generate a DSCP value (310), wherein the DSCP value (310) is valid for a delivery interface (172, 173); transmit on an interface (171) to a network device (150) configured to perform LI in the communication network (100), a message (410, 1210), the message (410, 1210) managing configuration of the network device (150), wherein the message (410, 1210) comprises the DSCP value (310); and receive a response message (420, 1220) from the network device (150).

Description

[0001] LAWFUL INTERCEPTION IN A COMMUNICATION NETWORK

[0002] TECHNICAL FIELD

[0003] The invention relates to a Lawful Interception (LI) administrative device configured to be used in a communication network, a network device configured to perform lawful interception (LI) in the communication network, corresponding methods, corresponding computer programs, and a corresponding computer readable storage medium.

[0004] BACKGROUND

[0005] LI allows law enforcement agencies (LEAs) to obtain data from a communication network pursuant to law authority, for the purpose of analysis or evidence.

[0006] 3GPP Technical Specification (TS) 33.127 v17.4.0 specifies LI by 3GPP. According to LI, an LEA serves a communication network with a lawful order, e.g., warrant from a court of law, requiring that the communication network perform LI on a certain LI target. To comply with the lawful order, an LI administrative device in the communication network configured one or more network devices in the communication network to intercept data associated with the LI target. The one or more network devices are one or more Point of Interception (POI).

[0007] The one or more POIs detect the target communication, derive the intercept related information or communications content from the target communications and deliver POI output to Mediation and Delivery Function (MDF).

[0008] The POIs are divided into two types based on the type of POI output they send to the MDF. Two variations of the POI are: Intercept Related Information - Point of Interception (IRI-POI) and Communication Content - Point of Interception (CC-POI). The IRI-POI delivers xIRI to the MDF. The CC-POI delivers xCC to the MDF.

[0009] Two variations of the MDF also exist: MDF2 and MDF3. The MDF2 generates the Intercept Related Information ( I R I) message from the xIRI and sends the IRI messages to one or more Law Enforcement Monitoring Facilities (LEMF). The MDF3 generates the Communication Content (CC) from the xCC and delivers it to one or more LEMFs. The POI can define a specific Differentiated Services Code Point (DiffServ) value for each interface the POI uses. The POIs use three interfaces: X1 , X2, and / or X3. X1 is used to transmit to a Communication Service Provider (CSP) for management tasking. X2 is used to transmit to the CSP for xIRI message delivery. X3 is used to transmit to the CSP for xCC delivery.

[0010] With the current LI architecture as defined in 3GPP TS 33.127 v17.4.0, it is not possible, within the current LI architecture, to distinguish between different types of traffic, carrying either xIRI data or xCC data. There is also no indication on how to differentiate the destination of the POI output (e.g., MDF2, MDF3).

[0011] SUMMARY

[0012] An object of the invention is to improve reporting for lawful interception in a communication network.

[0013] According to a first aspect of the invention, a lawful interception (LI) administrative device is provided. The LI administrative device is configured to be used in a communication network. The LI administrative device is configured to generate a Differentiated Services Code Point (DSCP) value. The DSCP value is valid for a delivery interface. The LI administrative device is configured to transmit on an interface to a network device configured to perform LI in the communication network, a message. The message is managing configuration of the network device. The message comprises the DSCP value. The LI administrative device is configured to receive a response message from the network device. Hereby is achieved that a DSCP value is generated specific to a delivery interface and the DSCP value is forwarded to the network device. As the DSCP value is particular to a specific delivery interface, the network device has knowledge regarding which further device to communicate with.

[0014] According to an embodiment of the first aspect, the DSCP value is used when a delivery address associated with the delivery interface is an IP Address And Port.

[0015] According to an embodiment of the first aspect, the interface is interface X1 . According to an embodiment of the first aspect, the interface X1 corresponds to interfaces internal to Communication Service Provider (CSP) for management tasking.

[0016] According to an embodiment of the first aspect, the delivery interface is one or more of interface X2, or interface X3.

[0017] According to an embodiment of the first aspect, X2 corresponds to interfaces internal to CSP for X2 Intercept Related Information (xIRI) delivery.

[0018] According to an embodiment of the first aspect, X3 corresponds to interfaces internal to CSP for X3 Content of Communication (xCC) delivery.

[0019] According to an embodiment of the first aspect, the message is a CreateDestinationRequest, or a ModifyDestinationRequest.

[0020] According to an embodiment of the first aspect, the response message is a CreateDestinationResponse a ModifyDestinationResponse.

[0021] According to an embodiment of the first aspect, the DSCP value is an integer.

[0022] According to an embodiment of the first aspect, the LI administrative device is an Administrative Function (ADMF) node.

[0023] According to an embodiment of the first aspect, the network device is a Point of Interception.

[0024] According to a second aspect of the invention, a network device is provided. The network device is configured to perform lawful interception in a communication network. The network device is configured to receive on an interface, from a lawful interception (LI) administrative device configured to be used in the communication network, a message. The message is managing configuration of the network device. The message comprises a Differentiated Services Code Point (DSCP) value. The DSCP value is valid for a delivery interface. The network device is configured to transmit to the LI administrative device a response message.

[0025] According to an embodiment of the second aspect, the network device is configured to transmit on the delivery interface a second message to a delivery device. The second message is comprising the DSCP value.

[0026] According to an embodiment of the second aspect, the second message is transmitted over the delivery interface.

[0027] According to an embodiment of the second aspect, the second message comprises the DSCP value within an IP header of the second message.

[0028] According to an embodiment of the second aspect, the DSCP value is used when a delivery address associated with the delivery interface is an IP Address And Port.

[0029] According to an embodiment of the second aspect, the interface is interface X1 .

[0030] According to an embodiment of the second aspect, the interface X1 corresponds to interfaces to Communication Service Provider (CSP) for management tasking.

[0031] According to an embodiment of the second aspect, the delivery interface is one or more of X2, or X3.

[0032] According to an embodiment of the second aspect, X2 corresponds to interfaces internal to CSP for X2 Intercept Related Information (xIRI) delivery.

