The IP Multimedia Subsystem (IMS) - · PDF file3 Preface This white paper provides an overview...
Transcript of The IP Multimedia Subsystem (IMS) - · PDF file3 Preface This white paper provides an overview...
The IP Multimedia Subsystem (IMS)
A Verint Systems Technical Brief
January 2007
1
Table of Contents
Preface ....................................................................................................... 3 Acronyms .......................................................................................................................... 3 Terms ............................................................................................................................... 4
Introduction................................................................................................. 6
The Need for Lawful Interception in the IMS Era................................................ 6
IMS Challenges for LI .................................................................................... 7 Arbitrary Access Layer ......................................................................................................... 7 Multiple Functions Involved in the SIP Path............................................................................. 7 Unlimited Applications Potential ............................................................................................ 7 Multiple Dynamic Structured Subscriber Identities ................................................................... 7
IMS Technology............................................................................................ 8 IMS Functional Decomposition .............................................................................................. 8
Control Plane .................................................................................................................. 8 Media Plane .................................................................................................................... 9
Other IMS Architectures....................................................................................................... 9
LI Solutions in the IMS Domain..................................................................... 10 Separate IMS LI Domain .....................................................................................................10 Classical LI Architecture......................................................................................................10 Basic Solution Types for IMS ...............................................................................................11
Guiding Rules.................................................................................................................11 Roamers Coverage..........................................................................................................12 Inter-Network Sessions ...................................................................................................13 Active Solutions..............................................................................................................13 Passive Solutions............................................................................................................15 Hybrid Solutions .............................................................................................................17
Delivery Protocols ..............................................................................................................18
2
Case Studies.............................................................................................. 19 Active Interception Example ................................................................................................19 Passive Interception Example ..............................................................................................20
Summary .................................................................................................. 21
This document contains confidential and proprietary information of Verint Systems Inc. and is protected by copyright laws and related international treaties. Unauthorized use, duplication, disclosure or modification of this document in whole or in part without the written consent of Verint Systems Inc. is strictly prohibited.
By providing this document, Verint Systems Inc. is not making any representations regarding the correctness or completeness of its contents and reserves the right to alter this document at any time without notice.
All marks referenced herein with the ® or TM symbol are registered trademarks or trademarks of Verint Systems Inc. or its subsidiaries. All rights reserved. All other marks are trademarks of their respective owners.
© 2007 Verint Systems Inc. All rights reserved.
ACSTG010107U
3
Preface This white paper provides an overview of Lawful Interception (LI) in the IP Multimedia Subsystem
(IMS) domain. Its intended audiences are Communication Service Providers (CSPs) and LI
practitioners.
Below are lists of useful acronyms and terms related to this topic.
Acronyms
Acronym Description
3GPP Third-Generation Partnership Project
AS Application Server
B2BUA Back to Back User Agent
BGCF Breakout Gateway Controller Function
CDMA Code Division Multiple Access
CS Circuit Switch
CSCF Call Session Control Function
CSP Communication Service Provider
ETSI European Telecommunications Standards Institute
GGSN Gateway GPRS Serving Node
GPRS General Packet Radio Service
GSA Global System Administrator
GSM Global System for Mobile communications
GUI Graphical User Interface
HSS Home Subscriber Server
IMS IP Multimedia Subsystem
IMS MGW IMS Media Gateway
LEA Law Enforcement Agency
LI Lawful Interception
MGC Media Gateway Controller
MGCF Media Gateway Controller Function
MRFC Media Resource Function Controller
MRFP Media Resource Function Processor
4
Acronym Description
NGN Next Generation Networks
PoC Push to talk Over Cellular
PS Packet Switch
SBC Session Border Controller
SDP Session Description Protocol
SGSN Serving GPRS Support Node
SGW Signaling Gateway
SIP Session Initiation Protocol
TISPAN Telecom & Internet converged Services & Protocols for Advanced Networks
UA User Agent
UE User Equipment
UMTS Universal Mobile Telecommunications System
VoIP Voice over IP
WCDMA Wideband
Terms
Term Description
In-bound roamers Subscribers of another CSP roaming in the network
Out-bound roamers Subscribers of our CSP roaming in another network
Session Data The data describing the SIP session containing information extracted from the control data in SIP messages
Session Content The content of the session, such as voice and video
Subscriber Communications The Session Data and Session Content of a particular subscriber session
5
Verint. Powering Actionable Intelligence.® Verint® Systems Inc. (NASDAQ: VRNT) is a leading global provider of analytic software-based
solutions for security and business intelligence. Verint solutions help organizations make sense of the
vast amounts of voice, video and data available to them, transforming this information into actionable
intelligence for better decisions and highly effective performance.
