Apparatus and methods for aggregating lawful interception logs

Abstract

A Lawful Interception (LI) Administrative Function (ADMF) device (130), a network element, NE, device (140), a mediation and delivery function (MDF) device (150), methods and computer programs are disclosed The LI ADMF device (130) is configured to generate a log correlation identifier (310), the log correlation identifier (310) is related to the target UE identifier (115); send, over a first interface (171), a first message (320) to a network element, NE, device (140), the first message (320) comprising the log correlation identifier (310); collect one or more LI logs (410) related to the target UE identifier (115), the one or more LI logs (410) comprise the log correlation identifier (310); and analyse the collected one or more LI logs (410) based on the log correlation identifier (310).

Description

[0001] APPARATUS AND METHODS FOR AGGREGATING LAWFUL INTERCEPTION

[0002] LOGS

[0003] TECHNICAL FIELD

[0004] The invention relates to a lawful interface (LI) administrative function (ADMF) device for aggregating LI logs related to a target user equipment (UE) identifier, a network element (NE) device for aggregating LI logs related to a target UE identifier, and a mediation and delivery function (MDF) device for aggregating LI logs related to a target UE identifier, corresponding methods, corresponding computer programs, and corresponding computer readable storage medium.

[0005] BACKGROUND

[0006] Lawful Interception (LI) allows law enforcement agencies (LEAs) to obtain LI data from a communication network pursuant to lawful authority, for the purpose of analysis or evidence.

[0007] Third Generation Partnership Project (3GPP) Technical Specification (TS) 33 127 version (v) 18.5.0. specifies LI architecture and functions. In particular, an LEA serves a communication network within a lawful order, e.g., warrant from a court of law, requiring that the communication network performs LI on a certain target user equipment (UE). To comply with the lawful order, an LI administrative function in the communication device configures network element(s) in the communication network to intercept LI data related to the target UE. The network element(s) are configured, for example, with regards to what type(s) of LI data to intercept and to where to deliver the intercepted LI data. The communication network then transfers any intercepted LI data to the LEA.

[0008] LI logs are used as a source of primary data for network observability. An LI log is a computer-generated data file that contains information about usage patters, activities, and operations within the LI architecture.

[0009] SUMMARY A disadvantage of the current LI architecture is that it does not allow end-to-end troubleshooting analysis where NE devices are involved to intercept LI data.

[0010] A further disadvantage of the current LI architecture is that the NE device intercepting the LI data is generating and storing the LI logs. This is in contrast to the security requirements of LI invisibility inside NE device performing Point of Interception.

[0011] It is an object of the invention is to enable improved security related to lawful interception logs.

[0012] According to a first aspect of the invention, a lawful interception, LI, administration function (ADMF) device for aggregating of one or more LI logs related to a target user equipment (UE) is provided. The LI ADMF device being configured to generate a log correlation identifier, wherein the log correlation identifier is related to the target UE identifier. The LI ADMF device is configured to send, over a first interface, a first message to a NE device, the first message comprising the log correlation identifier. The LI ADMF device is configured to collect one or more LI logs related to the target UE identifier, wherein the one or more LI logs comprise the log correlation identifier. The LI ADMF device is configured to analyse the collected one or more LI logs based on the log correlation identifier. Hereby is achieved that the LI logs are aggregated based on a log correlation identifier related to the target UE identifier. In particular, the LI logs are aggregated centrally towards the LI ADMF device, such that the LI ADMF device is able to perform analyses on the collected LI logs.

[0013] According to an embodiment of the first aspect, the first interface is interface X1 .

[0014] According to an embodiment of the first aspect, the interface X1 corresponds to LI interfaces internal to a Communication Service Provider, CSP, for management tasking.

[0015] According to an embodiment of the first aspect, collecting the one or more LI logs comprises one or more of: receiving, from the NE device, one or more NE(NE) LI logs related to the target UE identifier over a second interface, the one or more NE LI logs comprise the log correlation identifier; and receiving, from a mediation and delivery function (MDF) device, one or more MDF LI logs related to the target UE identifier over the first interface, the one or more MDF LI logs comprise the log correlation identifier.

[0016] According to an embodiment of the first aspect, the one or more MDF LI logs comprise one or more LI data intercepted by the NE device and received by the MDF device over a delivery interface, the one or more LI data comprise the log correlation identifier.

[0017] According to an embodiment of the first aspect, the second interface is a SYSLOG interface.

[0018] According to an embodiment of the first aspect, the LI ADMF device is configured to receive, over the first interface, from the NEdevice, a second message reporting an issue related to the target UE identifier, the second message comprises the log correlation identifier.

[0019] According to an embodiment of the first aspect, the first message is an ActivateTask request.

[0020] According to an embodiment of the first aspect, the first message is a CreateDestinationRequest.

[0021] According to an embodiment of the first aspect, the second message is a ReportT asklssueRequest.

[0022] According to an embodiment of the first aspect, the second message is a ReportDestinationlssueRequest.

[0023] According to an embodiment of the first aspect, the LI ADMF device is configured to configure the NE device to indicate the one or more NE LI logs related to the target UE identifier, the one or more NE LI logs comprise the log correlation identifier.

[0024] According to an embodiment of the first aspect, configuring comprises sending a configuration message to the NE device. The configuration message comprises an indication whether to enable or disable sending the one or more NE LI logs related to the target UE to the LI ADMF device; an IP address and port associated with the LI ADMF device; and / or a delivery policy.

[0025] According to an embodiment of the first aspect, the configuration message is sent over an interface X0.

[0026] According to a second aspect of the invention, a NEdevice for aggregating of one or more lawful interception, LI, logs related to a target user equipment (UE) identifier, is provided. The NE device is configured to receive, over a first interface, a first message from an LI ADMF device, the first message comprising a log correlation identifier, the log correlation identifier being related to the target UE identifier. The NE device is configured to send one or more NE(NE) LI logs related to the target UE identifier over a second interface, the one or more NE LI logs comprise the log correlation identifier. The Ne device is configured to send, to a mediation and delivery function (MDF) device, one or more LI data intercepted by the NE device related to the target UE identifier over a delivery interface, wherein the one or more LI data comprises the log correlation identifier.

[0027] According to an embodiment of the second aspect, the first interface is interface X1 .

[0028] According to an embodiment of the second aspect, the interface X1 corresponds to LI interfaces internal to a Communication Service Provider, CSP, for management tasking.

[0029] According to an embodiment of the second aspect, the delivery interface is one or more of: interface X2; or interface X3.

[0030] According to an embodiment of the second aspect, the interface X2 corresponds to LI interfaces internal to the CSP for X2 Intercept Related Information (xIRI) delivery.

[0031] According to an embodiment of the second aspect, the interface X3 corresponds to LI interfaces internal to the CSP for X3 Content of Communication (xCC) delivery. According to an embodiment of the second aspect, the second interface is a SYSLOG interface.

[0032] According to an embodiment of the second aspect, the NE device is configured to send, over the first interface, to the LI ADMF device, a second message reporting an issue related to the target UE identifier, the second message comprises the log correlation identifier.

[0033] According to an embodiment of the second aspect, the first message is an Activate? askRequest.

[0034] According to an embodiment of the second aspect, the first message is a CreateDestinationRequest.

[0035] According to an embodiment of the second aspect, the second message is a ReportT asklssueRequest.

[0036] According to an embodiment of the second aspect, the second message is a ReportDestinationlssueRequest.

[0037] According to an embodiment of the second aspect, the NE device is configured to receive a configuration message to indicate the one or more NE LI logs related to the target UE identifier. The one or more NE LI logs comprise the log correlation identifier. The configuration message comprises an indication whether to enable or disable sending the one or more NE LI logs related to the target UE identifier to the LI ADMF device; an IP address and port associate with the LI ADMF device; and / or a delivery policy.

