SIST-TP TR 101 750 V1.1.2:2004

• Abstract:

  Liaison and studies into the impact of lawful interception on TIPHON and TIPHON access networks. This shall include the following specific tasks: Review of IUR, CALEA and ETR 331 to assess applicability to TIPHON and report findings to TC-SEC-L1 in addition to EP-TIPHON; Review of TIPHON access networks to determine capability to support L1 requirement; Act as primary liaison with TC-SEC-L1 during development of packet data handover interface ensuring that it is suited to TIPHON.

• Status: Published
• Publication Date: 31-Mar-2004
• ICS: 33.020 - Telecommunications in general
• Technical Committee: SPN - Services and Protocols for Networks
• Current Stage: 6060 - National Implementation/Publication (Adopted Project)
• Start Date: 01-Apr-2004
• Due Date: 01-Apr-2004
• Completion Date: 01-Apr-2004
• Ref Project: ETSI TR 101 750 V1.1.2 (2002-01) - Telecommunications and Internet Protocol Harmonization Over Networks (TIPHON); Requirements Definition Study; Studies into the Impact of lawful interception

SIST-TP TR 101 750 V1.1.2:2004 is the Slovenian identical adoption of ETSI TR 101 750 V1.1.2, a Technical Report on lawful interception in TIPHON networks. It studies how lawful interception affects TIPHON and TIPHON access networks, with emphasis on the IP side, the LEA user requirements, and the handover arrangements needed to deliver interception results to an LEA. It is aimed at network operators, access providers, service providers, and designers who need to assess how TIPHON systems can support lawful interception under national law.

What does SIST-TP TR 101 750 V1.1.2:2004 specify?

SIST-TP TR 101 750 V1.1.2:2004 sets out a pre-study of the impact of lawful interception on TIPHON compliant systems. Its scope covers liaison and study work, including review of IUR, CALEA, and ETR 331, review of TIPHON access networks for L1 capability, and liaison with TC-SEC-L1 during development of the packet data handover interface.

The document focuses on lawful interception in an IP network. Lawful interception on the SCN side is treated as already covered elsewhere and is outside the document’s focus.

The document is organized into these main clauses:

• Scope
• References
• Definitions and abbreviations
• General introduction
• User (LEA) requirements for Lawful Interception
• TIPHON scenarios and role model
• Further work

What are the key requirements of SIST-TP TR 101 750 V1.1.2:2004?

SIST-TP TR 101 750 V1.1.2:2004 describes what a TIPHON system should support so that lawful interception can be delivered to an LEA while protecting service operation and confidentiality.

• Clause 5.1 requires the NWO/AP/SP to intercept the traffic covered by a lawful authorization and to exclude traffic outside that authorization. In practice, the operator must apply interception only to the named target service and identify each result of interception clearly.
• Clause 5.2 requires delivery of the content of communication and intercept related information (IRI), including call attempts, successful calls, status changes, service changes, location changes, timestamps, and related identities. This means the interception output has to be rich enough for investigations, not just audio or data.
• Clause 5.3 covers location information in several forms, including current geographic, physical, or logical location. In practice, the system must be able to supply location data whether or not a call is active, if national requirements demand it.
• Clause 5.4 requires cooperation from the moment commercial service starts and real-time or near real-time delivery after lawful authorization. If buffering is used, the LEA must be able to force delivery by emptying the buffers.
• Clause 5.6 requires delivery through a handover interface, protection against unauthorized access, authentication, possible encryption, and tamper-proof recording of activation and use. This matters because interception functions must be controlled, traceable, and protected from misuse.
• Clause 5.8 requires interception to be invisible to users and to avoid changing service operation or Quality of Service (QoS). In practice, the target and other users should not detect the interception.
• Clause 5.9 to 5.13 cover the interface, format, identification, and multiple interception measures. The document requires unique association of each target with a handover interface instance, generally available output formats, en clair delivery where needed, and support for concurrent interceptions of the same identity.

