Patent Description:
Many existing wireless communication systems are fourth generation (<NUM>) systems such as Long Term Evolution (LTE) systems, LTE-Advanced (LTE-A) systems, or LTE-A Pro systems. Fifth generation (<NUM>) wireless communication systems are already being deployed and are expected to become widespread in the near future. The industry consortium setting standards for <NUM> is the 3rd Generation Partnership Project (3GPP).

One significant advantage of <NUM> systems is that they will have greater bandwidth, thereby providing faster download speeds. Due to the increased bandwidth, it is expected that <NUM> systems will facilitate many new applications in areas of technology such as Internet of Things (IoT) devices and machine-to-machine communication.

The <NUM> system architecture is significantly different from its predecessors in many respects. For example, in a <NUM> system, network management can be software driven, and network functions and resources can be virtualized at the edges and inside the network core. A <NUM> system implementation can be based on cloud-native applications, virtualized network functions, and microservices-based design patterns. In addition, a <NUM> system implementation can provide support for stateless network functions by decoupling compute and storage.

Lawful interception (LI) refers to the facilities in telecommunications and telephone networks that allow law enforcement agencies with court orders or other legal authorization to obtain communications network data for the purpose of analysis or evidence. To ensure systematic procedures for carrying out LI procedures, while also lowering the costs of LI solutions, industry groups and government agencies worldwide have attempted to standardize the technical processes behind LI.

3GPP TS <NUM> defines an LI architecture for <NUM> systems. Among other things, this LI architecture defines how network operators and law enforcement agents can interact. The LI architecture set forth in 3GPP TS <NUM> includes the following aspects: collection where target-related data and content are extracted from the network, mediation where the data is formatted to conform to specific standards, and delivery of the data and content to the law enforcement agency.

The subject matter in the background section is intended to provide an overview of the overall context for the subject matter disclosed herein. The subject matter discussed in the background section should not be assumed to be prior art merely as a result of its mention in the background section. Similarly, a problem mentioned in the background section or associated with the subject matter of the background section should not be assumed to have been previously recognized in the prior art.

One aspect of the present disclosure is a method for enabling hanging lawful interception (LI) resources to be cleaned up in a mobile network that comprises a triggering function set and a data store. The triggering function set comprises a plurality of triggering functions. The data store comprises a plurality of auditing records corresponding to the plurality of triggering functions. The method comprises causing each triggering function among the plurality of triggering functions to send an update request to the data store in response to being notified about a failed triggering function within the triggering function set. Each update request comprises a request to change ownership of an auditing record corresponding to the failed triggering function. The method also comprises selecting a triggering function as a new owner of the auditing record corresponding to the failed triggering function based at least in part on a match between a claimant attribute in the auditing record and a claimant field in the update request sent by the triggering function. The method also comprises causing the new owner of the auditing record corresponding to the failed triggering function to send at least one request to a triggered point of interception (POI) to remove an LI resource corresponding to the failed triggering function.

In some embodiments, each update request can comprise the claimant field that identifies the failed triggering function and a request to modify the claimant attribute of the auditing record to an identifier associated with a sender of the update request.

In some embodiments, the request to modify the claimant attribute is only granted when the claimant field matches the claimant attribute of the auditing record.

In some embodiments, the failed triggering function can comprise a failed session management function (SMF) and the plurality of triggering functions can comprise a plurality of SMFs.

In some embodiments, the data store can comprise an unstructured data storage network function (UDSF).

In some embodiments, the triggered POI can reside within a user plane function (UPF).

In some embodiments, the method can additionally comprise notifying the plurality of triggering functions in the triggering function set about the failed triggering function.

In some embodiments, the method can additionally comprise causing each triggering function among the plurality of triggering functions to register with a network function repository function.

In some embodiments, the at least one request that is sent to the triggered POI can comprise a first request to deactivate all tasks associated with the failed triggering function, and a second request to remove all destinations associated with the failed triggering function.

In some embodiments, the method can additionally comprise causing the new owner of the auditing record corresponding to the failed triggering function to send a request to the data store to remove the auditing record from the data store.