[0038] According to an embodiment of the second aspect, the configuration message is sent over an interface X0.

[0039] According to a third aspect of the invention, a mediation and delivery function (MDF) device for aggregating of lawful interception, LI, logs related to a target user equipment (UE) identifier, is provided. The MDF device is configured to receive, from a NE device, over a delivery interface, one or more LI data related to the target UE identifier, the one or more LI data comprise a log correlation identifier, the log correlation identifier being related to the target UE identifier. The MDF device is configured to send, to a LI administrative function (ADMF) device, over a first interface, one or more MDF LI logs, the one or more MDF LI logs comprising the one or more LI data and the log correlation identifier.

[0040] According to an embodiment of the third aspect, the delivery interface is one or more of: interface X2; or interface X3.

[0041] According to an embodiment of the third aspect, the interface X2 corresponds to LI interfaces internal to a CSP for X2 Intercept Related Information (xIRI) delivery.

[0042] According to an embodiment of the third aspect, the interface X3 corresponds to LI interfaces internal to the CSP for X3 Content of Communication (xCC) delivery.

[0043] According to an embodiment of the third aspect, the first interface is interface X1 .

[0044] According to an embodiment of the third aspect, the interface X1 corresponds to LI interfaces internal to the CSP for management tasking.

[0045] According to a fourth aspect of the invention, a method performed by a lawful interception, LI, administration function, ADMF, device (130), for aggregating of one or more LI logs related to a target user equipment, UE, identifier is provided. The method comprises generating a log correlation identifier, the log correlation identifier is related to the target UE identifier. The method comprises sending, over a first interface, a first message to a NE device, the first message comprising the log correlation identifier. The method comprises collecting one or more LI logs related to the target UE identifier, the one or more LI logs comprise the log correlation identifier. The method comprises analysing the collected one or more LI logs based on the log correlation identifier.

[0046] According to an embodiment of the fourth aspect, the first interface is interface X1 . According to an embodiment of the fourth aspect, the interface X1 corresponds to LI interfaces internal to a CSP for management tasking.

[0047] According to an embodiment of the fourth aspect, collecting the one or more LI logs comprises one or more of: receiving, from the NE device, one or more NE(NE) LI logs related to the target UE identifier over a second interface, the one or more NE LI logs comprise the log correlation identifier; and receiving, from a mediation and delivery function (MDF) device, one or more MDF LI logs related to the target UE identifier over the first interface, the one or more MDF LI logs comprise the log correlation identifier.

[0048] According to an embodiment of the fourth aspect, the one or more MDF LI logs comprise one or more LI data intercepted by the NE device and received by the MDF device over a delivery interface, the one or more LI data comprise the log correlation identifier.

[0049] According to an embodiment of the fourth aspect, the second interface is a SYSLOG interface.

[0050] According to an embodiment of the fourth aspect, the method comprises receiving, over the first interface, from the NE device, a second message reporting an issue related to the target UE identifier, the second message comprises the log correlation identifier.

[0051] According to an embodiment of the fourth aspect, the first message is an ActivateTask request.

[0052] According to an embodiment of the fourth aspect, the first message is a CreateDestinationRequest.

[0053] According to an embodiment of the fourth aspect, the second message is a ReportT asklssueRequest.

[0054] According to an embodiment of the fourth aspect, the second message is a ReportDestinationlssueRequest. According to an embodiment of the fourth aspect, the method comprises configuring the NEdevice to indicate the one or more NE LI logs related to the target UE identifier, the one or more NE LI logs comprise the log correlation identifier.

[0055] According to an embodiment of the fourth aspect, configuring comprises sending a configuration message to the NE device. The configuration message comprises an indication whether to enable or disable sending the one or more NE LI logs related to the target UE to the LI ADMF device; an IP address and port associated with the LI ADMF device; and / or a delivery policy.

[0056] According to an embodiment of the fourth aspect, the configuration message is sent over an interface X0.

[0057] According to a fifth aspect of the invention, a method performed by a NE device, for aggregating of one or more lawful interception (LI) logs related to a target user equipment (UE) identifier. The method comprises receiving, over a first interface, a first message from an LI Administrative Function, ADMF, device, the first message comprising a log correlation identifier, the log correlation identifier being related to the target UE identifier. The method comprises sending one or more Network Element, NE, LI logs related to the target UE identifier over a second interface, the one or more NE LI logs comprise the log correlation identifier. The method comprises sending, to a mediation and delivery function, MDF, device, one or more LI data intercepted by the NE device related to the target UE identifier over a delivery interface, the one or more LI data comprises the log correlation identifier.

[0058] According to an embodiment of the fifth aspect, the first interface is interface X1 .

[0059] According to an embodiment of the fifth aspect, the interface X1 corresponds to LI interfaces internal to a CSP for management tasking.

[0060] According to an embodiment of the fifth aspect, the delivery interface is one or more of: interface X2; or interface X3. According to an embodiment of the fifth aspect, the interface X2 corresponds to LI interfaces internal to the CSP for X2 Intercept Related Information (xIR), delivery.

[0061] According to an embodiment of the fifth aspect, the interface X3 corresponds to LI interfaces internal to the CSP for X3 Content of Communication (xCC) delivery.

[0062] According to an embodiment of the fifth aspect, the second interface is a SYSLOG interface.

[0063] According to an embodiment of the fifth aspect, the method comprises sending, over the first interface, to the LI ADMF device, a second message reporting an issue related to the target UE identifier, the second message comprises the log correlation identifier.

[0064] According to an embodiment of the fifth aspect, the first message is an Activate? askRequest.

[0065] According to an embodiment of the fifth aspect, the first message is a CreateDestinationRequest.

[0066] According to an embodiment of the fifth aspect, the second message is a ReportT asklssueRequest.

[0067] According to an embodiment of the fifth aspect, the second message is a ReportDestinationlssueRequest.

[0068] According to an embodiment of the fifth aspect, the method comprises receiving a configuration message to indicate the one or more NE LI logs related to the target UE identifier, the one or more NE LI logs comprise the log correlation identifier. The configuration message comprises an indication whether to enable or disable sending the one or more NE LI logs related to the target UE identifier to the LI ADMF device; an IP address and port associate with the LI ADMF device; and / or a delivery policy.

[0069] According to an embodiment of the fifth aspect, the configuration message is sent over an interface X0. According to a sixth aspect of the invention, a method performed by a mediation and delivery function (MDF) device, for aggregating of lawful interception (LI) logs related to a target user equipment (UE) identifier is provided. The method comprises receiving, from a NE device, over a delivery interface, one or more LI data related to the target UE identifier, the one or more LI data comprise a log correlation identifier, the log correlation identifier being related to the target UE identifier. The method comprises sending, to a LI administrative function, ADMF, device, over a first interface, one or more MDF LI logs, the one or more MDF LI logs comprising the one or more LI data and the log correlation identifier.

[0070] According to an embodiment of the sixth aspect, the delivery interface is one or more of: interface X2; or interface X3.

[0071] According to an embodiment of the sixth aspect, the interface X2 corresponds to LI interfaces internal to a CSP for X2 Intercept Related Information (xIRI) delivery.

[0072] According to an embodiment of the sixth aspect, the interface X3 corresponds to LI interfaces internal to the CSP for X3 Content of Communication (xCC) delivery.

[0073] According to an embodiment of the sixth aspect, the first interface is interface X1 .

[0074] According to an embodiment of the sixth aspect, the interface X1 corresponds to LI interfaces internal to the CSP for management tasking.