Clause 6 limits the study to cases where interception takes place on the IP side of the communication. That means the document is about TIPHON IP interception scenarios, not SCN-side interception.

What terms does SIST-TP TR 101 750 V1.1.2:2004 define?

• Access Provider (AP): the party that gives a user access from the terminal to the network.
• Handover Interface: the physical and logical interface where interception results are delivered to the LEMF.
• Intercept Related Information (IRI): information associated with telecommunications service activity, such as call-related, service-related, and location information.
• Law Enforcement Agency (LEA): the organization authorized by law to receive interception results.
• Law Enforcement Monitoring Facility (LEMF): the destination facility that receives the interception results for a target subject.
• Target Identity (TI): the identity associated with the target service used for interception.
• Result of interception: the information passed to the LEA, including content of communication and IRI.

Who uses SIST-TP TR 101 750 V1.1.2:2004?

SIST-TP TR 101 750 V1.1.2:2004 is used by TIPHON implementers, network operators, access providers, and service providers when planning lawful interception support. It is also relevant to LEA and security groups when checking whether a proposed TIPHON/IP architecture can deliver interception results, preserve confidentiality, and support required handover arrangements.

Which standards are used with SIST-TP TR 101 750 V1.1.2:2004?

The document refers to these companion and background documents:

• ETSI ES 201 158 - requirements for network functions involved in lawful interception.
• ETSI ES 201 671 - the lawful interception handover interface.
• ETSI ETR 331 - user requirements for lawful interception from the LEA perspective.
• ITU-T Recommendation H.323 - packet-based multimedia communications systems used for the TIPHON voice and multimedia context.
• ETSI TR 101 300 - technical issues and TIPHON scenarios used as a reference for the IP-side study.
• Council Resolution 96/C329/01 - the European lawful interception policy reference used for the LEA requirements.

What does the SIST-TP TR 101 750 V1.1.2:2004 document contain?

The document contains a definitions section, a detailed list of LEA-oriented lawful interception requirements, and a TIPHON scenario and role model section. It also includes a functional block diagram and a table of functional components showing the roles of IIF, INI, mediation function, and delivery paths to the LEA/LEMF.

For engineering work, the most useful parts are the requirement lists in Clause 5 and the TIPHON model in Clause 6. For implementation planning, these sections help identify what must be intercepted, how results are handed over, and where the internal interception and network interfaces fit into the architecture.

SLOVENSKI STANDARD
01-april-2004
Harmonizacija telekomunikacij in internetnega protokola prek omrežij (TIPHON) -
Študija definicije zahtev - Študija vpliva zakonitega prestrezanja
Telecommunications and Internet Protocol Harmonization Over Networks (TIPHON);
Requirements Definition Study; Studies into the Impact of lawful interception
Ta slovenski standard je istoveten z: TR 101 750 Version 1.1.2
ICS:
33.020 Telekomunikacije na splošno Telecommunications in
general
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

Technical Report
Telecommunications and Internet Protocol
Harmonization Over Networks (TIPHON);
Requirements Definition Study;
Studies into the Impact of lawful interception

2 ETSI TR 101 750 V1.1.2 (2002-01)

Reference
RTR/TIPHON-08001a
Keywords
IP, network, security, VoIP
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE

Tel.: [phone]  Fax: [phone]

Siret N° 348 623 562 00017 - NAF 742 C
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° 7803/88

Important notice
Individual copies of the present document can be downloaded from:
http://www.etsi.org
The present document may be made available in more than one electronic version or in print. In any case of existing or
perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF).
In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive
within ETSI Secretariat.
Users of the present document should be aware that the document may be subject to revision or change of status.
Information on the current status of this and other ETSI documents is available at
http://portal.etsi.org/tb/status/status.asp
If you find errors in the present document, send your comment to:
[e-mail]
Copyright Notification
No part may be reproduced except as authorized by written permission.
The copyright and the foregoing restriction extend to reproduction in all media.