[0033] According to an embodiment of the second aspect, X3 corresponds to interfaces internal to CSP for X3 Content of Communication (xCC) delivery.

[0034] According to an embodiment of the second aspect, the message is a CreateDestinationRequest, or a ModifyDestinationRequest. According to an embodiment of the second aspect, the response message is a CreateDestinationResponse, or a ModifyDestinationResponse.

[0035] According to an embodiment of the second aspect, the second message is a message comprising an xIRI, or a message comprising an xCC.

[0036] According to an embodiment of the second aspect, the DSCP value is an integer.

[0037] According to an embodiment of the second aspect, the LI administrative device is an Administrative Function (ADMF) node.

[0038] According to an embodiment of the second aspect, the network device is a Point of Interception.

[0039] According to an embodiment of the second aspect, the delivery device is a Mediation and Delivery Function (MDF) node.

[0040] According to a third aspect of the invention, a method performed by a lawful interception (LI) administrative device is provided. The LI administrative device is configured to be used in a communication network. The method comprises generating a Differentiated Services Code Point (DSCP) value. The DSCP value is valid for a delivery interface. The method comprises transmitting on an interface to a network device configured to perform LI in the communication network, a message. The message is managing configuration of the network device. The message comprises the DSCP value (310). The method comprises receiving a response message from the network device.

[0041] According to an embodiment of the third aspect, the DSCP value is used when a delivery address associated with the delivery interface is an IP Address And Port.

[0042] According to an embodiment of the third aspect, the interface is interface X1 .

[0043] According to an embodiment of the third aspect, the interface X1 corresponds to interfaces internal to Communication Service Provider (CSP) for management tasking. According to an embodiment of the third aspect, the delivery interface is one or more of interface X2, or interface X3.

[0044] According to an embodiment of the third aspect, X2 corresponds to interfaces internal to CSP for X2 Intercept Related Information (xIRI) delivery.

[0045] According to an embodiment of the third aspect, X3 corresponds to interfaces internal to CSP for X3 Content of Communication (xCC) delivery.

[0046] According to an embodiment of the third aspect, the message is a CreateDestinationRequest, or a ModifyDestinationRequest.

[0047] According to an embodiment of the third aspect, the response message is a CreateDestinationResponse, or a ModifyDestinationResponse.

[0048] According to an embodiment of the third aspect, the DSCP value is an integer.

[0049] According to an embodiment of the third aspect, the LI administrative device is an Administrative Function (ADMF) node.

[0050] According to an embodiment of the third aspect, the network device is a Point of Interception.

[0051] According to a fourth aspect of the invention, a method performed by a network device is provided. The network device is configured to perform lawful interception in a communication network. The method comprises receiving on an interface, from a lawful interception (LI) administrative device configured to be used in the communication network, a message. The message is managing configuration of the network device. The message comprises a Differentiated Services Code Point (DSCP) value. The DSCP value is valid for a delivery interface. The method comprises transmitting to the LI administrative device a response message. According to an embodiment of the fourth aspect, the method comprises transmitting on the delivery interface a second message to a delivery device. The second message comprises the DSCP value.

[0052] According to an embodiment of the fourth aspect, the second message is transmitted over the delivery interface.

[0053] According to an embodiment of the fourth aspect, the second message comprises the DSCP value within an IP header of the second message.

[0054] According to an embodiment of the fourth aspect, the DSCP value is used when a delivery address associated with the delivery interface is an IP Address And Port.

[0055] According to an embodiment of the fourth aspect, the interface is interface X1 .

[0056] According to an embodiment of the fourth aspect, the interface X1 corresponds to interfaces to Communication Service Provider (CSP) for management tasking.

[0057] According to an embodiment of the fourth aspect, the delivery interface is one or more of X2, or X3.

[0058] According to an embodiment of the fourth aspect, X2 corresponds to interfaces internal to CSP for X2 Intercept Related Information (xIRI) delivery.

[0059] According to an embodiment of the fourth aspect, X3 corresponds to interfaces internal to CSP for X3 Content of Communication (xCC) delivery.

[0060] According to an embodiment of the fourth aspect, the message is a CreateDestinationRequest, or a ModifyDestinationRequest.

[0061] According to an embodiment of the fourth aspect, the response message is a CreateDestinationResponse, or a ModifyDestinationResponse. According to an embodiment of the fourth aspect, the second message is a message comprising an xIRI, or a message comprising an xCC.

[0062] According to an embodiment of the fourth aspect, the DSCP value is an integer.

[0063] According to an embodiment of the fourth aspect, the LI administrative device is an Administrative Function (ADMF) node.

[0064] According to an embodiment of the fourth aspect, the network device is a Point of Interception.

[0065] According to an embodiment of the fourth aspect, the delivery device is a Mediation and Delivery Function (MDF) node.

[0066] According to a fifth aspect of the invention, a computer program is provided. The computer program comprises instructions, which when executed by a Lawful Interception (LI) administrative device, causes the LI administrative device to perform the method according to one or more embodiments of the third aspect of the invention.

[0067] According to a sixth aspect of the invention, a computer program is provided. The computer program comprises instructions, which when executed on a network device, causes the network device to perform the method according to one or more embodiments of the fourth aspect of the invention.

[0068] According to a seventh aspect of the invention a computer readable storage medium is provided. The computer readable storage medium comprises a computer program according to the fifth aspect of the invention, and / or according to the sixth aspect of the invention.

[0069] At least one or more embodiments advantageously enable handling of Differentiated Services (DiffServ) in LI.

[0070] At least one or more embodiments advantageously enable to distinguish different types of POI output. At least one or more embodiments advantageously enable to distinguish different POI output destination.

[0071] At least one or more embodiments advantageously enable flexible DiffServ capabilities for each POI.

[0072] Further objectives of, features of, and advantages with, the invention will become apparent when studying the following detailed disclosure, the drawings, and the appended claims. Those skilled in the art realize that different features of the invention can be combined to create embodiments other than those described in the following.

