Lawful Interception Management Function - Intercept Related Information

Description

The Lawful Interception Management Function for Intercept Related Information (LMISF-IRI) is a specialized component within the 3GPP Lawful Interception (LI) architecture, first defined in Release 19 specifications 33.127 and 33.929. It is responsible for managing and delivering Intercept Related Information (IRI), which comprises the signaling and control data associated with a target's communications—such as call setup, session initiation, registration events, and supplementary service activations—as opposed to the actual content of the communication (CC). The LMISF-IRI acts as a mediation and management entity between the network functions that generate IRI (e.g., AMF, SMF, UPF, and other 5G core elements) and the Law Enforcement Monitoring Facility (LEMF).

Architecturally, the LMISF-IRI resides within the Lawful Interception Management Function (LIMF) domain, which is part of the overall LI system in 5G. It interfaces with the ADMF (Administration Function) for provisioning and with the DF (Delivery Function) for transmitting IRI to the LEMF. The LMISF-IRI ensures that IRI is collected, formatted, and delivered according to the standardized HI2 (Handover Interface 2) protocol, which is based on ASN.1 encoding and typically transported over TCP/IP or other secure channels. It supports both national and international LI requirements, including the ability to handle multiple LEMFs and different warrant types.

Key functions of the LMISF-IRI include: managing interception warrants and mapping them to specific targets; correlating IRI from multiple network functions to provide a coherent view of a target's activities; applying privacy and data minimization rules as required by regional regulations; and ensuring reliable, timely delivery of IRI even under network congestion or failures. It also supports the dynamic addition or removal of interception targets without disrupting ongoing sessions.

In 5G networks, the LMISF-IRI must handle the increased complexity of service-based architectures, network slicing, and edge computing. It interacts with the 5G Core (5GC) via the LI_X interfaces (e.g., LI_X1, LI_X2, LI_X3) defined in 3GPP TS 33.127. The LMISF-IRI may be deployed as a standalone entity or integrated with other LI functions, depending on operator preferences and regulatory mandates.

The introduction of LMISF-IRI in Release 19 reflects the ongoing evolution of lawful interception to address new 5G capabilities such as network slicing, multi-access edge computing, and enhanced privacy features. It ensures that law enforcement can maintain effective interception capabilities while respecting user privacy and complying with legal frameworks.

Purpose & Motivation

The LMISF-IRI exists to provide a standardized, efficient, and secure mechanism for delivering Intercept Related Information (IRI) to law enforcement agencies in 5G networks. Prior to its introduction, LI architectures in earlier generations (e.g., 4G) relied on less integrated management functions, which struggled with the distributed and service-based nature of 5G. The LMISF-IRI addresses the need for a centralized management point that can handle the increased volume and variety of signaling data generated by 5G services, including network slicing and edge computing.

It solves the problem of correlating IRI from multiple network functions (AMF, SMF, etc.) and ensuring that only authorized data is delivered to the correct LEMF. It also provides a framework for dynamic warrant management, allowing law enforcement to add or remove targets in real-time without manual reconfiguration. This is crucial in 5G environments where users may move rapidly between slices and access technologies.

Historically, LI in 3GPP has evolved from circuit-switched to packet-switched and now to 5G. The LMISF-IRI represents a maturation of the LI management function, incorporating lessons learned from earlier deployments and aligning with the 3GPP Release 19 focus on enhanced security and privacy. It enables operators to meet regulatory obligations while minimizing impact on network performance and user experience.