© European Telecommunications Standards Institute 2002.
All rights reserved.
ETSI
3 ETSI TR 101 750 V1.1.2 (2002-01)
Contents
Intellectual Property Rights.4
Foreword.4
Introduction .4
1 Scope.5
2 References.5
3 Definitions and abbreviations.5
3.1 Definitions.5
3.2 Abbreviations.8
4 General introduction.8
5 User (LEA) requirements for Lawful Interception.9
5.1 General requirements.9
5.2 Result of interception .10
5.3 Location information.10
5.4 Time constraints.11
5.5 Non disclosure.11
5.6 Information transmission and information protection requirements .11
5.7 Internal security.12
5.8 Unchanged state of service, etc. .12
5.9 Technical interface(s) and format requirements .12
5.10 Independence of the Network Operator/Access Provider/Service Provider.13
5.11 Temporary obstacles to transmission .13
5.12 Identification of the identity to be intercepted.13
5.13 Multiple interception measures.14
6 TIPHON scenarios and role model .14
6.1 TIPHON scenarios.14
6.2 Functional block diagram.14
7 Further work.16
History .17

ETSI
4 ETSI TR 101 750 V1.1.2 (2002-01)
Intellectual Property Rights
IPRs essential or potentially essential to the present document may have been declared to ETSI. The information
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found
in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in
respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web
server (http://webapp.etsi.org/IPR/home.asp).
Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee
can be given as to the existence of other IPRs not referenced in SR 000 314 (or the updates on the ETSI Web server)
which are, or may be, or may become, essential to the present document.
Foreword
This Technical Report (TR) has been produced by ETSI Project Telecommunications and Internet Protocol
Harmonization Over Networks (TIPHON).
Introduction
The present document has been produced by ETSI Project TIPHON of the European Telecommunications Standards
Institute (ETSI) in close alliance with the ad-hoc group for TIPHON Security of ETSI Technical Committee Security
(TC-SEC) and the Lawful Interception Working Group of TC-SEC.
ETSI
5 ETSI TR 101 750 V1.1.2 (2002-01)
1 Scope
The present document describes the user (Law Enforcement Agencies) requirements for Lawful Interception and the
impact in a TIPHON Implementation. It provides an abstract of the requirements [6], [3] and outlines a study on the
impact of Lawful Interception for TIPHON compliant systems.
The provision of lawful interception on the SCN part of a TIPHON network is already generally addressed and is not
considered in the present document. The present document does consider lawful interception in an IP network.
NOTE: The present document is a pre-study to identify the impact of lawful interception and therefore should
lead to a subsequent document which specifies a TIPHON system compliant mechanism to permit the
provision of lawful interception according to national law and appropriate standards.
The provision of lawful interception is a requirement of national law, which is usually mandatory. From time to time, a
network operator/access provider/service provider shall be required, according to a lawful authorization, to make
available results of interception, relating to specific target identities, to a specific Law Enforcement Agency.
2 References
For the purposes of this Technical Report (TR) the following references apply:
[1] ETSI ES 201 158: "Telecommunications Security; Lawful Interception (LI); Requirements for
network functions".
[2] ETSI ES 201 671: "Telecommunications security; Lawful Interception (LI); Handover interface
for the lawful interception of telecommunications traffic".
[3] ETSI ETR 331: "Security Techniques Advisory Group (STAG); Definition of user requirements
for lawful interception of telecommunications; Requirements of the law enforcement agencies".
[4] ITU-T Recommendation H.323: "Packet-based multimedia communications systems".
[5] ETSI TR 101 300: "Telecommunications and Internet Protocol Harmonization Over Networks
(TIPHON); Description of technical issues".
[6] Official Journal of the European Communities 96/C329/01: "Council Resolution of 17 January
1995 on the lawful interception of telecommunications".
3 Definitions and abbreviations
3.1 Definitions
For the purposes of the present document, the following terms and definitions apply:
Access Provider (AP): provides a user of some network with access from the user's terminal to that network
NOTE 1: This definition applies specifically for the present document. In a particular case, the access provider and
network operator may be a common commercial entity.
NOTE 2: The definitions from ETR 331 [3] have been expanded to include reference to an access provider, where
appropriate.
(to) buffer: temporary storing of information in case the necessary telecommunication connection to transport