[0073] BRIEF DESCRIPTION OF THE DRAWINGS

[0074] The above, as well as additional objects, features and advantages of the invention, will be better understood through the following illustrative and non-limiting detailed description of embodiments of the invention, with reference to the appended drawings, in which:

[0075] Figure 1 shows an embodiment of a communication network.

[0076] Figure 2 shows an embodiment of a method performed by a LI administrative device.

[0077] Figure 3 shows an embodiment of the method performed by the LI administrative device.

[0078] Figure 4 shows an embodiment of the method performed by the LI administrative device.

[0079] Figure 5 shows an embodiment of a message.

[0080] Figure 6 shows an embodiment of the message.

[0081] Figure 7 shows an embodiment of the message. Figure 8 shows an embodiment of the message.

[0082] Figure 9 shows an embodiment of a method performed by a network device.

[0083] Figure 10 shows an embodiment of the method performed by the network device.

[0084] Figure 11 shows an embodiment of a second message.

[0085] Figure 12 shows an illustrative example of messages exchanged between an LI administrative device, a network device, and a delivery device.

[0086] Figure 13 shows a block diagram of a LI administrative device.

[0087] Figure 14 shows a block diagram of a network device.

[0088] Figure 15 shows a block diagram of an LI administrative device.

[0089] Figure 16 shows a block diagram of a network device.

[0090] All figures are schematic, and generally show parts which are necessary in order to elucidate the invention, wherein other parts may be omitted or merely suggested.

[0091] DETAILED DESCRIPTION

[0092] The invention will now be described more fully herein with reference to the accompanying drawings, in which certain embodiments are shown. This invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided by way of example so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0093] State of the art LI has no defined manner to set up differentiated services (DiffServ) while configuring a destination. Indeed, it is up to the Point Of Interest (POI) to find a way to support DiffServ when DiffServ are implemented by an operator. For example, DiffServ can be configured on every POI ingress / Egress interface, defining a specific DSCP (Differentiated Services Code Point) value for each interface. Thus, a DiffSer- aware router defines a packet forwarding property associated to a traffic class (e.g. low-latency, best-effort, etc.) allowing different treatment of packet flows. However, in case of multiple X2 and / or X3 destinations (e.g., MDF2Z MDF3), it is impossible to differentiate traffic classes between different data types (e.g., IRI or CC) or among different destinations (e.g., MDF2 or MDF3).

[0094] To overcome these problems, the solution to be disclosed, in its embodiment, provides an LI administrative device configured to be used in a communication device, a network device configured to perform lawful interface, and corresponding methods. The LI administrative device is configured to generate a Differentiated Services Code Point (DSCP) value. The DSCP value is valid for a delivery interface. The LI administrative device transmits on an interface to the network device a message. The message is for managing configuration of the network device. The message comprises the DSCP value. The LI administrative device is also configured to receive a response message from the network device.

[0095] The present invention in its embodiments allows DSCP value to be separately configured for each delivery interface (e.g., X2, X3). Thus, the present invention enables flexible DiffServ capabilities for each network device (e.g., POI). The present invention avoids violating policies when packet rates exceed committed rates and / or allowed burst size. Indeed, DSCP value is specified by the LI administrative device which has knowledge of ongoing traffic in the communication network.

[0096] In Figure 1 , an embodiment of the communication network 100 is provided. The communication network 100 of a communication service provider (CSP) provides communication services to communication devices, one of which is shown as communication device 120. The skilled person would understand that even if only one communication device 120 is illustrated in Figure 1 , however there might be a plurality of communication devices (e.g., more than one). In an embodiment, the communication network 100 is a wireless communication network, in which case the communication network 100 provides the communication service over a wireless communication interface with communication devices.

[0097] The communication network 100 provides an LI service to a Law Enforcement Agency (LEA) 130. The communication network 100 intercepts data 135 pursuant to lawful authority, e.g. a warrant, and provides the intercepted data 135 to the LEA 130 for the purpose of analysis or evidence.

[0098] The intercepted data 135 that the communication network 100 intercepted as part of LI may include copies of the content of communications transmitted to or from one or more targeted communication devices (e.g., communication device 120). The content of communications may, for example, include any material or information concerning the substance, purport, or meaning of the communications. Alternatively, or additionally, the intercepted data 135 may include material or information related to the interception of communications transmitted to or from targeted communication devices. Such intercepted-related information (IRI) may include dialling, signalling, or addressing information that identified the origin, direction, destination, or termination of each communication generated or received by a subscriber by means of any equipment, facility, or service of a service provider. This may include for instance parameters of the signalling information that can be used as a means to subscribe to or activate features of the LI service, or establish and control a communication attempt. In an embodiment, the intercepted date 135 that the communication network 100 intercepted may include copies of network traffic that contain material related to IRI or material related to IRI and the content of communications (CC).

[0099] A LI administrative device 140 in the communication network 100 controls interception of the intercepted date 135 by the communication network 100 and delivery of the intercepted data 135 to the LEA 130. The LI administrative device 140 may control the interception of the intercepted data 135 by a network device 150 in the communication network 100. The LI administrative device 140 may control delivery of the interception data 135 from the network device 150 to a delivery device 160. The delivery device 160 may then provide the intercepted data 135 to the LEA 130.

[0100] In particular, the LI administrative device 140 may control the network device 150 to deliver the intercepted data 135 to one or more delivery destinations 162, 163. Only two delivery destination are depicted in Figure 1 , however, the skilled person would understand that there might be a plurality of delivery destination (e.g., more than one).

[0101] The network device 150 delivers the intercepted data 135 to the delivery device 160 to the delivery destination 162, 163 at the delivery device 160. The network device 150 and the delivery device 160 communicate over a delivery interface.

[0102] In an embodiment, the LI administrative device 140 implements function of the Administrative Function (ADMF) according to ETSI TS 103 221 -1 v.1.13.1.

[0103] In an embodiment, the network device 150 implements function of the Network Element according to European Telecommunications Standards Institute (ETSI) TS 103 221-1 v.1.13.1.