[0075] According to a seventh aspect of the invention, a computer program is provided. The computer program comprises instructions, which when executed on a Lawful Interception, LI, Administrative Function (ADMF) device, causes the LI ADMF device to perform the method according to any embodiments of the fourth aspect of the invention.

[0076] According to an eighth aspect of the invention, a computer program is provided. The computer program comprises instructions, which when executed on a NE device, causes the NE device to perform the method according to any embodiments of the fifth aspect of the invention.

[0077] According to a ninth aspect of the invention, a computer program is provided. The computer program comprises instructions, which when execute on a Mediation and Delivery Function (MDF) device, causes the MDF device to perform the method according to any embodiments of the sixth aspect of the invention.

[0078] According to a tenth aspect of the invention, a computer readable storage medium is provided. The computer readable storage medium comprises a computer program according to the seventh aspect of the invention, the eighth aspect of the invention, and / or the ninth aspect of the invention.

[0079] At least one or more embodiments advantageously enable centralized analysis of reported issues and correlated LI logs within the LI ADMF device based on the log correlation identifier.

[0080] At least one or more embodiments advantageously enable centralized analysis of reported issues and correlated LI logs within the LI ADMF device based on the log correlation identifier distributed at tack activation.

[0081] At least one or more embodiments advantageously enable centralized analysis of reported issues and correlated LI logs within the LI ADMF device based on log correlation identifier distributes at destination activation.

[0082] At least one or more embodiments advantageously improve security by avoiding to store the LI logs within the NE device performing the interception of data within the communication network.

[0083] Further objectives of, features of, and advantages with, the invention will become apparent when studying the following detailed disclosure, the drawings, and the appended claims. Those skilled in the art realize that different features of the invention can be combined to create embodiments other than those described in the following. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] The above, as well as additional object, features and advantages of the invention will be better understood through the following and non-limiting detailed description of embodiments of the invention, with reference to the appended drawings, in which:

[0085] Figure 1 shows an embodiment of a communication network.

[0086] Figure 2 shows an embodiment of a method performed by an LI ADMF device.

[0087] Figure 3 shows an embodiment of the method performed by the LI ADMF device.

[0088] Figure 4 shows an embodiment of the method performed by the LI ADMF device.

[0089] Figure 5 shows an embodiment of the method performed by the LI ADMF device.

[0090] Figure 6 shows an embodiment of the method performed by the LI ADMF device.

[0091] Figure 7 shows an embodiment of a configuration message.

[0092] Figure 8 shows an embodiment of a method performed by an NE device.

[0093] Figure 9 shows an embodiment of a method performed by a MDF device.

[0094] Figure 10 shows a block diagram of an LI ADMF device.

[0095] Figure 11 shows a block diagram of an NE device.

[0096] Figure 12 shows a block diagram of an MDF device.

[0097] Figure 13 shows an illustrative example of messages exchanged between an LI ADMF device, an NE device, and an MDF device.

[0098] Figure 14 shows a block diagram of an LI ADMF device. Figure 15 shows a block diagram of an NE device.

[0099] Figure 16 shows a block diagram of an MDF device.

[0100] All figures are schematic, and generally show parts which are necessary in order to elucidate the invention, wherein other parts may be omitted or merely suggested.

[0101] DETAILED DESCRIPTION

[0102] The invention will now be described more fully herein with reference to the accompanying drawings, in which certain embodiments are shown. This invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided by way of example so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0103] The current LI architecture does not allow end-to-end troubleshooting analysis where NE devices are involved to intercept LI data. Furthermore, the NE device intercepting the LI data is generating and storing the LI logs. This is in contrast to the security requirements of LI invisibility inside NE device performing Point of Interception.

[0104] To overcome these problems, the solution to be disclosed, in its embodiments, provides an LI ADMF device for aggregating one or more LI logs related to a target UE identifier. The LI ADMF device is configured to generate a log correlation identifier. The log correlation identifier is related to the target UE identifier. The LI ADMF device is further configured to send, over a first interface, a first message to an NE device. The first message comprises the log correlation identifier. The LI ADMF device is further configured to collect one or more LI logs related to the target UE identifier. The one or more LI logs comprise the log correlation identifier. The LI ADMF device is further configured to analyse the collected one or more LI logs based on the log correlation identifier. The present invention in its embodiments allow aggregation of one or more LI logs based on a log correlation identifier related to the target UE identifier. The LI logs are aggregated centrally towards the LI ADMF device, such that the LI ADMF device is able to perform analysis on the collected LI logs. Further, the present invention improves security by avoiding storing of the LI logs within the NE device performing the interception of data within the communication network.

[0105] In Figure 1 , an embodiment of a communication network 100 is provided. The communication network 100 of a Communication Service Provider (CSP) provides communication services to communication devices, one of which is shown as target user equipment (UE) 110. The skilled person would understand that even if only one target UE 110 is illustrated in Figure 1 , there might be a plurality of target UEs (e.g., more than one). The communication network 100 is a 3GPP cellular network, such as a third generation (3G) cellular network, a further generation (4G) cellular network, a fifth generation (5G) cellular network, or any future generation cellular network, such as a 3GPP sixth generation (6G) cellular network.

[0106] The target UE 1 10 is identified by a target UE identifier 115. The target UE identifier 115 may be a subscription permanent identifier (SUPI), in the form of an international mobile subscription identifier (IMSI). The target UE identifier may be a Generic public subscription identifier (GPSI), in the form of a mobile subscriber ISDN number (MSIDN). The target UE identifier may be a permanent equipment identifier (PEI), such as an international mobile equipment identity (IMEI).

[0107] In an embodiment, the communication network 100 is a wireless communication network, in which case the communication network 100 provides the communication services over a wireless communication interface with communication devices.

[0108] The communication network 100 provides an LI service to a Law Enforcement Agency (LEA) 120. The communication network 100 intercepts one or more LI data 125 pursuant to lawful authority, e.g., a warrant, and provides the one or more LI data 125 to the LEA 120 for the purpose of analysis or evidence.

[0109] In an embodiment, the one or more LI data 125 that the communication network 100 intercepted as part of LI include copies of the content of communications (CC) transmitted to or from the target UE 110. The content of communications may, for example, include any material or information concerning the substance, purport, or meaning of the communications.

[0110] Alternatively, or additionally, the one or more LI data 125 include material or information related to the interception of communication transmitted to or from the target UE 110. Such intercepted-related information (IRI) may include dialling, signalling, or addressing information that identify the origin, direction, destination, or termination of each communication generated or received by a subscriber by means of any equipment, facility, or service of a service provider. This may include for instance parameters of the signalling information that can be used as a means to subscribe to or activate features of the LI service, or establish and control a communication attempt.

[0111] In an embodiment, the one or more LI data 125 that the communication network 100 intercepted include copies of network traffic that contain material related to IRI, or material related to IRI and CC.

[0112] The communication network 100 comprises an LI Administrative Function (ADMF) device 130. The LI ADMF device 130 controls interception of the one or more LI data 125 by the communication network 100 and delivery of the one or more LI data 125 to the LEA 120.

[0113] The LI ADMF device 130 may control interception of the one or more LI data 125 by an NE device 140 in the communication network 100. The LI ADMF device 130 may control delivery of the one or more LI data 125 from the NE device 134 to a Mediation and Delivery Function (MDF) device 150. The MDF device 150 may then provide the one or more LI data 125 to the LEA.

[0114] While the NE device 140 performs interception of the one or more LI data 125, the NE device 140 generates one or more NE(NE) LI logs 145. The one or more NE LI logs 145 comprise information about usage patters, activities, and / or operations within the NE device 140.