information to the LEMF is temporarily unavailable
ETSI
6 ETSI TR 101 750 V1.1.2 (2002-01)
call: any connection (fixed or temporary) capable of transferring information between two or more users of a
telecommunications system
NOTE: In this context a user may be a person or a machine.
content of communication: information exchanged between two or more users of a telecommunications service,
excluding intercept related information
NOTE: This includes information which may, as part of some telecommunications service, be stored by one user
for subsequent retrieval by another.
Gatekeeper (GK): H.323 entity on the network that provides address translation and controls access to the network for
H.323 terminals, Gateways and MCUs
NOTE: The Gatekeeper may also provide other services to the terminals, Gateways and MCU such as bandwidth
management and locating Gateways. (See also ITU-T Recommendation H.323 [4]).
Gateway (GW): H.323 Gateway (GW) is an endpoint on the network which provides for real-time, two-way
communications between H.323 terminals on the packet based network and other ITU terminals on a switched circuit
network, or to another H.323 Gateway
NOTE: Other ITU Terminals include those complying with recommendations H.310 (H.320 on B-ISDN), H.320
(ISDN), H.321 (ATM), H.322 (GQOS-LAN), H.234 (GSTN), H.234M (Mobile) and V.70 (DSVD). (See
also ITU-T Recommendation H.323 [4]).
H.323 Terminal: endpoint on the network which provides for real-time, two-way communications with another H.323
Terminal, Gateway, or Multipoint Control Unit (MCU)
NOTE: This communication consists of control, indications, audio, moving colour video pictures, and/or data
between the two terminals. A terminal may provide speech only, speech and data, speech and video, or
speech, data and video. (See also ITU-T Recommendation H.323 [4]).
handover interface: physical and logical interface across which the results of interception are delivered from a network
operator/access provider/service provider to an LEMF
identity: technical label which may represent the origin or destination of any telecommunications traffic, as a rule
clearly identified by a physical telecommunications identity number (such as a telephone number) or the logical or
virtual telecommunications identity number (such as a personal number) which the subscriber can assign to a physical
access on a case-by-case basis
intercept related information: collection of information or data associated with telecommunication services involving
the TI, specifically call associated information or data (e.g. unsuccessful call attempts), service associated information
or data (e.g. service profile management by subscriber) and location information
interception (or Lawful Interception): action (based on the law), performed by a network operator/access
provider/service provider, of making available certain information and providing that information to an LEMF
NOTE: In the present document the term interception is not used to describe the action of observing
communications by an LEA (see below).
interception interface: physical and logical locations within the access provider's/network operator's/service provider's
telecommunications facilities where access to the content of communication and intercept related information is
provided
NOTE: The interception interface is not necessarily a single, fixed point.
interception measure: technical measure which facilitates the interception of telecommunications traffic pursuant to
the relevant national laws and regulations
interception subject: person or persons, specified in a lawful authorization, whose telecommunications are to be
intercepted
internal intercepting function: point within a network or network element at which the content of communication is
made available
ETSI
7 ETSI TR 101 750 V1.1.2 (2002-01)
internal network interface: network's internal interface between the Internal Intercepting Function and a mediation
device
Law Enforcement Agency (LEA): organization authorized by a lawful authorization based on a national law to
receive the results of telecommunications interceptions
Law Enforcement Monitoring Facility (LEMF): law enforcement facility designated as the transmission destination
for the results of interception relating to a particular interception subject
lawful authorization: permission granted to an LEA under certain conditions to intercept specified telecommunications
and requiring co-operation from a network operator/access provider/service provider
NOTE: Typically this refers to a warrant or order issued by a lawfully authorized body.
location information: information relating to the geographic, physical or logical location of an identity relating to an
interception subject
mediation device: mechanism which passes information between a network operator/access provider/service provider
