Content for  TS 33.127  Word version:  18.8.0

A warrant that does not require the interception of communication contents, may require IRI messages that have to be derived from the user plane packets. One report type that requires such a capability is the packet header information report.

Depending on the requirements of the warrant, packet header information reporting may be done either in per-packet form, as one or more Packet Data Header Reports (PDHR), or in summary form, as one or more Packet Data Header Summary Reports (PDSR).

To support the generation of related xIRI (i.e. that requires access to the user plane packets), the present document supports two implementation approaches:

• In approach 1, xIRI (that includes the correlation number and the target identity) is generated by the IRI-POI in the UP Entity. The IRI-POI generates the xIRI from the user plane packets and sends it to the MDF2. The MDF2 generates the IRI messages and sends them to the LEMF.
• In approach 2, xCC is generated by the CC-POI in the UP Entity as if the warrant involves the interception of communication contents. To enable this, the CC-POI is presumed to be present and provisioned in the UP Entity even when the warrant does not require the interception of communication contents. The CC-POI generates the xCC and sends it to the MDF3. The MDF3 (based on the provisioned intercept information) does not generate and deliver the CC to the LEMF. Instead, the MDF3 forwards the xCC to the MDF2 over LI_MDF interface. The MDF2 then generates the IRI messages from xCC and delivers those IRI messages to the LEMF.

In 5GS and CUPS EPS, the POI in the UP Entity requires a trigger to enable it to detect the user plane packets. The corresponding Triggering Function (IRI-TF or CC-TF) resides in the CP Entity that has the IRI-POI for the generation of other xIRI. The trigger sent by the IRI-TF or CC-TF to the corresponding POI includes the following:

• User plane packet detection rules.
• Target identity.
• Correlation information.
• MDF2 (in approach 1) or MDF3 (in approach 2) address.