Another aspect of the present disclosure is directed to a method for enabling hanging lawful interception (LI) resources to be cleaned up. The method is implemented by a triggering function that belongs to a triggering function set that comprises a plurality of triggering functions. The method comprises receiving notification about a failed triggering function in the triggering function set. The method also comprises sending, in response to the notification, an update request to a data store that comprises a plurality of auditing records corresponding to the plurality of triggering functions. The update request comprises a request to change ownership of an auditing record corresponding to the failed triggering function. The method also comprises receiving, in response to sending the update request, an indication that the triggering function has been selected as a new owner of the auditing record based at least in part on a match between a claimant attribute in the auditing record and a claimant field in the update request sent by the triggering function. The method also comprises sending, in response to receiving the indication, at least one request to a triggered point of interception (POI) to remove an LI resource corresponding to the failed triggering function.

In some embodiments, the claimant field can identify the failed triggering function, and the update request can comprise a request to modify the claimant attribute of the auditing record to an identifier associated with the triggering function.

In some embodiments, the triggering function can comprise a session management function (SMF), the failed triggering function can comprise a failed SMF, and the plurality of triggering functions can comprise a plurality of SMFs.

In some embodiments, the method can further comprise registering with a network function repository function (NRF). The notification about the failed triggering function can be received from the NRF.

In some embodiments, the at least one request that is sent to the triggered POI can comprise a first request to deactivate all tasks associated with the failed triggering function and a second request to remove all destinations associated with the failed triggering function.

In some embodiments, the method can additionally comprise sending a request to the data store to remove the auditing record from the data store.

Another aspect of the present disclosure is a system that enables hanging lawful interception (LI) resources to be cleaned up. The system includes one or more processors and memory in electronic communication with the one or more processors. A triggering function set is stored in the memory. The triggering function set comprises a plurality of triggering functions. A data store is also provided in the memory. The data store comprises a plurality of auditing records corresponding to the plurality of triggering functions in the triggering function set. Each auditing record comprises a claimant attribute. Instructions are stored in the memory. The instructions are executable by the one or more processors to cause each triggering function among the plurality of triggering functions to send an update request to the data store in response to being notified about a failed triggering function within the triggering function set. Each update request comprises a request to change ownership of the auditing record corresponding to the failed triggering function. The instructions are also executable by the one or more processors to select a triggering function as a new owner of the auditing record corresponding to the failed triggering function based at least in part on a match between the claimant attribute in the auditing record and a claimant field in the update request sent by the triggering function. The instructions are also executable by the one or more processors to cause the new owner of the auditing record corresponding to the failed triggering function to send at least one request to a triggered point of interception (POI) to remove an LI resource corresponding to the failed triggering function.

In some embodiments, each update request can comprise the claimant field that identifies the failed triggering function and a request to modify the claimant attribute of the auditing record to an identifier associated with a sender of the update request. The system can be configured such that the request to modify the claimant attribute is only granted when the claimant field matches the claimant attribute of the auditing record.

Additional features and advantages will be set forth in the description that follows. Features and advantages of the disclosure may be realized and obtained by means of the systems and methods that are particularly pointed out in the appended claims. Features of the present disclosure will become more fully apparent from the following description and appended claims, or may be learned by the practice of the disclosed subject matter as set forth hereinafter.

In order to describe the manner in which the above-recited and other features of the disclosure can be obtained, a more particular description will be rendered by reference to specific embodiments thereof which are illustrated in the appended drawings. For better understanding, the like elements have been designated by like reference numbers throughout the various accompanying figures. Understanding that the drawings depict some example embodiments, the embodiments will be described and explained with additional specificity and detail through the use of the accompanying drawings in which:.

The present disclosure is generally related to cleaning up hanging lawful interception (LI) resources from a triggered point of interception (POI) when a triggering function fails.

As noted above, 3GPP TS <NUM> defines an LI architecture for <NUM> systems. In this document, the term "triggering" is defined as the action taken by a dedicated function (which is referred to as a "triggering function") to provide another dedicated function (which is referred to as a "triggered POI") that provisioning could not directly be applied to, with information that identifies the specific target communication to be intercepted.