[0104] The LI administrative device 140 and the network device 150 may communicate interface X1 (shown in Figure 1 as X1 171 ). The interface X1 171 may correspond to interface X1 as defined in ETSI TS 103 221 -1 v.1 .13.1 .

[0105] In an embodiment, the network device 150 implements function of POI as defined in ETSI TS 103 221 -2 V1.6.1.

[0106] In an embodiment, the delivery device 160 implements function of a Mediation and Delivery Function (MDF) as defined in ETSI TS 103 221 -2 V1 .6.1 .

[0107] The network device 150 and the delivery device 160 may communicate other a delivery interface. The delivery interface is particular to a data type that is communicated between the network device 150 and the delivery device 160. The delivery interface may be an X2 interface as defined by ETSI TS 103 221-2 V.1.6.1. The X2 interface is illustrated as X2 172 in Figure 1 . The delivery interface may be an X3 interface as defined by ETSI TS 103 221-2 V.1.6.1. The X3 interface is illustrated as X3 173 in Figure 1 .

[0108] In particular, the X2 interface 172 may be used for delivery of one type of intercepted data 135, such as IRI. In particular, the X3 interface 173 may be used for delivery of another type of intercepted data 135, such as CC. The delivery interface may be X2 172. The delivery interface may be X3 173. In Figure 2, a flowchart depicting embodiment of a method 200 is provided. The method 200 is performed by the LI administrative device 140. The LI administrative device 140 is configured to be used in the communication network 100.

[0109] The method 200 comprises generating 210 a Differentiated Services Code Point (DSCP) value 310. In Figure 3, an embodiment of step 210 of the method 200 is illustrated. The DSCP value 310 is valid for the delivery interface. The LI administrative device 140 may be notified regarding traffic load on the delivery interface. For example, a notification 320 may correspond to a notification sent by the delivery device 160. Indeed, traffic load may be measured directly at the delivery device 160. The notification may be received by the

[0110] LI administrative device 140 periodically. For example, the notification may be received every minute, or every hour, or every day. Based on the notification 320, the LI administrative device 140 may generate the DSCP value 310 for the delivery interface. Thus, the LI administrative device 140 may prevent congestion on the delivery interface. As a consequence, the LI administrative device 140 may balance the traffic load on the interface by specifying the DSCP value 310 for the delivery interface. The delivery interface may be X2 interface 172. The delivery interface may be X3 interface 173. In an embodiment, the DSCP value 310 is an integer.

[0111] The method comprises transmitting 220 on an interface to the network device 150 a message 410. The interface on which the message 410 is transmitted in step 220 of the method 200 may be interface X1 171 as defined above. In particular, the interface X1 171 may correspond to interfaces internal to Communication Service Provider (CSO) for management tasks. In Figure 4, an embodiment of step 220 of the method 200 is illustrated. The message 410 is managing configuration of the network node 150. The message 410 comprises the DSCP value 310. As mentioned above, the DSCP value 310 is particular to the delivery interface. Thus, the network device 150 may transmit on the delivery interface a second message 1010 (illustrated in Figure 10) comprising the DSCP value 310, so as to reach the delivery device 160. In an embodiment, the interface corresponds to X1 interface 171 . In particular, the message 410 informs the network device 150 which delivery destination 162, 163 to transmit to. Indeed, the DSCP value 310 is dependent on the delivery interface. For example, if the DSCP value 310 is particular to interface X2 172, then the network device 150 will know to transmit on interface X2 172 to reach the delivery destination

[0112] 162 of the delivery device 160.

[0113] For example, if the DSCP value 310 is particular to interface X3 173, then the network device 150 will know to transmit on interface X3 173 to reach the delivery destination

[0114] 163 of the delivery device 160.

[0115] In an embodiment, the delivery interface may be interface X2 172. In particular, interface X2 172 may correspond to interfaces internal to CSP for X2 Intercept Related Information (xIRI) delivery.

[0116] In an embodiment, the delivery interface may be interface X3 173. In particular, interface X3 173 may correspond to interfaces internal to CSP for X3 Content of Communication (xCC) delivery.

[0117] In an embodiment, the message 410 is a CreateDestinationRequest as defined, for example, in ETSI TS 103 221 v1 .13.1 . In Figure 5, an embodiment of the message 410 is illustrated. In particular, the message 410 may be used to add a new destination to the network device 15O.The message 410 may comprise a field 510 indicating delivery information from the network device 150 to the destination. The field 510 indicating delivery information from the network device 150 to the destination may be DestinationDetails as defined, for example, in ETSI TS 103 221 v1 .13.1. The field 510 may comprise a new field 520 indicating the DSCP value 310. The new field 520 may be named DSCPDetails. The new field 520 may comprise the DSCP value 310.

[0118] The message 410 may comprise a second field 530 indicating a delivery address 540. The delivery address 540 is associated with the delivery interface. In other words, the delivery address corresponds to a destination that can be reached through the delivery interface (e.g., X2 or X3). The second field 530 may be DeliveryAddress as defined, for example, in ETSI TS 103 221 -1 v1 .13.1 . The second field 530 may comprise an IP Address and Port 540. The IP Address and Port 540 may use IPv4. The IP Address and Port 540 may use IPv6. The IP Address and Port 540 may contain a single IP Address and Port associated with the delivery interface. The IP Address and Port 540 may be formatted as IPAddressAndPort as defined, for example, in ETSI TS 103 280 v2.3.1. Thus, the message 410 may specify the DSCP value 310 for each created destination (e.g. second field 530) for reporting of xIRI and / or xCC. In an embodiment, the DSCP value 310 is used by the network device 150 when the delivery address associated with the delivery interface is an IP Address and Port.

