The Point of Interception (POI) detects the target communication, derives the intercept related information or communications content from the target communications and delivers the POI output as xIRI to the MDF2 or as xCC to the MDF3. The output of a POI is determined by the type of the NF associated with the POI. A POI may be embedded within a Network Function (NF) or separate from a NF with which it is associated. Multiple POIs may have to be involved in executing a warrant.

POIs are divided into two categories:

• Directly provisioned POIs are provisioned by the LIPF.
• Triggered POIs are triggered by a Triggering Function (TF) (see clause 5.3.3).

The directly provisioned POIs detect the target's communications that need to be intercepted, and then derive the intercept related information or communication contents from that target communications depending on the POI type (see clause 5.3.2.3). The triggered POIs detect the target communications based on the trigger received from an associated Triggering Function and then derives the intercept related information or communication contents of target communications depending on the POI type (see clause 5.3.2.3).

POIs are divided into two types for each category based on the type of data they send to the MDF (see clause 5.3.4):

• IRI-POI delivers xIRI to the MDF2.
• CC-POI delivers xCC to the MDF3.

Both IRI-POIs and CC-POIs are either directly provisioned or triggered (see clause 5.3.2.2). In the present document, an xIRI is identified with the event that has caused its generation within the IRI-POI.

In case a network procedure involving the target UE and requiring the generation of an xIRI fails, the IRI-POI shall be able to report the failure reason available from the involved network protocol.

The Administration Function (ADMF) provides the CSP's administrative and management functions for the LI capability. This includes overall responsibility for the provisioning/activating, modifying, and de-activating/de-provisioning the Point(s) Of Interception (POI), Triggering Functions (TF), and the Mediation and Delivery Functions (MDF). The ADMF is also responsible for managing the Identifier Event Functions (IEF) and Identifier Caching Function (ICF). The ADMF is also responsible for controlling and managing the Location Acquisition Requesting Function (LARF). The ADMF includes the following logical sub-functions:

• Lawful Interception Control Function (LICF).
• Lawful Interception Provisioning Function (LIPF).
• Identifier Query Function (IQF).
• Certificate Authority (CA).
• Location Acquisition Function (LAF).

Within one ADMF there is one LICF, one IQF, one LAF, and at least one, but possibly multiple LIPFs. The LICF and LIPF communicate via the internal LI_ADMF interface, the details of which are outside the scope of the present document. The LICF and LAF communicate via the internal LI_LAFC interface, the details of which are outside the scope of the present document. The LIPF and LAF communicate via the internal LI_LAFP interface, the details of which are outside the scope of the present document. The ADMF contains the issuing Certificate Authority (CA) for all LI components (POIs, MDFs etc.). Further details are defined in clause 8.3. The IQF is used for handling identifier association requests. Further details are defined in clause 5.7. The LAF is used for handling location acquisition requests. Further details are defined in clause 7.3.5. For further details on the roles and responsibilities of the ADMF refer to Annex B.

The LICF controls the management of the end-to-end life cycle of a warrant. The LICF contains the master record of all sensitive information and LI configuration data. The LICF is ultimately responsible for all decisions within the overall LI system. The LICF, via the LIPF acting as its proxy is responsible for auditing other LI components (POIs, MDFs etc.). The LICF is responsible for communication with administrative LEA systems (LI_HI1). The LICF provides the intercept information derived from the warrant for provisioning at the POI, TF, MDF2, and MDF3. With the exception of the communication with the LEA, all other communication between the LICF and any other entities shall be proxied by the LIPF. The LICF also maintains and authorises the master list of POIs, IEFs, ICF, TFs, MDFs, and LARFs. In dynamic networks the LIPF is responsible for providing the LICF with any necessary updates to the POI, TF, IEF, ICF, MDF, and LARF list. The LICF is responsible for management and audit of the IEF(s) and ICF proxied by the LIPF. The LICF shall support activating and deactivating of IEF identifier association reporting capabilities on a per IEF basis proxied by the LIPF. The LICF shall provide the IQF with information relating to IEFs and ICF necessary for the IQF to handle queries from the LEA and obtain answers to such queries. If the LICF deactivates event record reporting to an IEF, the LICF shall also instruct the ICF to immediately delete all cached identifier associations which the ICF had received from that IEF. The LICF shall ensure that the ICF is always activated before IEFs and de-activated after IEFs to ensure that data loss does not occur due to an IEF sending events before an ICF is configured to receive them. The LICF shall provide the LAF with information necessary for the LAF to handle location acquisition queries from the LEA and obtain answers to such queries.

The LIPF provisions all the applicable POIs, TFs and MDFs. The role of the LIPF varies depending on implementation of network functions and of the ADMF itself (e.g. virtual or non-virtual). In its simplest form, the LIPF is the secure proxy used by the LICF to communicate with POIs, TFs, MDFs or other infrastructure required to operate LI within the CSP network. In this scenario the LIPF does not store target information and simply routes LI_X1 messages from and to the LICF. In scenarios where the ADMF is required to take an active role in POI triggering, the LIPF is responsible for receiving triggering information (e.g. from an IRI-TF) and forwarding the trigger to the appropriate POI. For directly provisioned POIs, TFs and MDFs, the LIPF will forward all LI administration instructions from the LICF to the intended destination POI, TF or MDF. In SBA as defined in TS 23.501 or virtualised deployments, the LIPF is responsible for identifying changes to NFs, POIs, and TFs and MDFs through interaction with the SIRF or underlying virtualisation infrastructure. The LIPF shall notify the LICF of changes affecting the number of active NFs/POIs and TFs or other information which the LICF requires to maintain the master POI/TF and MDF list. While the LIPF is assumed to be stateful with respect to dynamic interceptions it is managing, it shall not hold the full static target or other historic LI data. If the LIPF is deployed in a virtualised environment, the LIPF shall not store LI information in persistent storage and shall rely on the LICF to manage re-synchronisation in the case of LIPF restart.

The IQF is the function responsible for receiving and responding to dedicated LEA real-time queries for identifier associations. Further details of the IQF are defined in clause 5.7.2.1.

The LICF and LIPF shall support selective management and provisioning of groups of POIs, TFs and IEFs, based on the warrant parameters (e.g., service scope, target identities), the target UE type and profile (e.g. a smartphone, a CIoT device) and the CSP's network deployment architecture and services implementation (e.g. Slicing, MEC and URLLC enablers, etc.), with the purpose of optimizing the LI system operation and avoiding its over-provisioning. This selective management and provisioning shall apply independently of architectural alternatives in clause 8.2. The selective management and provisioning of LI functions may be supported by ADMF's GUI configuration capabilities, as well as by ADMF's ability to obtain and use the CSP network data to drive its provisioning decisions. The following are examples of the ADMF's configuration capabilities:

• Single or multiple POIs or TFs or IEFs.
• Groups of one or more POIs, TFs, and IEFs of a specific parent NF type.
• POIs, TFs, and IEFs associated with NFs in a specific slice.
• POIs, TFs, and IEFs independently where they are contained in the same parent NF.
• Enabling only specific services or features of POIs (individually and in groups).

Selective provisioning shall be supported on a per warrant basis.

The Location Acquisition Function (LAF) is responsible for processing the location requests received from the LEA during the location acquisition procedure. Further details of the LAF are defined in clause 7.3.5.