Since 1994, Verint has been committed to developing innovative solutions that help global
organizations achieve their most important objectives. Today, organizations in over 50 countries use
Verint solutions to enhance security, boost operational efficiency and fuel profitability.
6
Introduction The IP Multimedia Subsystem (IMS) has become the leading architecture enabling communication
service providers to offer VoIP and multimedia services. The IMS standards, which were developed by
3GPP and embraced by the European Telecommunications Standards Institute and the Telecom &
Internet converged Services & Protocols for Advanced Networks (ETSI/TISPAN), are now becoming
widely established. These standards have also been adopted by PacketCable, paving the way for
future fixed-mobile convergence and Triple Play services. Designed to work with multiple access types,
such as Global System for Mobile communications (GSM), Wideband (WCDMA), Code Division Multiple
Access (CDMA) 2000, WiMax and Wireline broadband, IMS has become the solution of choice for many
communication service providers as a substantial enabler of growth.
Most communication service providers envision the completion of the technological transition and full
reliance on IMS-based services to be achieved by the end of the decade. However, no one wants to be
late, and IMS currently reigns as the leading choice. Numerous tier 1 communication service providers
are already heavily involved in IMS test trials, while others are in advanced stages of planning and
implementation, gearing up to take their place in this competitive market.
The Need for Lawful Interception in the IMS Era The technological revolution that is taking mobility, connectivity and applications to the next level
does not exclude the LI domain. Although connectivity and the applications that subscribers use have
become more diverse and complex, the basic need for reliable LI and full coverage of all
communication aspects is extremely relevant. As in other LI domains, LI standardization lags behind
the technology standardization. Nevertheless, law enforcement agencies, as well as legislative and
regulatory bodies, require LI solutions for both the near and the long term.
Today’s IMS implementations primarily enable VoIP sessions, such as regular voice calls (PSTN/ISDN
emulation) and Push to talk Over Cellular (PoC). Current non-IMS LI standards deal with the delivery
of intercepted voice calls to enforcement agencies. The current need for an LI solution for IMS stems
from the same voice user experience in both legacy and IMS domains. Law enforcement agencies
acknowledge the different underlying technologies, but call for similar LI measures for obtaining the
required information. In terms of user experience, this information is practically the same. To meet
this requirement, LI standardization bodies are in the process of producing appropriate IMS domain LI
standards.
IMS has promise for seamless multimedia connectivity. Consequently, current and future applications
need to be covered by LI. They are all part of a constantly growing set of personal communications
that could be eligible for interception by the authorities. Law enforcement agencies cannot overlook
these communication methods, which are destined to capture a substantial share of the telecom
market. It is crucial for law enforcement agencies to be able to intercept the data communicated by
these methods so as to acquire the full communications picture surrounding a suspect.
7
As the IMS application landscape grows, LI coverage for these applications will need to follow suit and
to also cover fixed-mobile convergence and Triple Play in the future.
IMS Challenges for LI IMS is a distributed architecture and deals mainly with the session establishment control plane. This
poses significant challenges for LI, as indicated below.
Arbitrary Access Layer An IMS may establish Session Initiation Protocols (SIPs) across multiple access types in a seamless
manner. However, the LI solution must access the actual Session Content irrespective of the access
type and across all session scenarios in order to supply full coverage.
Multiple Functions Involved in the SIP Path The IMS architecture is comprised of a multitude of SIP functional entities, each with a specific role.
Actual systems may aggregate a number of functionalities into one physical box. Different vendors
may aggregate the functionalities in different ways. Furthermore, a deployed system may comprise
multi-vendor parts.
The LI solution must be able to acquire Session Data from all relevant functional entities across
multiple vendors in order to establish a comprehensive session picture to be delivered to the law
enforcement agency.
Unlimited Applications Potential The IMS architecture provides an important benefit as it can sustain growth through additional
applications without changing the underlying session establishment infrastructure. Numerous
applications such as these are envisioned, and some (for example, PoC) are already implemented.