[0119] In an embodiment, the message 410 is a ModifyDestinationRequest as defined, for example, in ETSI TS 103 221 v1 .13.1 . In Figure 6, an embodiment of the message 410 is illustrated. In particular, the message 410 may be used to modify an existing destination on the network device 150. The message 410 may comprise a field 610 indicating delivery information from the network device 150 to the destination. The field 610 indicating delivery information from the network device 150 to the destination may be DestinationDetails as defined, for example, in ETSI TS 103 221 v1 .13.1 . The field 610 may comprise a new field 620 indicating the DSCP value 310. The new field 620 may be named DSCPDetails. The new field 620 may comprise the DSCP value 310. The message 410 may comprise a second field 630 indicating a delivery address 640. The delivery address 640 is associated with the delivery interface. In other words, the delivery address corresponds to a destination that can be reached through the delivery interface (e.g., X2 or X3). The second field 630 may be DeliveryAddress as defined, for example, in ETSI TS 103 221 -1 v1 .13.1 . The second field 630 may comprise an IP Address and Port 640. The IP Address and Port 640 may use IPv4. The IP Address and Port 640 may use IPv6. The IP Address and Port 640 may contain a single IP Address and Port associated with the delivery interface. The IP Address and Port 640 may be formatted as IPAddressAndPort as defined, for example, in ETSI TS 103 280 v2.3.1. Thus, the message 410 may specify the DSCP value 310 for each modified destination (e.g. second field 630) for reporting of xIRI and / or xCC. In an embodiment, the DSCP value 310 is used by the network device 150 when the delivery address associated with the delivery interface is an IP Address and Port.

[0120] In an embodiment, the message 410 is a create issue destination message as defined in P104787W001 . The create issue destination message requests the network device 150 to add one or more issue destinations to the network device 150. In Figure 7, an embodiment of the message 410 is illustrated. In particular, the message 410 may be used to add a new destination to the network device 150. The message 410 may comprise a field 710 indicating delivery information from the network device 150 to the destination. The field 710 indicating delivery information from the network device 150 to the destination may be DestinationDetails as defined, for example, in ETSI TS 103 221 v1 .13.1 . The field 710 may comprise a new field 720 indicating the DSCP value 310. The new field 720 may be named DSCPDetails. The new field 720 may comprise the DSCP value 310.

[0121] The message 410 may comprise a second field 730 indicating a delivery address 740. The delivery address 740 is associated with the delivery interface. In other words, the delivery address corresponds to a destination that can be reached through the delivery interface (e.g., X2 or X3). The second field 730 may be DeliveryAddress as defined, for example, in ETSI TS 103 221 -1 v1 .13.1 . The second field 730 may comprise an IP Address and Port 740. The IP Address and Port 740 may use IPv4. The IP Address and Port 740 may use IPv6. The IP Address and Port 740 may contain a single IP Address and Port associated with the delivery interface. The IP Address and Port 740 may be formatted as IPAddressAndPort as defined, for example, in ETSI TS 103 280 v2.3.1. Thus, the message 410 may specify the DSCP value 310 for each created destination (e.g. second field 730) for reporting of xIRI and / or xCC. In an embodiment, the DSCP value 310 is used by the network device 150 when the delivery address associated with the delivery interface is an IP Address and Port.

[0122] In an embodiment, the message 410 is a modify issue destination message as defined in P104787W001 . The modify issue destination message requests modification of one or more issues destinations with which the network device 150 is configured. In Figure 8, an embodiment of the message 410 is illustrated. In particular, the message 410 may be used to modify an existing destination on the network device 150. The message 410 may comprise a field 810 indicating delivery information from the network device 150 to the destination. The field 810 indicating delivery information from the network device 150 to the destination may be DestinationDetails as defined, for example, in ETSI TS 103 221 v1 .13.1 . The field 810 may comprise a new field 820 indicating the DSCP value 310. The new field 820 may be named DSCPDetails. The new field 820 may comprise the DSCP value 310.

[0123] The message 410 may comprise a second field 830 indicating a delivery address 840. The delivery address 840 is associated with the delivery interface. In other words, the delivery address corresponds to a destination that can be reached through the delivery interface (e.g., X2 or X3). The second field 830 may be DeliveryAddress as defined, for example, in ETSI TS 103 221 -1 v1 .13.1 . The second field 830 may comprise an IP Address and Port 840. The IP Address and Port 840 may use IPv4. The IP Address and Port 840 may use IPv6. The IP Address and Port 840 may contain a single IP Address and Port associated with the delivery interface. The IP Address and Port 840 may be formatted as IPAddressAndPort as defined, for example, in ETSI TS 103 280 v2.3.1. Thus, the message 410 may specify the DSCP value 310 for each modified destination (e.g. second field 630) for reporting of xIRI and / or xCC. In an embodiment, the DSCP value 310 is used by the network device 150 when the delivery address associated with the delivery interface is an IP Address and Port.

[0124] The method comprises receiving 330 a response message 420 from the network device 150.

[0125] In an embodiment, the response message 420 is a CreateDestinationResponse, as defined, for example, in ETSI TS 103 221 -1 V1.13.1. For example, the CreateDestinationResponse may be a respective response to the CreateDestinationRequest defined herein.

[0126] In an embodiment, the response message 420 is a ModifyDestinationResponse, as defined, for example, in ETSI TS 103 221 -1 V1.13.1. For example, the ModifyDestinationResponse may be a respective response to the ModifyDestinationRequest defined herein.

[0127] In an embodiment, the response message 420 is a create issue destination response. For example, the create issue destination response may be a respective response to the create issue destination request defined herein.

[0128] In an embodiment, the response message 420 is a modify issue destination response. For example, the modify issue destination response may be a respective response to the modify issue destination request defined herein.

[0129] In Figure 9, a flowchart depicting embodiment of a method 900 is provided. The method 900 is performed by the network device 150. The network device 150 is configured to perform lawful interception in the communication network 100.

[0130] The method 900 comprises receiving 910 the message 410 on the interface. The message 410 is received from the LI administrative device 140. The message 410 of step 910 of the method 900 corresponds to the message 410 transmitted of the step 220 of the method 200, as described herein. The method 900 comprises transmitting 920 to the LI administrative device 149 the response message 420. The response message 420 of the step 920 of the method 900 corresponds to the response message 420 of the step 230 of the method 200.