[0115] While the MDF device 150 delivers and / or provides one or more LI data 125, the MDF device 150 generates one or more MDF LI logs 155. The one or more MDF LI logs 155 comprise information about usage patters, activities, and / or operations within the MDF device 150. In particular, the LI ADMF device 130 may control the NE device 140 to deliver the one or more LI data 125 to the MDF device 150. The NE device 140 and the MDF device 150 communicate over a delivery interface 160.

[0116] The delivery interface 160 may be interface X2 162. The interface X2 162 corresponds to LI interfaces internal to the CSP for X2 Intercept Related Information, xIRI, delivery. The interface X2 162 may correspond to interface X2 as defined, for example, by European Telecommunications Standards Institute (ETSI) Technical Specification (TS) 103 221 -2 v1 .13.1 . In particular, the interface X2 162 may be used for delivery of one type of the one or more LI data 125, such as IRI.

[0117] Alternatively, or additionally, the delivery interface 160 is interface X3 163. The interface X3 164 may correspond to interface X3 as defined, for example, by ETSI TS 103 221-2 v1 .13.1 . In particular, the interface X3 164 may be used for delivery of another type of the one or more LI data 125, such as CC.

[0118] The LI ADMF device 130 and the NE device 140 communicate over a first interface. The first interface is an interface X1 171. The interface X1 may correspond to interface X1 as defined, for example, in ETSI TS 103 221 -1 v.13.1. In particular, the interface X1 171 may correspond to LI interfaces internal to the CSP for management tasks.

[0119] Additionally, the LI ADMF device 130 and the NE device 140 communicate over a second interface. The second interface is an interface SYSLOG.The SYSLOG interface is a new interface between the LI ADMF device 130 and the NE device 140. The SYSLOG interface is based on the SYSLOG protocol as defined in Request For Comments (RFC) 5424 The Syslog protocol. The SYSLOG interface is used to transmit the one or more NE LI logs 145 to the LI ADMF device 130.

[0120] Alternatively, or additionally, the LI ADMF device 130 and the NE device 140 communicate over an interface X0 175. The interface X0 175 may correspond to interface X0 as defined, for example, in 3GPP TS 33 127 v18.5.0 clause 5.6 and 5.6.3.2.

[0121] The LI ADMF device 130 and the MDF device 150 communicate over a first interface.

[0122] The first interface is the interface X1 171.

[0123] In an embodiment, the LI ADMF device 140 implements function of an ADMF as defined, for example, in ETSI TS 103 221 -1 v1 .13.1 . In an embodiment, the NE device 140 implements function of a NE as defined, for example, in ETSI TS 103 221-2 v1.6.1. Alternatively, or additionally, the NE device 140 implements function of a Point of Interception as defined, for example, in 3GPP TS 33 127 v 18.5.0.

[0124] In an embodiment, the MDF device 150 implements function of a MDF as defined, for example, in ETSI TS 103 221 -2 v.1.6.1.

[0125] In Figure 2, a flowchart depicting an embodiment of a method 200 is provided. The method 200 is performed by the LI ADMF 130. The method 200 is for aggregating of one or more LI logs 410. The one or more LI logs 410 are related to the target UE identifier 115.

[0126] The method 200 comprises generating 210 a log correlation identifier 310. The log correlation identifier 310 is related to the target UE identifier 115. In other words, the log correlation identifier 310 allows to identify the one or more LI logs 410 related to the target UE identifier 115.

[0127] The method 200 comprises sending 220, over the first interface, a first message 320 to the NE device 140. The first message comprises the log correlation identifier 310. In an embodiment, the first interface is interface X1 171 .

[0128] In an embodiment, the first message 320 is an ActivateTaskRequest. The ActivateTaskRequest correspond to an extended ActivateTaskRequest as defined, for example, in ETSI TS 103 221 -1 v1.13.1 clause 6.2.1. In particular, the ActivateTaskRequest comprises the log correlation identifier 310.

[0129] In an alternative embodiment, the first message 320 is a CreateDestinationRequest. The CreateDestinationRequest correspond to an extended CreateDestinationRequest as defined, for example, in ETSI TS 103 221 -1 v1 .13.1 clause 6.3.1. In particular, the CreateDestinationRequest comprises the log correlation identifier 310.

[0130] The method 200 comprises collecting 230 one or more LI logs 410 related to the target UE identifier 115. The one or more LI logs 410 comprise the log correlation identifier 310. In particular, the one or more LI logs 410 comprising the log correlation identifier 310 correspond to logs related to the target UE identifier 115. In other words, regardless of the NE device intercepting the LI data 125, the log correlation identifier 310 allows to identify the one or more LI logs 410 related to the particular target UE identifier 115. An embodiment of the step 230 of the method 200 is provided in Figure 4.

[0131] In an embodiment, the step of collecting 230 comprises receiving, from the NE device 140, one or more NE LI logs 145 related to the target UE identifier 115 over the second interface. The one or more NE LI logs 145 comprise the log correlation identifier 310. In other words, the one or more NE LI logs 145 are generated by the NE device 140 and labelled with the log correlation identifier 310 so as to identify the one or more NE LI logs 145 related to the target UE identifier 115. In an embodiment, the second interface is the SYSLOG interface 173.

[0132] Alternatively, or additionally, the step of collecting 230 comprises receiving, from the MDF device 150, one or more MDF LI logs 155 related to the target UE identifier over the first interface. The one or more MDF LI logs 155 comprise the log correlation identifier 310. The one or more MDF LI logs 155 related to the target UE identifier 115 received by the LI ADMF device 130 from the MDF device 150 are received by the MDF device 150 over the delivery interface 160. The one or more MDF LI logs 155 may comprise one or more LI data 125 intercepted by the NE device 140, and received by the MDF device 150 over the delivery interface 160. The one or more LI data 125 sent over the delivery interface 160 to the MDF device 150 comprise the log correlation identifier 310. In other words, the one or more MDF LI logs 155 are generated by the MDF device 150 and labelled by the MDF device 150 labelled with the log correlation identifier 310 so as to identify the one or more MDF LI logs 145 related to the target UE identifier 115.

[0133] The one or more LI logs 410 collected by the LI ADMF device 130 comprise the one or more NE LI logs 145, and / or the one or more MDF LI logs 155. As the one or more LI logs 410 comprise the log correlation identifier 310, it enables to aggregate the one or more LI logs 410 based on the log correlation identifier 310.

[0134] The method 200 comprises analysing 240 the collected one or more LI logs 410 based on the log correlation identifier 310.

[0135] In an embodiment, the step of analysing 240 comprises arranging the one or more LI logs 410 based on the log correlation identifier 310. For example, the one or more LI logs 410 comprising the log correlation identifier 310 are grouped together, and another one or more LI logs comprising another log correlation identifier are grouped together. The one or more LI logs 410 may be stored in a look-up table based on the log correlation identifier 310.

[0136] Alternatively, or additionally, the step of analysing 240 may comprise identifying an anomaly in the NE device 140 and / or the MDF device 150 based on the log correlation identifier 310. For example, a machine learning model may be used to identify the anomaly. The machine learning model may be a natural language processing machine learning model.

[0137] The machine learning model may be run by the LI ADMF device 130. Alternatively, the machine learning model may be run on another network device, and the output of the machine learning model is sent to the LI ADMF device 130.

[0138] The machine learning model may be trained with the one or more LI logs 410. The machine learning model may take as input the one or more LI logs 410. The machine learning model may detect the anomaly. The anomaly may be a misconfiguration of the NE device 140. Additionally, or additionally, the anomaly may be that the NE device 140 is not properly intercepting LI data.

[0139] In an embodiment, the method 200 comprises receiving 250, over the first interface, from the NE device 140, a second message 520 reporting an issue related to the target UE identifier 115. The second message 520 comprises the log correlation identifier 310.