However, each will entail some of its own peculiarities in terms of LI. Even though all application
specific peculiarities cannot be foreseen today, the LI solution architecture must enable incremental
upgrades that will not affect deployed functionality adversely.
Multiple Dynamic Structured Subscriber Identities The rich set of options for subscriber identities in the IMS environment necessitates a modified
paradigm for interception criteria. A sole identity may not be enough, and an LI solution must be able
to intercept relying on all target identities. Moreover, a subscriber may manage his or her identities by
connecting via the Internet to the IMS management infrastructure. This poses unforeseen and
dynamic changes to the set of subscriber identities, of which neither law enforcement agencies nor
communication service providers may be aware in advance.
8
IMS Technology Before going into the exact specifications of practical LI solutions in the IMS domain, a brief
explanation of IMS architecture is needed. This explanation is not intended as an IMS tutorial, and we
will only briefly note the major functional components in the architecture and their respective roles.
IMS Functional Decomposition
Control Plane
The main functional role of IMS architecture is to establish and manage SIP sessions. The main brain
of the IMS architecture is the Serving Call Session Control Function (S-CSCF), which manages the SIP
sessions on behalf of the subscriber. Irrespective of the subscriber state (such as turned on or off,
roaming or busy), an S-CSCF is assigned to the subscriber to manage its session. The S-CSCF is
totally independent of any physical aspects of the subscriber, its communication pattern, its location
and access method.
Figure 1 - IMS Architecture
9
The Proxy Call Session Control Function (P-CSCF) serves as the initial SIP contact point in the IMS
domain; it handles issues, such as security and compression towards the User Equipment (UE). The
UE must find the P-CSCF prior to any registration to the IMS. Different initial underlying access layers
and geographical locations of the UE result in a different accessed P-CSCF.
The Interrogating Call Session Control Function (I-CSCF) serves as the internal and external focal
point for finding other subscribers in the IMS network. Finding the terminating party in each session
involves querying the I-CSCF. I-CSCF accesses the Home Subscriber Server (HSS) and returns the S-
CSCF identity serving the terminating party. This information enables the establishment of the SIP
session.
The HSS holds all subscriber data relevant for the IMS session management: identities, service
profiles and so on. The HSS plays a similar role for the HLR in GSM networks.
The IMS enables multiple Application Servers (AS) to be connected to the infrastructure. The
Multimedia Resource Function Controller (MRFC) and its associated Media Resource Function Processor
(MRFP) are considered as an AS. Their role is to provide conferencing and announcement services.
Many other Application Servers, such as a PoC server and a Messaging server, can be attached.
To interface to the Circuit Switch (CS) domain, the IMS incorporates a number of functions that deal
mainly with signaling media translation and transformation. These include the Breakout Gateway
Controller Function (BGCF), the Media Gateway Controller Function (MGCF), the IMS Media Gateway
(IMS-MGW) and the Signaling Gateway (SGW).
A typical session setup scenario takes place along the following lines. Subscriber A, who is connected
to a P-CSCF, sends an INVITE message to subscriber B. The message reaches the S-CSCF associated
with subscriber A. The S-CSCF interrogates the I-CSCF as to the S-CSCF of subscriber B. Then, the I-
CSCF forwards the INVITE to the S-CSCF associated with subscriber B, which in turn sends it to the P-
CSCF to which subscriber B is attached. Once this path is established, regular SIP session
establishment procedures can take place.
Media Plane
The IMS is defined mostly in terms of its control plane, leaving the media plane to take almost any
form. These forms can be Universal Mobile Telecommunications System Packet Switch (UMTS PS)
access, fixed Next Generation Networks (NGN) access, CDMA2000 access or Internet access. For the
near term, the vision is for the IMS to be connected mostly with the UMTS PS access, that is, with the
Serving GPRS Support Node/Gateway GPRS Serving Node (SGSN/GGSN) backbone.
Other IMS Architectures Besides 3rd Generation Partnership Project (3GPP), other technical bodies rely on IMS as their core
session management infrastructure. Notably, TISPAN, PacketCable and 3GPP2 have already adopted
IMS with appropriate modifications.