[0131] In an embodiment, the method 900 comprises transmitting 930 on the delivery interface a second message 1010. In Figure 10, an embodiment of the step 930 of the method 900 is illustrated. The second message 1010 is transmitted to the delivery device 160. The second message 1010 may comprise the DSCP value 310 received in the step 910 of the method 900. The second message 1010 is transmitted in step 930 of the method 900 over the delivery interface. In Figure 11 , an embodiment of the second message 1010 is illustrated. The second message 1010 may comprise the DSCP value 310 within an Internet Protocol (IP) header 1110 of the second message 1010.

[0132] In an embodiment, the second message 1010 may be a message comprising an xIRI. The xIRI may comprise an SCEFPDNConnectionEstablishment record, as defined for example in 3GPP TS 33.128 v18.3.0, section 7.8.2.1 .2.

[0133] The xIRI may comprise an SCEFPDNConnectionllpdate record, as defined for example in 3GPP TS 33.128 v18.3.0, section 7.8.2.1 .3.

[0134] The xIRI may comprise an SCEFPDNConnectionRelease record, as defined for example in 3GPP TS 33.128 v18.3.0, section 7.8.2.1 .4.

[0135] The xIRI may comprise an SCEFUnsuccessfulProcedure record, as defined for example in 3GPP TS 33.128 v18.3.0, section 7.8.2.1 .5.

[0136] The xIRI may comprise an SCEFStartOflnterceptionWithEstablishedPDNConnection record, as defined for example in 3GPP TS 33.128 v18.3.0, section 7.8.2.1 .6.

[0137] In an embodiment, the second message 1010 may be a message comprising an xCC.

[0138] In an embodiment, the step 930 of the method 900 is performed before the step 920 of the method 900. In an embodiment, the step 920 of the method 900 is performed before the step 930 of the method 900. In an embodiment, the step 920 and the step 930 are performed simultaneously. In Figure 12, an illustrative example of messages exchanges between the LI administrative device 140, the network device 150, and the delivery device 160 according to embodiments, is provided.

[0139] The LI administrative device 140 is configured to send a message 1210. In an embodiment, the message 1210 corresponds to the message 410 transmitted in the step 220 of the method 200. In an embodiment, the message 1210 correspond to the message 410 received in the step 910 of the method 900.

[0140] The LI administrative device 140 is configured to receive a response message 1220. In an embodiment, the response message 420 corresponds to the response message 420 received in the step 230 of the method 200. In an embodiment, the response message 1220 corresponds to the response message 420 transmitted in the step 920 of the method 900.

[0141] The network device 150 is configured to transmit a second message 1230 to the delivery device 160. In an embodiment, the second message 1230 corresponds to the second message 1010 transmitted in the step 930 of the method 900.

[0142] In Figure 13, a block diagram of the LI administrative device 140 is provided. The LI administrative device 140 comprises a generating unit 1310. The LI administrative device 140 comprises a transmitting unit 1320. The LI administrative device 140 comprises a receiving unit 1330.

[0143] The generating unit 1310 is configured to cause the LI administrative device 140 to perform the step 210 of the method 200 as described above.

[0144] The transmitting unit 1320 is configured to cause the LI administrative device 140 to perform the step 220 of the method 200 as described above.

[0145] The receiving unit 1330 is configured to cause the LI administrative device 140 to perform the step 230 of the method 200 as described above. In an embodiment, the transmitting unit 1320, and the receiving unit 1330 are a same unit, such as a transceiver unit 1340.

[0146] The generating unit 1310, the transmitting unit 1320, and the receiving unit 1330, illustrated in Figure 13, may be implemented as a hardware solution or as a combination of software and hardware, e.g., by one or more of: a processor or a microprocessor and adequate software and memory for storing of the software, a Programmable Logic Device (PLD) or other electronic component(s) or processing circuitry configured to perform the actions described above with regards to the method 200.

[0147] In Figure 14, a block diagram of the network device 150 is provided. The network device 150 comprises a receiving unit 1410. The network device 150 comprises a first transmitting unit 1420.

[0148] The receiving unit 1410 is configured to cause the network device 150 to perform the step 910 of the method 900 as described above.

[0149] The first transmitting device 1420 is configured to cause the network device 150 to perform the step 920 of the method 900 as described above.

[0150] In an embodiment, the network device 150 comprises a second transmitting unit 1430. The second transmitting unit 1430 is configured to cause the network device 150 to perform the step 930 of the method 900 as described above.

[0151] In an embodiment, the first transmitting unit 1420, and the second transmitting device are a same unit.

[0152] In an embodiment, the receiving unit 1410, the first transmitting unit 1420, and the second transmitting unit 1430 are a same unit, such as a transceiver unit 1440.

[0153] The receiving unit 1410, the first transmitting unit 1420, and the second transmitting unit 1430, illustrated in Figure 14, may be implemented as a hardware solution or as a combination of software and hardware, e.g., by one or more of: a processor or a micro-processor and adequate software and memory for storing of the software, a Programmable Logic Device (PLD) or other electronic component(s) or processing circuitry configured to perform the actions described above with regards to the method 900.

[0154] In Figure 15, an embodiment of the LI administrative device 140 is provided. The LI administrative device 140 comprises a processor 1510, and a computer readable storage medium 1520 in the form of a memory 1525. The memory 1525 contains a computer program 1530 comprising instructions executable by the processor 1510 whereby the LI administrative device 150 is operative to perform the steps of the method 200.

[0155] In Figure 16, an embodiment of the network device 150 is provided. The network device 150 comprises a processor 1610, and a computer readable storage medium 1620 in the form of a memory 1625. The memory 1625 contains a computer program 1630 comprising instructions executable by the processor 1610 whereby the network device 150 is operative to perform the steps of the method 900.

[0156] The (non-transitory) computer readable storage media mentioned above may be an Electrically Erasable Programmable Read-Only Memory (EEPROM), a flash memory, Field Programmable Gate Array, and a hard drive.