[0140] In an embodiment, if the first message 320 is the ActivateTaskRequest, then the second message 520 is a ReportTasklssueRequest. The ReportTasklssueRequest corresponds to an extended ReportTasklssueRequest as defined, for example, in ETSI TS 103 221 -1 v1 .13.1 clause 6.5.2. In particular, the ReportTasklssueRequest comprises the log correlation identifier 310.

[0141] In an alternative embodiment, if the first message 320 is the

[0142] CreateDestinationRequest, then the second message 520 is a

[0143] ReportDestinationlssueRequest. The ReportDestinationlssueRequest corresponds to an extended ReportDestinationlssueRequest as defined, for example, in ETSI TS 103 221-1 v1.13.1 clause 6.5.3. In particular, the ReportDestinationlssueRequest comprises the log correlation identifier 310. In an embodiment, the method 200 comprises configuring 260 the NE device 140 to indicate the one or more NE LI logs 145 related to the target UE identifier 115. The one or more NE LI logs 145 comprise the log correlation identifier 310.

[0144] In an embodiment, the step of configuring 260 comprises sending a configuration message 610 to the NE device 140.

[0145] An embodiment of the configuration message 610 is provided in Figure 7.

[0146] The configuration message 610 may comprise an indication whether to enable or disable sending the one or more NE LI logs 145 related to the target UE identifier 115 to the LI ADMF device 130. The indication may be a Boolean value. For example, the Boolean may be true indicating enabling and / or disable sending the one or more NE LI logs to the LI ADMF device. Alternatively, the Boolean may be false indicating to not enable and / or not disable sending the one or more NE LI logs to the LI ADMF device.

[0147] Alternatively, or additionally, the configuration message may comprise an IP address and port associated with the LI ADMF device 130.

[0148] Alternatively, or additionally, the configuration message may comprise a delivery policy.

[0149] In an embodiment, the configuration message is sent over the interface X0 175.

[0150] The configuration message 610 may correspond to an extended configuration message, such as configuration message defined, for example, in 3GPP TS 33 127 v. 18.5.0 clause 5.6.2.

[0151] In Figure 8, a flowchart depicting an embodiment of a method 800 is provided. The method 800 is performed by the NE device 140. The method 800 is for aggregating of the one or more LI logs 410. The one or more LI logs 410 are related to the target UE identifier 115.

[0152] The method 800 comprises receiving 810, over the first interface, the first message 320 from the LI ADMF device 130. The first message 320 comprises the log correlation identifier 310. The log correlation identifier 310 is related to the target UE identifier 115. The first message 320 of the step 810 of the method 800 corresponds to the first message 310 of the step 220 of the method 200, as described above. The method 800 comprises sending 820 the one or more NE LI logs 145 related to the target UE identifier 115. The one or more NE LI logs 145 comprise the log correlation identifier 310. The one or more NE LI logs 145 received by the LI ADMF device 130 and sent by the NE device 140 correspond to the one or more NE LI logs 145 as described above with relation to method 200.

[0153] The method 800 comprises sending 830 to the MDF device 150 over the delivery interface 160 the one or more LI data 125 intercepted by the NE device 140. The one or more LI data 125 are related to the target UE identifier 115. The one or more LI data 125 sent to the MDF device 150 comprise the log correlation identifier 310. The one or more LI data 125 received by the MDF device 150 and sent by the NE device 140 correspond to the one or more LI data 125 as described above with relation to method 200.

[0154] In an embodiment, the method 800 comprises sending 840, over the first interface, to the LI ADMF device 130, the second message 520 reporting the issue related to the target UE identifier 115. The second message 520 comprises the log correlation identifier 310. The second message 520 of the step 840 of the method 800 corresponds to the second message 520 of the step 250 of the method 200, as described above.

[0155] In an embodiment, the method 800 comprises receiving 850 the configuration message 610 to indicate the one or more NE LI logs 145 related to the target UE identifier 115. The one or more NE LI logs 145 comprise the log correlation identifier 310. The configuration message 610 of the step 850 of the method 800 corresponds to the configuration message 610 of the step 260 of the method 200, as described above.

[0156] In Figure 9, a flowchart depicting an embodiment of a method 900 is provided. The method 900 is performed by the MDF device 150. The method 900 is for aggregating of the one or more LI logs 410. The one or more LI logs 410 are related to the target UE identifier 115. The method 900 comprises receiving 910, from the NE device 140, over the delivery interface, the one or more LI data 125 related to the target UE identifier 115. The one or more LI data 125 comprise the log correlation identifier 310, the log correlation identifier 310 being related to the target UE identifier 115. The one or more LI data 125 correspond of step 910 of the method 900 correspond to the one or more LI data 125 sent by the NE device 140 in the step 830 of the method 800 as described above.

[0157] The method 900 comprises sending 920, to the LI ADMF device 130, over the first interface, the one or more MDF LI logs 155. The one or more MDF LI logs 155 comprise the one or more LI data 125 received in the step 910 of the method 900, and the log correlation identifier 310. The one or more MDF LI logs 155 of the step 920 of the method 900 correspond to the one or more MDF LI logs 155 of the method 200 as described above.

[0158] In Figure 10, an embodiment of the LI ADMF device 130 is provided.

[0159] The LI ADMF device 130 comprises a generating unit 1010. The LI ADMF device 130 comprises a sending unit 1020. The LI ADMF device 130 comprises a collecting unit 1030. The LI ADMF device 130 comprises an analysing unit 1040.

[0160] The generating unit 1010 is configured to cause the LI ADMF device 130 to perform the step 210 of the method 200 as described herein.

[0161] The sending unit 1020 is configured to cause the LI ADMF device 130 to perform the step 220 of the method 200 as described herein.

[0162] The collecting unit 1030 is configured to cause the LI ADMF device 130 to perform the step 230 of the method 200 as described herein.

[0163] The analysing unit 1040 is configured to cause the LI ADMF device 130 to perform the step 240 of the method 200 as described herein.

[0164] In an embodiment, the LI ADMF device 130 comprises a receiving unit 1050. The receiving unit 1050 is configured to cause the LI ADMF device 130 to perform the step 250 of the method 200 as described herein. In an embodiment, the LI ADMF device 130 comprises a configuring unit 1060. The configuring unit 1060 is configured to cause the LI ADMF device 130 to perform the step 260 of the method 200 as described herein.

[0165] In an embodiment, the receiving unit 1050 and the sending unit 1020 are a same unit, such as a transceiver unit.

[0166] The generating unit 1010, the sending unit 1020, the collecting unit 1030, the analysing unit 1040, the receiving unit 1050, and the configuring unit 1060, illustrated in Figure 10, may be implemented as a hardware solution or as a combination of software and hardware, e.g., by one or more of: a processor or a micro-processor and adequate software and memory for storing of the software, a Programmable Logic Device (PLD) or other electronic component(s) or processing circuitry configured to perform the actions described herein with regards to the method 200.

[0167] In Figure 11 , an embodiment of the NE device 140 is provided.

[0168] The NE device 140 comprises a first receiving unit 1110. The NE device 140 comprises a first sending unit 1120. The NE device 140 comprises a second sending unit 1130.

[0169] The first receiving unit 1110 is configured to cause the NE device 130 to perform the step 810 of the method 800 as described herein.

[0170] The first sending unit 1120 is configured to cause the NE device 130 to perform the step 820 of the method 800 as described herein.

[0171] The second sending unit 1130 is configured to cause the NE device 130 to perform the step 830 of the method 800 as described herein.

[0172] In an embodiment, the NE device 130 comprises a third sending unit 1140. The third sending unit 1140 is configured to cause the NE device 130 to perform the step 840 of the method 800 as described herein. In an embodiment, the NE device 130 comprises a second receiving unit 1150. The second receiving unit 1150 is configured to cause the NE device 130 to perform the step 850 of the method 800 as described herein.