10
LI Solutions in the IMS Domain
Separate IMS LI Domain The scope of IMS domain interception is separate from other domains of interception. Each
interception domain must be supported separately, resulting in separate and appropriate LI standard-
compliant delivery to the law enforcement agency.
For example, a communication service provider with UMTS deployed technology might have an
SGSN/GGSN access infrastructure and IMS. The difference between the access level interception and
the application level interception is clearly evident in this case. Interception at the SGSN/GGSN
(access) level produces the entire IP stream of the subscriber, while interception at the IMS
(application) level produces only the IMS SIP oriented sessions of the subscriber. Accordingly, 3GPP
33.108 specifies the LI delivery standard for the UMTS PS domain, while ETSI DTS/LI-00024 specifies
the LI delivery standard for the IMS domain.
A communication service provider that needs to support LI in both domains must support both
delivery standards separately. Note that the law enforcement agency receiving intercepts from both
domains may be getting IMS traffic through both delivery mechanisms: once from the access level and
once from the application level. This is a common situation whenever delivery to a law enforcement
agency requires multiple interception overlapping domains.
Classical LI Architecture Before going into the details of IMS interception architectures, a brief explanation of classical LI
architecture is required. As depicted in Figure 2, the western world LI paradigm involves two legally
separated organizations. One is a law enforcement agency, responsible for requesting the interception
of the communications of a specific subscriber, and the other is a communication service provider,
responsible for providing the subscriber’s intercepted data.
Figure 2 - LI General Architecture
11
The LI standardization bodies deal with the exact specification of the mechanisms of intercepted data
and delivery protocols from the communication service providers to the law enforcement agencies.
These standards basically define a similar set of functional entities for the accomplishment of the LI
procedures, as depicted in Figure 2.
The communication service provider is responsible for the LI Access Function and the Mediation
Function. The role of the LI Access Function is to extract subscriber communications for Call/Session
Control information (Call/Session Data) and Call/Session Content information. These communications
are sent to a Mediation Function. The Mediation Function is responsible for the translation of
communication into the appropriate format, according to the LI delivery standard, and for its
distribution to multiple law enforcement agencies. The law enforcement agencies are considered a
Collection Function and are responsible for accepting all information sent from the communication
service providers via the LI delivery standard.
Basic Solution Types for IMS In general, all LI solutions can be categorized as either active or passive. Active solutions rely on
network elements (LI Access functions in Figure 2) to support an LI interface protocol stack through
which the Mediation Function can access the subscriber’s communications. The LI interface is usually
proprietary to the vendor.
Passive solutions rely on passive tapping devices placed at strategic positions in the communication
pathways at the communication service provider. They enable the capture of subscriber
communications. There is no active interaction with any part of the network.
Both the active and passive LI solutions are designed not to interfere with a subscriber’s actual
communications. In the active solution, the network element vendor is responsible for the transparent
interception. In the passive solution, the nature of the tapping devices ensures the same objective.
Guiding Rules
The IMS architecture produces a number of insights affecting LI solutions:
• Every originating or terminating subscriber SIP session always travels through an S-CSCF in the subscriber’s home network.1 This includes out-bound roamers.
• In-bound roamer SIP traffic will only traverse a P-CSCF in the roamed network.2
• AS servers entail special information that is application specific.
1 The case of emergency calls is an exception. The call will be placed through an S-CSCF in the roamed network so
as to provide the emergency service on a geographical basis. 2 This pertains to the case of roaming agreements at the IMS level between two CSPs. If the roaming agreement is
on the access level only (for example, GPRS), the session goes from the SGSN in the roamed network (where interception takes place), to the GGSN in the home network. Such a session does not need to be intercepted at the IMS domain in the roamed network, but rather in the PS domain.
12
These insights enable us to establish a number of general guiding rules for the LI solutions:
• All S-CSCFs in the network must be accessed to provide information since all SIP sessions traverse at least one S-CSCF.
• All P-CSCFs in the network must be accessed to provide information since in-bound roamer SIP sessions do not necessarily traverse any of the S-CSCFs in the roamed network.3
• All AS in the network must be accessed to provide information since they can act as User Agents (UAs) by themselves, terminate sessions, and perform various tasks that are beyond the basic infrastructure of the IMS.