[0157] The processor 1510 of Figure 15, and the processor 1610 of Figure 16, may be a single Central Processing Unit (CPU), but could also comprise two or more processing units. For example, the processor 1510 of Figure 15, and the processor 1610 of Figure 16 may include general purpose microprocessors; instructions set processors and / or related chips sets and / or special purpose microprocessors such as Application Specific Circuits (ASICs). The processor 1510 of Figure 15 and the processor 1610 of Figure 16 may also comprise board memory for caching purposes.

[0158] The computer program 1530 of Figure 15, and the computer program 1630 of Figure 16 may be carried by a computer program product connected to the processor 1510 of Figure 15, and the processor 1610 of Figure 16. The computer program products may be or comprise a non-transitory computer readable storage medium on which the computer programs 1530 of Figure 15, and the computer program 1630 of Figure 16 are stored. For example, the computer program products may be a flash memory, a Random-Access memory (RAM), a Read-Only Memory (ROM), or an EEPROM, and the computer programs described above could in alternative embodiments be distributed on different computer program products in the form of memories.

[0159] It should be understood that although the terms “first”, “second”, etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, the first message could be termed the second message, and similarly, the second message could be termed the first message.

[0160] As used herein, the term “and / or” includes any and all combinations of one or more of the associated listed terms. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limited of example embodiments. As used herein, the single forms “a”, “an”, and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises”, “comprising”, “has”, “having”, “includes”, and / or “including”, when used herein, specify the presence of stated features, elements, and / or components etc. but not preclude the presence or addition of one or more other features, elements, components, and / or combinations thereof.

[0161] The disclosure has been described above in reference to embodiments thereof. It should be understood that various modifications, alternatives, and additions can be made by those skilled in the art without departing from the scope of the disclosure. Therefore, the scope of the disclosure is not limited to the above particular embodiments but only defined by the claims as attached.

Claims

CLAIMS1 . A lawful interception, LI, administrative device (140) configured to be used in a communication network (100), the LI administrative device (140) being configured to:- generate a Differentiated Services Code Point, DSCP, value (310), wherein the DSCP value (310) is valid for a delivery interface (172, 173);- transmit on an interface (171 ) to a network device (150) configured to perform LI in the communication network (100), a message (410, 1210), the message (410, 1210) managing configuration of the network device (150), wherein the message (410, 1210) comprises the DSCP value (310); and- receive a response message (420, 1220) from the network device (150).

2. The LI administrative device (140) according to claim 1 , wherein the DSCP value (310) is used when a delivery address (540, 640, 740, 840) associated with the delivery interface (172, 173) is an IP Address And Port.

3. The LI administrative device (140) according to one or more of claims 1 -2, wherein the interface is interface X1 (171 ).

4. The LI administrative device (140) according to claim 3, wherein interface X1 (171 ) corresponds to interfaces internal to Communication Service Provider, CSP, for management tasking.

5. The LI administrative device (140) according to one or more of claims 1 -4, wherein the delivery interface is one or more of:- interface X2 (172); or- interface X3 (173).

6. The LI administrative device (140) according to claim 5, wherein X2 (172) corresponds to interfaces internal to CSP for X2 Intercept Related Information, xIRI, delivery.

7. The LI administrative device (140) according to one or more of claims 5-6, wherein X3 (173) corresponds to interfaces internal to CSP for X3 Content of Communication, xCC, delivery.

8. The LI administrative device (140) according to one or more of claims 1-7, wherein the message (410, 1210) is:- a CreateDestinationRequest; or- a ModifyDestinationRequest.

9. The LI administrative device (140) according to one or more of claims 1-8, wherein the response message (420, 1220) is:- CreateDestinationResponse; or- ModifyDestinationResponse.

10. The LI administrative device (140) according to one or more of claims 1-9, wherein the DSCP value (310) is an integer.11 .The LI administrative device (140) according to one or more of claims 1-10, wherein the LI administrative device (140) is an Administrative Function, ADMF, node.

12. The LI administrative device (140) according to one or more of claims 1-11 , wherein the network device (150) is a Point of Interception.

13. A network device (150) configured to perform lawful interception in a communication network (100), the network device (150) being configured to:- receive on an interface (171 ), from a lawful interception, LI, administrative device (140) configured to be used in the communication network (100), a message (410, 1210), the message (410, 1210) managing configuration of the network device (150), wherein the message (410, 1210) comprises a Differentiated Services Code Point, DSCP, value (310), wherein the DSCP value (310) is valid for a delivery interface (172, 173); andtransmit to the LI administrative device (140) a response message (420, 1220).

14. The network device (150) according to claim 13, is configured to:- transmit on the delivery interface (172, 173) a second message (1010, 1230) to a delivery device (160), the second message (1010, 1230) comprising the DSCP value (310).

15. The network device (150) according to claim 14, wherein the second message (1010, 1230) is transmitted over the delivery interface (172, 173).

16. The network device (150) according to one or more of claims 14-15, wherein the second message (1010, 1230) comprises the DSCP value (310) within an IP header (1110) of the second message (1010, 1230).

17. The network device (150) according to claim 16, wherein the DSCP value (310) is used when a delivery address (540, 640, 740, 840) associated with the delivery interface (172, 173) is an IP Address And Port.

18. The network device (150) according to one or more of claims 13-17, wherein the interface is interface X1 (171 ).

19. The network device (150) according to claim 18, wherein interface X1 (171 ) corresponds to interfaces to Communication Service Provider, CSP, for management tasking.

20. The network device (150) according to one or more of claims 13-19, wherein the delivery interface is one or more of:- X2 (172); or- X3 (173).

21. The network device (150) according to claim 20, wherein X2 (172) corresponds to interfaces internal to CSP for X2 Intercept Related Information, xIRI, delivery.

22. The network device (150) according to one or more of claims 20-21 , wherein X3 (173) corresponds to interfaces internal to CSP for X3 Content of Communication, xCC, delivery.

23. The network device (150) according to one or more of claims 13-22, wherein the message (410, 1210) is:- a CreateDestinationRequest; or- a ModifyDestinationRequest.

24. The network device (150) according to one or more of claims 13-23, wherein the response message (420, 1220) is:- a CreateDestinationResponse; or- a ModifyDestinationResponse.