[0173] In an embodiment, the first receiving unit 1110 and the second receiving unit 1150 are a same receiving unit.

[0174] In an embodiment, the first sending unit 1120, the second sending unit 1130, and the third sending unit 1140 are a same sending unit.

[0175] In an embodiment, the first receiving unit 1110, the second receiving unit 1150, the first sending unit 1120, the second sending unit 1130, and the third sending unit 1140 are a same unit, such as a transceiver unit.

[0176] The first receiving unit 1110, the first sending unit 1120, the second sending unit 1130, the third sending unit 1140, and the second receiving unit 1150, illustrated in Figure 11 , may be implemented as a hardware solution or as a combination of software and hardware, e.g., by one or more of: a processor or a micro-processor and adequate software and memory for storing of the software, a Programmable Logic Device (PLD) or other electronic component(s) or processing circuitry configured to perform the actions described herein with regards to the method 800.

[0177] In Figure 12, an embodiment of the MDF device 150 is provided.

[0178] The MDF device 150 comprises a receiving unit 1210. The MDF device 150 comprises a sending unit 1220.

[0179] The receiving unit 1210 is configured to cause the MDF device 150 to perform the step 910 of the method 900 as described herein.

[0180] The sending unit 1220 is configured to cause the MDF device 150 to perform the step 920 of the method 900 as described herein.

[0181] In an embodiment, the receiving unit 1210 and the sending unit 1220 are a same unit, such as a transceiver unit. The receiving unit 1210 and the sending unit 1220, illustrated in Figure 12, may be implemented as a hardware solution or as a combination of software and hardware, e.g., by one or more of: a processor or a micro-processor and adequate software and memory for storing of the software, a Programmable Logic Device (PLD) or other electronic component(s) or processing circuitry configured to perform the actions described herein with regards to the method 900.

[0182] In Figure 13, an illustrative example of message exchanges between the LI ADMF device 130, the NE device 140, and the MDF device 150, according to embodiments, is provided.

[0183] The LI ADMF device 130 is configured to send a configuration message 1310. The configuration message 1310 is received by the NE device 140. The configuration message 1310 may correspond to the configuration message 610 sent in the step 260 of the method 200 as described herein. The configuration message 1310 may correspond to configuration message 610 received in the step 850 of the method 800 as described herein.

[0184] The LI ADMF device 130 is configured to send a first message 1320. The first message 1320 is received by the NE device 140. The first message 1320 may correspond to the first message 320 sent in the step 220 of the method 200 as described herein. The first message 1320 may correspond to the first message 320 received in the step 810 of the method 800 as described herein.

[0185] The LI ADMF device 130 is configured to receive a second message 1330. The second message 1330 is received by the LI ADMF device 130. The second message 1330 may correspond to the second message 520 received in the step 250 of the method 200 as described herein. The second message 1330 may correspond to the second message 520 sent in the step 840 of the method 200 as described herein.

[0186] The NE device 140 is configured to send one or more LI data 1340. The one or more LI data 1340 are received by the MDF device 150. The one or more LI data 1340 may correspond to the one or more LI data 125 sent in the step 830 of the method 800 as described herein. The one or more LI data 1340 may correspond to the one or more LI data 125 received in the step 910 of the method 900 as described herein.

[0187] The MDF device 150 is configured to send one or more MDF LI logs 1350. The one or more MDF LI logs 1350 are received by the LI ADMF device 130. The one or more MDF LI logs 1350 may correspond to the one or more MDF LI logs 155 received by the LI ADMF device 130 as described with relation to method 200. The one or more MDF LI logs 1350 may correspond to the one or more MDF LI logs 155 sent in the step 920 of the method 900 as described herein.

[0188] The NE device 140 is configured to send one or more NE LI logs 1360. The one or more NE LI logs 1360 may correspond to the one or more NE LI logs 145 received as described with relation to method 200 as described herein. The one or more NE LI logs 1360 may correspond to the one or more NE LI logs 145 sent in the step 820 of the method 800 as described herein.

[0189] In Figure 14, an embodiment of the LI ADMF device 130 is provided. The LI ADMF device 130 comprises a processor 1410, an da computer readable storage medium 1420 in the form of a memory 1425. The memory 1425 contains a computer program 1430 comprising instructions executable by the processor 1410 whereby the LI ADMF device 130 is operative to perform the steps of the method 200.

[0190] In Figure 15, an embodiment of the NE device 140 is provided. The NE device 140 comprises a processor 1510, and a computer readable storage medium 1520 in the form of a memory 1525. The memory 1525 contains a computer program 1530 comprising instructions executable by the processor 1510 whereby the NE device 140 is operative to perform the steps of the method 800.

[0191] In Figure 16, an embodiment of the MDF device 150 is provided. The MDF device 150 comprises a processor 1610, and a computer readable storage medium 1620 in the form of a memory 1625. The memory 1625 contains a computer program 1630 comprising instructions executable by the processor 1610 whereby the MDF device 150 is operative to perform the steps of the method 900. 1

[0192] The (non-transitory) computer readable storage media mentioned above may be an Electrically Erasable Programmable Read-Only Memory (EEPROM), a flash memory, Field Programmable Gate Array, and a hard drive.

[0193] The processor 1410 of Figure 14, the processor 1510 of Figure 15, and the processor 1610 of Figure 16, may be a single Central Processing Unit (CPU), but could also comprise two or more processing units. For example, the processor 1410 of Figure

[0194] 14, the processor 1510 of Figure 15, and the processor 1610 of Figure 16 may include general purpose microprocessors; instructions set processors and / or related chips sets and / or special purpose microprocessors such as Application Specific Circuits (ASICs). The processor 1410 of Figure 14, the processor 1510 of Figure 15 and the processor 1610 of Figure 16 may also comprise board memory for caching purposes.

[0195] The computer program 1430 of Figure 14, the computer program 1530 of Figure 15, and the computer program 1630 of Figure 16 may be carried by a computer program product connected to the processor 1410 of Figure 14, the processor 1510 of Figure

[0196] 15, and the processor 1610 of Figure 16. The computer program products may be or comprise a non-transitory computer readable storage medium on which thecomputer program 1430 of Figure 14, the computer program 1530 of Figure 15, and the computer program 1630 of Figure 16 are stored. For example, the computer program products may be a flash memory, a Random-Access memory (RAM), a Read-Only Memory (ROM), or an EEPROM, and the computer programs described above could in alternative embodiments be distributed on different computer program products in the form of memories.

[0197] It should be understood that although the terms “first”, “second”, etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, the first message could be termed the second message, and similarly, the second message could be termed the first message.

[0198] As used herein, the term “and / or” includes any and all combinations of one or more of the associated listed terms. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limited of example embodiments. As used herein, the single forms “a”, “an”, and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises”, “comprising”, “has”, “having”, “includes”, and / or “including”, when used herein, specify the presence of stated features, elements, and / or components etc. but not preclude the presence or addition of one or more other features, elements, components, and / or combinations thereof.

[0199] The disclosure has been described above in reference to embodiments thereof. It should be understood that various modifications, alternatives, and additions can be made by those skilled in the art without departing from the scope of the disclosure.

[0200] Therefore, the scope of the disclosure is not limited to the above particular embodiments but only defined by the claims as attached.