Roamers Coverage
Since all SIP traffic traverses the home network, Session Data of out-bound roamers can always be
accessed in the home network for both roaming agreement types — IMS roaming agreements (see
Figure 3a), and access roaming agreements (see Figure 3b). Note that in Figure 3, the SIP paths
(denoted in red lines) always traverse the intercepted network (denoted in cyan).
However, in such cases, Session Content cannot be accessed. If the roaming model supports roaming
at the IMS service level (Figure 3a), the serving GGSN and P-CSCF would be in the roamed network.
The LI function in the home network will have no access to the Session Content (in Figure 3a the
green line does not traverse the intercepted network). 4
Figure 3 - Different Roaming Agreements
3 See footnote 2. 4 If the session associate belongs to the same IMS home network and is not out-bound roaming (that is, CSP B and
CSP C merge in Figure 3(a)), then it is possible for the associate’s side to access Session Content.
13
Alternatively, if the roaming model is at the access level — for example, GPRS — as shown in Figure
3b, then the Session Content is bound to traverse a GGSN in the home network. This enables access
to the Session Content for all of the target sessions irrespective of the location of the associate.
Inter-Network Sessions
The LI solution needs to address the cases in which session parties are off-network. There are a
number of such cases and solutions, as follows:
Case 1: The target is in the network and talks to an off-network associate.
Solution 1: Content is accessible since the target is in the network.
Case 2: An out-bound roaming target talks to an off-network associate.
Solution 2: Content is accessible if the target roams under an access level roaming
agreement (see Roamers Coverage).
Case 3: An off-network associate is redirected to a service (for instance, voice mail) on behalf
of the target.
Solution 3: Content is accessible since the service is in the network.
Case 4: An off-network associate is redirected to another off-network subscriber on behalf of
the target.
Solution 4: Content may not be accessible depending on the type of redirection.
In all these cases, there is an S-CSCF associated with the target, and it is involved in the SIP path.
This is even true when the UE is turned off and incoming calls need to be handled. Consequently, in
these cases, accessing the S-CSCF provides access to Session Data.
From the above we see that accessing the Session Content depends on the content’s path.
Active Solutions
In an active solution, the IMS functional entities serve as the LI Access Functions which support an
active interface. The underlying assumption is that the physical platforms incorporating the IMS
functional entities support an active interface.
14
Figure 4 - Active Interception Solution
The Mediation Function interfaces with all P-CSCFs, S-CSCFs, and AS in the network, as shown in
Figure 4.
Other functional entities need not necessarily be interfaced since all SIP traffic coverage can be
handled by these functions alone. Nevertheless, some vendors may provide LI interfaces to additional
functional entities. These interfaces towards additional functional entities may provide LI information
that compensates for the possible lack of information coming from the S-CSCFs, P-CSCSFs, and AS.
Once the communication service provider is bound to provision a new IMS target, it must collect the
entire set of private and public target identities via its IMS management interface (for example, GUI).
As a target may use any of its public identities, the entire identity set is needed. This set will be
provisioned to all abovementioned functional entities. Provisioning the target to all platforms is the
prevailing provisioning method in wireless systems. This provisioning mode covers all S-CSCF
allocation possibilities, as follows:
• The target may have a pre-defined S-CSCF.
• The S-CSCF may be allocated to the target dynamically when registering based on the required capabilities.
• The pre-defined S-CSCF may be malfunctioning or inaccessible resulting in a new allocated S-CSCF for a specific session.
The provisioning also covers all the associations of a roaming target in any of the available P-CSCFs in
the network as well as the invocation of any application. Once the target is provisioned, the IMS
entities intercept all SIP traffic, and the relevant Session Data information is sent to the LI Mediation
Function.
15
In order to also acquire the content of the intercepted session, two methods can be applied. The first
method relies on the vendor to incorporate some proprietary LI intra-IMS protocol between its
platforms (SIP control and media platforms). This enables entities such as the S-CSCF to control and
command the content pathways that will be duplicated towards the Mediation Function.
To achieve this, the session can be set up either through a conference device (for example, MRFC) for
which the Mediation Function is a silent member, or through direct control of media resources in the
access network. In the latter method, content is duplicated and sent to the Mediation Function without
affecting the original path (for example, by mirroring traffic in various IP switching devices).