3GPP TS <NUM> describes a scenario in which a session management function (SMF) is responsible for creating and removing LI resources on a user plane function (UPF). In this scenario, the SMF can be considered to be a triggering function, and the triggered POI resides on the UPF. For purposes of example, the systems and methods disclosed herein will be described in relation to this scenario. However, the scope of the present disclosure is not limited in this regard. The systems and methods disclosed herein are applicable to other scenarios involving other triggering functions and/or other triggered POIs.

The LI resources disclosed herein can include tasks and destinations. In this context, the term "task" can refer to the entity whose network data is being intercepted. For example, a task can be an individual subscriber, a mobile number, an IP address, etc. The term "destination" can refer to the place(s) where the intercepted data should be sent.

From time to time, an SMF can fail and experience unplanned downtime after provisioning. There are many reasons why an SMF can fail. For example, an SMF can fail because of a hardware failure. If an SMF fails after provisioning, then the UPF LI resources can remain hanging because the SMF is no longer available in the network.

The current solution to this problem is to clean up hanging resources based on inactivity. More specifically, if there is no activity on the part of the SMF for a certain period of time (which can be referred to as "Time-P2"), then the hanging resources will be cleaned up (e.g., deleted). However, there are several disadvantages with this approach. For example, with the current approach, resources will be hanging and continue intercepting user data until the expiration of Time-P2. The default value of Time-P2 is one hour, which means that under the current approach resources typically continue intercepting user data for a relatively long period of time. However, if any intercept warrant has expired or been revoked in the Time-P2 time period, then it is illegal to continue intercepting user data. Another disadvantage with the current approach is that if the SMF comes up again and sends any message to the UPF before the expiration of the Time-P2 time period, then the hanging resources will not be cleaned up.

The present disclosure proposes an auditing mechanism to take ownership of the failed SMF in order to clean up hanging resources on the UPF. The auditing mechanism disclosed herein takes advantage of the 3GPP concept of a set of SMFs. This may alternatively be referred to as creating a pool of SMFs. For consistency, the term "set" will be used in the discussion that follows.

Within a particular SMF set, each SMF can be configured with the network element identifier (NEID) as well as the network function (NF) instance ID of all other SMFs in the set. Each SMF in a particular SMF set maintains its NEID-related record in a data store that is accessible to every SMF in the SMF set. In some embodiments, the data store can be an unstructured data storage network function (UDSF). The record corresponding to a particular SMF contains a claimant attribute that identifies the SMF as the owner of the record.

Each SMF in the SMF set receives updates about the liveliness of other SMFs. In some embodiments, the updates can be received from the network function repository function (NRF) via the Nnrf interface. When any SMF goes down, all other SMFs in the SMF set are notified (e.g., by the NRF) about the status of the SMF that has failed. In addition, one of the active SMFs in the SMF set is expected to take ownership of the record corresponding to the failed SMF.

The techniques disclosed herein can use the claimant attribute of the record corresponding to the failed SMF for ownership contention resolution. Each SMF in the SMF set attempts to take ownership of the record with a conditional update. In this context, the term "conditional update" refers to a process whereby a record (including the claimant attribute) is permitted to be modified only if the claimant attribute that is present in the record matches the claimant field that is present in the query of an update request. Thus, each SMF in the SMF set attempts to update the record of the failed SMF with the NEID of the failed SMF as the claimant field in the query and their own NEID as the claimant attribute in the update record. Only one of the SMFs will succeed and take ownership, and all other SMFs fail. The SMF that is successfully able to update the record is the new owner.

The new owner then cleans up the hanging resources corresponding to the failed SMF. In some embodiments, the new owner sends a DeactivateAllTasksRequest to each UPF to remove hanging tasks and waits for DeactivateAllTasksResponse. In addition, the new owner sends a RemoveAllDestinationsRequest to each UPF to remove hanging destinations and waits for a RemoveAllDestinationsResponse. The new owner also removes the record of the failed SMF.

<FIG> and <FIG> illustrate an example of a method <NUM> for cleaning up hanging LI resources when an SMF fails. The entities that are involved in performing the method <NUM> include an SMF set <NUM> that includes a first SMF <NUM>-<NUM>, a second SMF <NUM>-<NUM>, and a third SMF <NUM>-<NUM>. Other entities that are involved in performing the method <NUM> include a UDSF <NUM>, an NRF <NUM>, and a UPF <NUM>.