and a handover interface
network element: component of the network structure, such as a local exchange, higher order switch or service control
processor
Network Operator (NWO): operator of a public telecommunications infrastructure which permits the conveyance of
signals between defined network termination points by wire, by microwave, by optical means or by other
electromagnetic means
Quality of Service (QoS): quality specification of a telecommunications channel, system, virtual channel,
computer-telecommunications session, etc.
NOTE: Quality of service may be measured, for example, in terms of signal-to-noise ratio, bit error rate, message
throughput rate or call blocking probability.
reliability: probability that a system or service performs in a satisfactory manner for a given period of time when used
under specific operating conditions
result of interception: information relating to a target service, including the content of communication and intercept
related information, which is passed by an access provider or network operator or service provider to an LEA
NOTE: Intercept related information shall be provided whether or not call activity is taking place.
service information: information used by the telecommunications infrastructure in the establishment and operation of a
network related service or services
NOTE: The information may be established by an access provider, network operator, a service provider or a
network user.
Service Provider (SP): natural or legal person providing one or more public telecommunications services whose
provision consists wholly or partly in the transmission and routing of signals on a telecommunications network
NOTE: A service provider need not necessarily run his own network.
Target Identity (TI): identity associated with a target service (see below) used by the interception subject
target identification: identity which relates to a specific lawful authorization as such
NOTE: This might be a serial number or similar. It is not related to the denoted interception subject or subjects.
target service: telecommunications service associated with an interception subject and usually specified in a lawful
authorization for interception
NOTE: There may be more than one target service associated with a single interception subject.
telecommunications: any transfer of signs, signals, writing images, sounds, data or intelligence of any nature
transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photo-optical system
ETSI
8 ETSI TR 101 750 V1.1.2 (2002-01)
3.2 Abbreviations
For the purposes of the present document, the following abbreviations apply:
AP Access Provider
CC Content of Communication
GK GateKeeper
GSM Global System for Mobile communications
GW GateWay
HI Handover Interface
HI1 Handover Interface Port 1 (for Administrative Information)
HI2 Handover Interface Port 2 (for Intercept Related Information)
HI3 Handover Interface Port 3 (for Content of Communication)
IIF Internal Intercepting Function
INI Internal Network Interface
IP Internet Protocol
IRI Intercept Related Information
ISDN Integrated Services Digital Network
LEA Law Enforcement Agency
LEMF Law Enforcement Monitoring Facility
LI Lawful Interception
MF Mediation Function
NWO NetWork Operator
PSTN Public Switched Telephone Network
QoS Quality of Service
SCN Switched Circuit Networks
SS Supplementary Service
SP Service Provider
TI Target Identity
4 General introduction
According to rules set by the laws and/or regulations of individual nations there is a need lawfully to intercept
telecommunications traffic and provide intercept related information in modern telecommunications systems. (Due to
the need of mutual legal assistance there is also a need of harmonizing the interception policy between the various
nations. This also has an impact on the development of modern telecommunication systems and services).
In a telecommunications network interception usually takes place at a switching function close to the terminal. In the
case of a PSTN SCN the interception often takes place at a local switch, to which the Target Identity (TI) is directly
connected. Similarly, an IP network which directly supports terminals must make its own arrangements for interception
of target identities at some suitable point within that IP network.
Lawful interception in SCNs is already covered by existing specifications and arrangements. The cases where lawful
interception is necessary in an IP network shall be considered in step 1 and step 2 of this work. These cases correspond
to scenarios 0, 1, 2 and 4 of TR 101 300 [5]. (In scenario 3 the IP network does not support terminals directly.)
The LEA requirements as they apply in Europe [6], ETR 331 [3] have been taken into account in the definition of the
abstract handover interface ES 201 158 [1] and ES 201 671 [2]. The transformat
...