Claims

CLAIMS1. A lawful interception, LI, administration function, ADMF, device (130) for aggregating of one or more LI logs (410) related to a target user equipment, UE, identifier (115), the LI ADMF device (130) being configured to:- generate a log correlation identifier (310), wherein the log correlation identifier (310) is related to the target UE identifier (115);- send, over a first interface (171 ), a first message (320) to a network element, NE, device (140), the first message (320) comprising the log correlation identifier (310);- collect one or more LI logs (410) related to the target UE identifier (115), wherein the one or more LI logs (410) comprise the log correlation identifier (310); and- analyse the collected one or more LI logs (410) based on the log correlation identifier (310).

2. The LI ADMF device (130) according to claim 1 , wherein the first interface (171 ) is interface X1 .

3. The LI ADMF device (130) according to claim 2, wherein the interface X1 corresponds to LI interfaces internal to a Communication Service Provider, CSP, for management tasking.

4. The LI ADMF device (130) according to any of claims 1 -3, wherein collecting the one or more LI logs (410) comprises one or more of:- receiving, from the NE device (140), one or more Network Element, NE, LI logs (145) related to the target UE identifier (115) over a second interface (173), wherein the one or more NE LI logs (145) comprise the log correlation identifier (310); and- receiving, from a mediation and delivery function, MDF, device (150), one or more MDF LI logs (155) related to the target UE identifier (115) over the first interface (171 ), wherein the one or more MDF LI logs (155) comprise the log correlation identifier (310).

5. The LI ADMF device (130) according to claim 4, wherein the one or more MDF LI logs (155) comprise one or more LI data (125) intercepted by the NE device (140) and received by the MDF device (140) over a delivery interface (160), wherein the one or more LI data (125) comprise the log correlation identifier (310).

6. The LI ADMF device (130) according to any of claims 4-5, wherein the second interface (173) is a SYSLOG interface.

7. The LI ADMF device (130) according to any of claims 1 -6, is configured to:- receive, over the first interface (171 ), from the NE device (140), a second message (520) reporting an issue related to the target UE identifier (115), wherein the second message (520) comprises the log correlation identifier (115).

8. The LI ADMF device (130) according to any of claims 1 -7, wherein the first message (320) is an ActivateTask request.

9. The LI ADMF device (130) according to any of claims 1 -7, wherein the first message (320) is a CreateDestinationRequest.

10. The LI ADMF device (130) according to claim 7 and 8, wherein the second message (520) is a ReportTasklssueRequest.

11. The LI ADMF device (130) according to claim 7 and 9, wherein the second message (520) is a ReportDestinationlssueRequest.

12. The LI ADMF device (130) according to any of claims 4-11 , is configured to:- configure the NE device (140) to indicate the one or more NE LI logs (145) related to the target UE identifier (115), wherein the one or more NE LI logs (145) comprise the log correlation identifier (310).

13. The LI ADMF device (130) according to claim 12, wherein configuring comprises:- sending a configuration message (610) to the NE device (140), the configuration message (610) comprising: an indication (710) whether to enable or disable sending the one or more NE LI logs (145) related to the target UE identifier (115) to the LI ADMF device (130); an IP address and port (720) associated with the LI ADMF device (130); and / or a delivery policy (730).

14. The LI ADMF device (130) according to claim 13, wherein the configuration message (610) is sent over an interface X0 (175).

15. A network element, NE, device (140) for aggregating of one or more lawful interception, LI, logs (410) related to a target user equipment, UE, identifier (115), the NEdevice (140) being configured to:- receive, over a first interface (171 ), a first message (320) from an LI Administrative Function, ADMF, device (130), the first message (320) comprising a log correlation identifier (310), the log correlation identifier (310) being related to the target UE identifier (115);- send one or more Network Element, NE, LI logs (145) related to the target UE identifier (115) over a second interface (173), wherein the one or more NE LI logs (145) comprise the log correlation identifier (310); and- send, to a mediation and delivery function, MDF, device (140), one or more LI data (125) intercepted by the NE device (140) related to the target UE identifier (115) over a delivery interface (160), wherein the one or more LI data (125) comprises the log correlation identifier (310).

16. The NE device according to claim 15, wherein the first interface (171 ) is interface X1 .

17. The NE device (140) according to claim 16, wherein the interface X1 (171 ) corresponds to LI interfaces internal to a Communication Service Provider, CSP, for management tasking.

18. The NE device (140) according to any one of claims 15-17, wherein the delivery interface (160) is one or more of:interface X2 (162); or interface X3 (164).

19. The NE device (140) according to claim 18, wherein the interface X2 (162) corresponds to LI interfaces internal to the CSP for X2 Intercept Related Information, xIRI, delivery.

20. The NE device (140) according to any of claims 18-19, wherein the interface X3 (164) corresponds to LI interfaces internal to the CSP for X3 Content of Communication, xCC, delivery.

21. The NE device (140) according to any of claims 15-20, wherein the second interface (173) is a SYSLOG interface.

22. The NE device (140) according to any of claims 15-21 , is configured to:- send, over the first interface (171 ), to the LI ADMF device (130), a second message (520) reporting an issue related to the target UE identifier (115), wherein the second message (520) comprises the log correlation identifier (310).

23. The NE device (140) according to any of claims 15-22, wherein the first message (320) is an ActivateTaskRequest.

24. The NE device (140) according to any of claims 15-22, wherein the first message (320) is a CreateDestinationRequest.

25. The NE device (140) according to claim 22 and 23, wherein the second message (520) is a ReportTasklssueRequest.

26. The NE device (140) according to claim 22 and 24, wherein the second message (520) is a ReportDestinationlssueRequest.

27. The NE device (140) according to any of claims 15-26, is configured to:- receive a configuration message (610) to indicate the one or more NE LI logs (145) related to the target UE identifier (115), wherein the one or more NE LI logs (145) comprise the log correlation identifier (310), the configuration message (610) comprising: an indication (710) whether to enable or disable sending the one or more NE LI logs (145) related to the target UE identifier to the LI ADMF device (130); an IP address and port (720) associate with the LI ADMF device (130); and / or a delivery policy (730).

28. The NE device (140) according to claim 27, wherein the configuration message (610) is sent over an interface X0 (175).

29. A mediation and delivery function, MDF, device (150) for aggregating of lawful interception, LI, logs (410) related to a target user equipment, UE, identifier (115), the MDF device (150) being configured to:- receive, from a network element, NE, device (140), over a delivery interface (160), one or more LI data (125) related to the target UE identifier (115), wherein the one or more LI data (125) comprise a log correlation identifier (310), the log correlation identifier (310) being related to the target UE identifier (115); and- send, to a LI administrative function, ADMF, device (130), over a first interface (171 ), one or more MDF LI logs (155), the one or more MDF LI logs (155) comprising the one or more LI data (125) and the log correlation identifier (310).

30. The MDF device (150) according to claim 29, wherein the delivery interface (160) is one or more of:- interface X2 (162); or- interface X3 (164).

31. The MDF device (150) according to claim 30, wherein the interface X2 (162) corresponds to LI interfaces internal to a Communication Service Provider, CSP, for X2 Intercept Related Information, xIRI, delivery.

32. The MDF device (150) according to any of claims 30-31 , wherein the interface X3 (164) corresponds to LI interfaces internal to the CSP for X3 Content of Communication, xCC, delivery.

33. The MDF device (150) according to any of claims 29-32, wherein the first interface (171 ) is interface X1 .

34. The MDF device (150) according to claim 33, wherein the interface X1 corresponds to LI interfaces internal to the CSP for management tasking.

35. A method (200), performed by a lawful interception, LI, administration function, ADMF, device (130), for aggregating of one or more LI logs (410) related to a target user equipment, UE, identifier (115), the method (200) comprising:- generating (210) a log correlation identifier (310), wherein the log correlation identifier (310) is related to the target UE identifier (115);- sending (220), over a first interface, a first message to a network element, NE, device, the first message comprising the log correlation identifier;- collecting (230) one or more LI logs (410) related to the target UE identifier (115), wherein the one or more LI logs (410) comprise the log correlation identifier (310); and- analysing (240) the collected one or more LI logs (410) based on the log correlation identifier (310).