25. The network device (150) according to one or more of claims 14-24, wherein the second message (1010, 1230) is:- a message comprising an xIRI; or- a message comprising an xCC.

26. The network device (150) according to one or more of claims 13-25, wherein the DSCP value (310) is an integer.

27. The network device (150) according to one or more of claims 13-26, wherein the LI administrative device (140) is an Administrative Function, ADMF, node.

28. The network device (150) according to one or more of claims 13-27, wherein the network device (150) is a Point of Interception.

29. The network device (150) according to one or more of claims 14-28, wherein the delivery device (160) is a Mediation and Delivery Function, MDF, node.

30. A method (200) performed by a lawful interception, LI, administrative device (140), the LI administrative device (140) being configured to be used in a communication network (100), the method (200) comprising:- generating (210) a Differentiated Services Code Point, DSCP, value (310), wherein the DSCP value (310) is valid for a delivery interface (172, 173);- transmitting (220) on an interface (171 ) to a network device (150) configured to perform LI in the communication network (100), a message (410, 1210), the message (410, 1210) managing configuration of the network device (150), wherein the message (410, 1210) comprises the DSCP value (310); and- receiving (230) a response message (420, 1220) from the network device (150).

31. The method (200) according to claim 30, wherein the DSCP value (310) is used when a delivery address (540, 640, 740, 840) associated with the delivery interface (172, 173) is an IP Address And Port.

32. The method (200) according to one or more of claims 30-31 , wherein the interface is interface X1 (171 ).

33. The method (200) according to claim 32, wherein interface X1 (171 ) corresponds to interfaces internal to Communication Service Provider, CSP, for management tasking.

34. The method (200) according to one or more of claims 30-33, wherein the delivery interface is one or more of:- interface X2 (172); or- interface X3 (173).

35. The method (200) according to claim 34, wherein X2 (172) corresponds to interfaces internal to CSP for X2 Intercept Related Information, xIRI, delivery.

36. The method (200) according to one or more of claims 34-35, wherein X3 (173) corresponds to interfaces internal to CSP for X3 Content of Communication, xCC, delivery.

37. The method (200) according to one or more of claims 30-36, wherein the message (410, 1210) is:- a CreateDestinationRequest; or- a ModifyDestinationRequest.

38. The method (200) according to one or more of claims 30-37, wherein the response message (420, 1220) is:- CreateDestinationResponse; or- ModifyDestinationResponse.

39. The method (200) according to one or more of claims 30-38, wherein the DSCP value (310) is an integer.

40. The method (200) according to one or more of claims 30-39, wherein the LI administrative device (140) is an Administrative Function, ADMF, node.41 . The method (200) according to one or more of claims 30-40, wherein the network device is a Point of Interception.

42. A method (900) performed by a network device (150), the network device (150) being configured to perform lawful interception in a communication network (100), the method (900) comprising:- receiving (910) on an interface (171 ), from a lawful interception, LI, administrative device (140) configured to be used in the communication network (100), a message (410, 1210), the message (410, 1210) managing configuration of the network device (150), wherein the message (410, 1210) comprises a Differentiated Services Code Point, DSCP, value (310), wherein the DSCP value (310) is valid for a delivery interface (172, 173); andtransmitting (920) to the LI administrative device (140) a response message (420, 1220).

43. The method (900) according to claim 42, comprising:- transmitting (930) on the delivery interface (172, 173) a second message (1010, 1230) to a delivery device (160), the second message (1010, 1230) comprising the DSCP value (310).

44. The method (900) according to claim 43, wherein the second message (1010 1230) is transmitted over the delivery interface (172, 173).

45. The method (900) according to one or more of claims 43-44, wherein the second message (1010, 1230) comprises the DSCP value (310) within an IP header (1110) of the second message (1010, 1230).

46. The method (900) according to one or more of claims 42-45, wherein the DSCP value (310) is used when a delivery address (540, 640, 740, 840) associated with the delivery interface (172, 173) is an IP Address And Port.

47. The method (900) according to one or more of claims 42-46, wherein the interface is interface X1 (171 ).

48. The method (900) according to claim 47, wherein interface X1 (171 ) corresponds to interfaces to Communication Service Provider, CSP, for management tasking.

49. The method (900) according to one or more of claims 42-48, wherein the delivery interface is one or more of:- X2 (172); or- X3 (173).

50. The method (900) according to claim 49, wherein X2 (172) corresponds to interfaces internal to CSP for X2 Intercept Related Information, xIRI, delivery.

51. The method (900) according to one or more of claims 49-50, wherein X3 (173) corresponds to interfaces internal to CSP for X3 Content of Communication, xCC, delivery.

52. The method (900) according to one or more of claims 42-51 , wherein the message (410, 1210) is:- a CreateDestinationRequest; or- a ModifyDestinationRequest.

53. The method (900) according to one or more of claims 42-52, wherein the response message (420, 1220) is:- a CreateDestinationResponse; or- a ModifyDestinationResponse.

54. The method (900) according to one or more of claims 43-53, wherein the second message (1010, 1230) is:- a message comprising an xIRI; or- a message comprising an xCC.

55. The method (900) according to one or more of claims 42-54, wherein the DSCP value (310) is an integer.

56. The method (900) according to one or more of claims 42-55, wherein the LI administrative device (140) is an Administrative Function, ADMF, node.

57. The method (900) according to one or more of claims 42-56, wherein the network device (150) is a Point of Interception.

58. The method (900) according to one or more of claims 43-57, wherein the delivery device (160) is a Mediation and Delivery Function, MDF, node.

59. A computer program (1530) comprising instructions, which when executed by a Lawful Interception, LI, administrative device (140), causes the LIadministrative device (140) to perform the method (200) according to one or more of claims 30-41 .

60. A computer program (1630) comprising instructions, which when executed on a network device (150), causes the network device (150) to perform the method (900) according to one or more of claims 42-58.

61. A computer readable storage medium (1520, 1620) comprising a computer program (1530, 1630) according to claim 59, and / or claim 60.

Images