The second method relies on the functional entities to supply the Session Data and the SDP
information with the appropriate media IP addresses and port to the Mediation Function. The
Mediation Function uses these IP addresses to acquire the Session Content from the access layer. It
provisions, in real time, the appropriate access device for sending the target traffic towards the
Mediation Function. Once the session ends, the Mediation Function provisions the access device to
stop sending the Session Content.
A key aspect of handling the Session Data and Content in the Mediation Function is the correlation
between the two. In the first method, the IMS elements provide a unique system-wide ID that enables
the Mediation Function to correlate the Session Data instances between themselves and the Session
Content. In the second method, the IMS elements still provide a similar unique ID for Session Data
instance correlation but the Mediation Function correlates the Session Content on its own using the
SDP information (IP address and port).
The Mediation Function transforms the information acquired actively from the IMS infrastructure
(Session Data and Content), and delivers and distributes it to the Law enforcement agencies using the
appropriate delivery standard.
Passive Solutions
Passive solutions do not involve the IMS at all in the acquisition of Session Data and Content. Passive
taps are placed at various strategic places in the network to acquire the data. These tapping devices
serve as the LI Access Functions. Naturally, the number of tap points needs to be as few as possible.
The main differences between active and passive solutions are the methods of acquisition and the
correlation between the Session Data and Session Content.
Using the guiding rules described in the section Guiding Rules, the tapping points need to cover all
traffic to and from the entire set of P-CSCFs, S-CSCFs, and AS (see Figure 5).
16
Figure 5 - Passive Interception Solution
The tapping devices, which sniff bare IP, are provisioned to deliver only SIP traffic to the Mediation
Function. Provisioning is for all tapping devices using the target identities set, as in the active case.
To access the Session Content, tapping devices are placed at the access infrastructure in the home
network. The actual acquisition of the Session Content is accomplished in two stages. Firstly, the IP
address and port of the Session Content is extracted from the sniffed SIP traffic of the target. Then,
the tapping device covering this IP address at the access layer is commanded to filter the traffic of this
specific IP address and to deliver it to the Mediation Function.
Unlike the active solution, the Mediation Function is responsible for correlating the Session Data
instances (SIP messages in this case) between themselves and the Session Content. The Mediation
Function uses the IMS Correlation ID (ICID) to correlate the Session Data instances. The ICID is
generated by the first SIP control function in the IMS which encounters a new session. It is
propagated henceforth in all SIP messages pertaining to that session.
The Session Content is correlated explicitly to the Session Data using the session IP address and port
(acquired from the SIP messages) to filter the IP traffic at the access layer.
17
Hybrid Solutions
Real IMS systems may involve equipment from a number of vendors. Not all vendors may support
active LI interfaces. In these cases, a hybrid solution is necessary. IMS functionalities, which have an
active LI interface, provide Session Data and Session Content directly. Tapping devices are placed
accordingly to access all missing information following the guidelines described previously in the
sections Active Solutions and Passive Solutions. The most probable case may be where one vendor
provides an LI relevant core IMS infrastructure (for example, P-CSCF and S-CSCF) and another vendor
provides the access infrastructure. In many cases, these access devices need to be tapped. For the
IMS platforms, most vendors will probably introduce active LI interfaces. Therefore, active access to
Session Data and passive access to Session Content are expected to be quite common. This does not
exclude other combinations, as well.
Another hybridization concept worth mentioning is that of vendors leveraging existing platforms for
IMS utilization. One example is the Session Border Controller (SBC). Besides its current popular role
as Back to Back User Agent (B2BUA) and security enforcer, it may include P-CSCF functionality and
more. In general, solutions with a soft switch (meaning I/S-CSCF or AS), SBC (meaning P-CSCF), and
with the addition of the complementary SIP functionalities can be expected, especially in the near
term.
18
Delivery Protocols A number of delivery protocols between communication service provider and law enforcement agency
are standardized for the IMS domain, as follows:
3GPP 33.108 / ETSI TS 133 108
This is the current delivery standard for the UMTS domain. Note that although the standard requires
the delivery of all SIP messages pertaining to the target’s session as ASN.1 (BER) messages over
TCP/IP, Session Content consists of all bare IP target traffic and is delivered as an encapsulated
stream over UDP. In addition, the standard explicitly enables the sending of P-CSCF and S-CSCF
information to the LEA resulting in duplication of information.
