UMTS LI Correlation

Description

UMTS LI Correlation (ULIC) is a defined functional entity within the standardized 3GPP Lawful Interception (LI) framework for Universal Mobile Telecommunications System (UMTS) networks, as specified in detail in 3GPP TS 33.108. Lawful Interception is the legally sanctioned process by which authorized law enforcement agencies (LEAs) can monitor and intercept telecommunications traffic and related information of a specified target (subscriber). A critical challenge in LI is that the intercepted data is collected from different points in the network: the content of communications (voice calls, data sessions, SMS) is captured at the media plane, while the associated metadata or Intercept Related Information (IRI—e.g., call setup times, dialed numbers, location updates) is captured from the control plane signaling. These two streams are generated and transported separately.

The ULIC function exists to solve this dissociation problem. It acts as a correlation point, typically located within the network operator's domain at the Mediation Function (MF). The ULIC receives the separate streams of Communication Content (CC) and IRI pertaining to the same interception warrant. Using correlation identifiers—such as the Correlation Number (CN) and the Communication Identity (ComId) which are assigned by the intercepting network elements (like the MSC or SGSN)—the ULIC logic matches each piece of content (e.g., a voice packet flow) with its corresponding IRI events (e.g., the "call started" and "call ended" events). This matching is temporal and identifier-based, ensuring that the LEA receives a synchronized and coherent record. For example, it ensures that the audio recording of a call is delivered to the LEA along with metadata stating who was called, when, and from which cell.

Architecturally, the ULIC is part of the Mediation Function's delivery functionality (MF2). It interfaces internally with other MF components that collect the CC and IRI from the Network Elements (NEs) such as the Mobile Switching Centre (MSC), Serving GPRS Support Node (SGSN), and Gateway GPRS Support Node (GGSN). After correlation, the MF formats the combined information according to standardized Handover Interfaces (HI2 for IRI, HI3 for CC) and delivers it securely to one or more Law Enforcement Monitoring Facilities (LEMFs). The ULIC's operation is crucial for maintaining the legal integrity of the intercept evidence. It must handle complex scenarios like multi-party calls, handovers between network elements, and data sessions with multiple packet data protocol (PDP) contexts, correctly associating all relevant data streams and signaling events for a single target across the duration of the interception warrant.

Purpose & Motivation

The ULIC was created to address a fundamental technical and legal requirement in lawful interception: the provision of a complete, accurate, and auditable record of a target's communications. Without correlation, a law enforcement agency would receive disjointed streams of raw audio/data packets and separate logs of signaling events. Manually piecing these together for a single call or session would be error-prone, time-consuming, and potentially inadmissible in court due to the risk of misassociation. The ULIC automates this precise matching, ensuring the evidence is presented as a unified, comprehensible record that clearly links content with context.

The development of the ULIC function was part of 3GPP's broader effort to standardize Lawful Interception across different generations of mobile technology (starting with GSM, then UMTS, and later EPS/5GS). Prior to such standardization, interception implementations were often vendor-specific and country-specific, making it difficult for operators in regions with strict legal mandates to deploy multi-vendor networks. The standardized correlation mechanism provided by ULIC ensured interoperability between network elements from different suppliers and a consistent evidence format for LEAs. It solved the problem of scalability and reliability in interception for UMTS networks, which introduced more complex packet-switched data services alongside circuit-switched voice, increasing the volume and variety of data that needed correlation.

From a regulatory compliance perspective, the existence of a defined correlation function like ULIC helps network operators demonstrate to national regulators that their interception systems meet the required standards of accuracy and reliability. It is a core component that fulfills the "service-specific details" requirements for UMTS interception. While later 3GPP releases defined similar correlation mechanisms for EPS (ELIC) and 5GS, the ULIC remains the defined solution for 3G UMTS networks, ensuring they can continue to meet lawful interception obligations throughout their operational lifetime. Its creation was motivated by the need for a robust, standardized technical process that upholds the principles of lawful interception while enabling efficient network operations.

Key Features

• Correlates Communication Content (CC) and Intercept Related Information (IRI) streams for a single target
• Uses standardized correlation identifiers (Correlation Number, Communication Identity) for matching
• Resides within the Mediation Function (MF) of the Lawful Interception architecture
• Handles complex scenarios like multi-party calls and session handovers
• Ensures delivery of a synchronized, legally coherent intercept record to law enforcement
• Specific to the UMTS (3G) network technology and its defined network elements (MSC, SGSN)

Evolution Across Releases

Defining Specifications