36. The method (200) according to claim 35, wherein the first interface (171 ) is interface X1 .

37. The method (200) according to claim 36, wherein the interface X1 corresponds to LI interfaces internal to a Communication Service Provider, CSP, for management tasking.

38. The method (200) according to any of claims 35-37, wherein collecting (230) the one or more LI logs (410) comprises one or more of:- receiving, from the NE device (140), one or more Network Element, NE, LI logs (145) related to the target UE identifier (115) over a second interface(173), wherein the one or more NE LI logs (145) comprise the log correlation identifier (310); and- receiving, from a mediation and delivery function, MDF, device (150), one or more MDF LI logs (155) related to the target UE identifier (115) over the first interface (171 ), wherein the one or more MDF LI logs (155) comprise the log correlation identifier (310).

39. The method (200) according to claim 38, wherein the one or more MDF LI logs (155) comprise one or more LI data (125) intercepted by the NE device (140) and received by the MDF device (150) over a delivery interface (160), wherein the one or more LI data (125) comprise the log correlation identifier (310).

40. The method (200) according to any of claims 38-39, wherein the second interface (173) is a SYSLOG interface.

41. The method (200) according to any of claims 35-40, the method (200) comprising:- receiving (250), over the first interface (171 ), from the NE device (140), a second message (520) reporting an issue related to the target UE identifier (115), wherein the second message (520) comprises the log correlation identifier (210).

42. The method (200) according to any of claims 35-41 , wherein the first message (320) is an ActivateTask request.

43. The method (200) according to any of claims 35-41 , wherein the first message (320) is a CreateDestinationRequest.

44. The method (200) according to claim 41 and 42, wherein the second message (520) is a ReportTasklssueRequest.

45. The method (200) according to claim 41 and 43, wherein the second message (520) is a ReportDestinationlssueRequest.

46. The method (200) according to any of claims 38-45, the method (200) comprising:- configuring (260) the NE device (140) to indicate the one or more NE LI logs (145) related to the target UE identifier (115), wherein the one or more NE LI logs (145) comprise the log correlation identifier (310).

47. The method (200) according to claim 46, wherein configuring (260) comprises:- sending a configuration message (610) to the NE device (140), the configuration message (610) comprising: an indication (710) whether to enable or disable sending the one or more NE LI logs (145) related to the target UE identifier (115) to the LI ADMF device (130); an IP address and port (720) associated with the LI ADMF device (130); and / or a delivery policy (730).

48. The method (200) according to claim 47, wherein the configuration message (610) is sent over an interface X0 (175).

49. A method (800), performed by a network element, NE, device (140), for aggregating of one or more lawful interception, LI, logs (410) related to a target user equipment, UE, identifier, the method (800) comprising:- receiving (810), over a first interface (171 ), a first message (320) from an LI Administrative Function, ADMF, device (130), the first message (320) comprising a log correlation identifier (310) , the log correlation identifier (310) being related to the target UE identifier (115);- sending (820) one or more Network Element, NE, LI logs (145) related to the target UE identifier (115) over a second interface (173), wherein the one or more NE LI logs (145) comprise the log correlation identifier (310); and- sending (830), to a mediation and delivery function, MDF, device (150), one or more LI data (125) intercepted by the NE device (140) related to the target UE identifier (115) over a delivery interface (160), wherein the one or more LI data (125) comprises the log correlation identifier (310).

50. The method (800) according to claim 49, wherein the first interface (171 ) is interface X1 .

51. The method (800)according to claim 50, wherein the interface X1 corresponds to LI interfaces internal to a Communication Service Provider, CSP, for management tasking.

52. The method (800) according to any one of claims 49-51 , wherein the delivery interface (160) is one or more of:- interface X2 (162); or- interface X3 (164).

53. The method (800) according to claim 52, wherein the interface X2 (162) corresponds to LI interfaces internal to the CSP for X2 Intercept Related Information, xIRI, delivery.

54. The method (800) according to any of claims 52-53, wherein the interface X3 (164) corresponds to LI interfaces internal to the CSP for X3 Content of Communication, xCC, delivery.

55. The method (800) according to any of claims 49-54, wherein the second interface (173) is a SYSLOG interface.

56. The method (800) according to any of claims 49-55, the method (800) comprising:- sending (840), over the first interface (171 ), to the LI ADMF device (130), a second message (520) reporting an issue related to the target UE identifier (115), wherein the second message (520) comprises the log correlation identifier (310).

57. The method (800) according to any of claims 49-56, wherein the first message (320) is an ActivateTaskRequest.

58. The method (800) according to any of claims 49-56, wherein the first message (320) is a CreateDestinationRequest.

59. The method (800) according to claim 56 and 57, wherein the second message (520) is a ReportTasklssueRequest.

60. The method (800) according to claim 56 and 58, wherein the second message (520) is a ReportDestinationlssueRequest.

61. The method (800) according to any of claims 49-60, the method (800) comprising:- receiving (850) a configuration message (610) to indicate the one or more NE LI logs (145) related to the target UE identifier (115), wherein the one or more NE LI logs (145) comprise the log correlation identifier (310), the configuration message (610) comprising: an indication (710) whether to enable or disable sending the one or more NE LI logs (145) related to the target UE identifier (115) to the LI ADMF device (130); an IP address and port (720) associate with the LI ADMF device (130); and / or a delivery policy (730).

62. The method (800) according to claim 61 , wherein the configuration message (610) is sent over an interface X0 (175).

63. A method (900), performed by a mediation and delivery function, MDF, device (150), for aggregating of lawful interception, LI, logs (410) related to a target user equipment, UE, identifier (115), the method (900) comprising:- receiving (910), from a network element, NE, device (140), over a delivery interface (160), one or more LI data (125) related to the target UE identifier (115), wherein the one or more LI data (125) comprise a log correlation identifier (310), the log correlation identifier (310) being related to the target UE identifier (115); and- sending (920), to a LI administrative function, ADMF, device (130), over a first interface (171 ), one or more MDF LI logs (155), the one or more MDF LI logs (155) comprising the one or more LI data (125) and the log correlation identifier (310).

64. The method (900) according to claim 63, wherein the delivery interface (160) is one or more of:- interface X2 (162); or- interface X3 (164).

65. The method (900) according to claim 64, wherein the interface X2 (162) corresponds to LI interfaces internal to a Communication Service Provider, CSP, for X2 Intercept Related Information, xIRI, delivery.

66. The method (900) according to any of claims 64-65, wherein the interface X3 (164) corresponds to LI interfaces internal to the CSP for X3 Content of Communication, xCC, delivery.

67. The method (900) according to any of claims 63-66, wherein the first interface (171 ) is interface X1.

68. The method (900) according to claim 67, wherein the interface X1 corresponds to LI interfaces internal to the CSP for management tasking.

69. A computer program (1430) comprising instructions, which when executed on a Lawful Interception, LI, Administrative Function, ADMF, device (130), causes the LI ADMF device (130) to perform the method (200) according to any of claims 35-48.

70. A computer program (1530) comprising instructions, which when executed on a network element, NE, device (140), causes the NE device (140) to perform the method (800) according to any of claims 49-62.

71. A computer program (1630) comprising instructions, which when execute on a Mediation and Delivery Function, MDF, device (150), causes the MDF device (150) to perform the method (900) according to any of claims 63-68.

72. A computer readable storage medium (1420, 1520, 1620) comprising a computer program (1430, 1530, 1630) according to claim 69, 70, and / or 71.

Images