PacketCable 2.0
As of this writing, the PacketCable standard is still not finalized, but work is progressing vigorously,
and most aspects are defined. Session Data is delivered as ASN.1 (BER) messages over TCP/IP.
Session Content is delivered as RTP (and may be also T.38 for fax, or similar) and is encapsulated in
UDP with the addition of a correlation header.
TIA-1066
This is the US CDMA2000 VoIP LI standard. The standard utilizes another US standard, T1.678, which
is intended for the VoIP fixed NGN domain. Session Data is delivered towards the LEA as ASN.1 (BER)
messages over TCP/IP, while Session Content is delivered as encapsulated traffic over UDP.
ETSI DTS/LI-00024
The standardization process for a general IP multimedia LI standard in ETSI is in progress. Session
Data and Content are delivered towards the LEA as ASN.1 (BER) messages.
TISPAN DTS-07013
The standardization process for IMS interception delivery in TISPAN is in progress. For the purpose of
delivery, the above mentioned ETSI standard is to be used.
19
Case Studies A myriad of case studies could be shown in various communication domains. But, for the sake of
simplicity, we will consider some realistic examples of a fixed network.
Active Interception Example Figure 6 shows the IMS infrastructure at the communication service provider. There is an access layer
that connects the subscriber’s UE, an IMS core layer that supplies the session management and
subscriber profile management, and an application layer that consists of a number of AS (basically soft
switches).
These various elements support an active LI interface. For brevity, these are not shown in Figure 6.
The elements include the AS and CSCFs for Session Data and the SBCs and MGW for Session Content.
When the communication service provider requires a new warrant to be intercepted for a specific
target, the target identity and all associated parameters are provisioned through the Mediation
Device’s administrator console. In this case, the Mediation Device is Verint’s STAR-GATE™ product,
whereas the administrator console is the GSA. The target is provisioned to the AS, CSCFs, SBCs and
MGW. Once a session is set up in the network on behalf of the target, the AS and CSCFs report
Session Data (denoted as red lines in Figure 6), and the SBCs and MGW convey Session Content
(denoted as blue lines in Figure 6) towards the Mediation Function.
Figure 6 - Active IMS Interception in a Fixed Network
The Mediation Function translates the Session Data and Content to a specific delivery standard format
and delivers and distributes the session to the law enforcement agencies.
20
Passive Interception Example Figure 7 shows the same network depicted in Figure 6, but the network elements do not support an
active LI interface.
Figure 7 - Passive IMS Interception in a Fixed Network
Tapping devices are placed in strategic places in the network. We show only a handful of devices
placed over some connections (denoted in purple). Some of the tapping devices are placed so as to
capture session control traffic. Taps are placed between AS and CSCF and between CSCF and MGC.
Other taps are placed for capturing the Session Content between SBC and the access server, and
between SBC and MGW. All tap devices are connected to an IP sniffing device (Verint’s IP-Probe),
which filters only relevant traffic and feeds it into the Mediation Device.
As in the active case, the administrator’s console (GSA) is used to provision the target. The target
information is propagated to the Mediation Device, but unlike the active case, the target is now
provisioned to the IP-Probe. Since passive taps are placed in the system, the IP-Probe is provisioned
with the target identifiers to be filtered out of the general traffic.
As in the active case, the Mediation Function translates the Session Data and Content to a specific
delivery standard format and delivers and distributes the session to the law enforcement agencies.
21
Summary The IMS is an extremely versatile platform enabling communication service providers a substantial
opportunity for growth by offering new multimedia services. This communication technology poses
new challenges for the LI domain yet these challenges can be readily met and overcome by careful
analysis and planning.
The two basic modes of LI, active and passive solutions, are applied to the IMS domain and shown to
produce viable interception architectures. These solutions cover all aspects of LI Session Data and
Content, roaming models, inter/intra-network sessions, and delivery standards. Although the IMS
serves in numerous communication domains, such as UMTS, PacketCable and TISPAN, its invariance
to the access layer also enables a modular LI solution structure that can be readily upgraded or
tailored, as necessary.
STAR-GATE active and passive architectures provide solutions for virtually all communication domains.
This technical brief showed two specific examples in the fixed domain. Current STAR-GATE
deployments in all communication domains can be upgraded to support IMS interception using the
same GSA console and mode of operation, while new installations can also benefit from these
solutions.