Reference is initially made to <FIG>. In act <NUM> of the method <NUM>, the SMF set <NUM> is created.

In act <NUM> of the method <NUM>, each of the SMFs in the SMF set <NUM> creates an auditing record in the UDSF <NUM>. More specifically, act <NUM> of the method <NUM> includes act <NUM>-<NUM> in which the first SMF <NUM>-<NUM> creates a first auditing record <NUM>-<NUM>, act <NUM>-<NUM> in which the second SMF <NUM>-<NUM> creates a second auditing record <NUM>-<NUM>, and act <NUM>-<NUM> in which the third SMF <NUM>-<NUM> creates a third auditing record <NUM>-<NUM>. Aspects of the auditing records <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> that are created are shown in <FIG>.

In act <NUM>-<NUM>, the first SMF <NUM>-<NUM> creates a first auditing record <NUM>-<NUM> in the UDSF <NUM>. The claimant attribute <NUM>-<NUM> of the first auditing record <NUM>-<NUM> is set to an identifier corresponding to the first SMF <NUM>-<NUM> (e.g., NEID1). In act <NUM>-<NUM>, the second SMF <NUM>-<NUM> creates a second auditing record <NUM>-<NUM> in the UDSF <NUM>. The claimant attribute <NUM>-<NUM> of the second auditing record <NUM>-<NUM> is set to an identifier corresponding to the second SMF <NUM>-<NUM> (e.g., NEID2). In act <NUM>-<NUM>, the third SMF <NUM>-<NUM> creates a third auditing record <NUM>-<NUM> in the UDSF <NUM>. The claimant attribute <NUM>-<NUM> of the third auditing record <NUM>-<NUM> is set to an identifier corresponding to the third SMF <NUM>-<NUM> (e.g., NEID3).

Referring again to <FIG>, each of the SMFs in the SMF set <NUM> registers with the NRF <NUM> in act <NUM> of the method <NUM>. More specifically, act <NUM> of the method <NUM> includes act <NUM>-<NUM> performed by the first SMF <NUM>-<NUM> and the NRF <NUM>, act <NUM>-<NUM> performed by the second SMF <NUM>-<NUM> and the NRF <NUM>, and act <NUM>-<NUM> performed by the third SMF <NUM>-<NUM> and the NRF <NUM>. In act <NUM>-<NUM>, the first SMF <NUM>-<NUM> registers with the NRF <NUM>. As part of registering with the NRF <NUM>, the first SMF <NUM>-<NUM> provides the NRF <NUM> with an identifier (e.g., UUID1) corresponding to the first SMF <NUM>-<NUM>. In act <NUM>-<NUM>, the second SMF <NUM>-<NUM> registers with the NRF <NUM>. As part of registering with the NRF <NUM>, the second SMF <NUM>-<NUM> provides the NRF <NUM> with an identifier (e.g., UUID2) corresponding to the second SMF <NUM>-<NUM>. In act <NUM>-<NUM>, the third SMF <NUM>-<NUM> registers with the NRF <NUM>. As part of registering with the NRF <NUM>, the third SMF <NUM>-<NUM> provides the NRF <NUM> with an identifier (e.g., UUID3) corresponding to the third SMF <NUM>-<NUM>.

In act <NUM> of the method <NUM>, LI tasks and LI destinations are provisioned on all of the SMFs in the SMF set <NUM>.

In act <NUM> of the method <NUM>, the first SMF <NUM>-<NUM> experiences a failure and becomes unavailable.

In act <NUM> of the method <NUM>, the NRF <NUM> detects the failure of the first SMF <NUM>-<NUM>. In act <NUM> of the method <NUM>, the NRF <NUM> notifies the other SMFs in the SMF set <NUM> that the first SMF <NUM>-<NUM> has failed. More specifically, act <NUM> of the method <NUM> includes acts <NUM>-<NUM> and <NUM>-<NUM>. In act <NUM>-<NUM>, the NRF <NUM> notifies the second SMF <NUM>-<NUM> about the failure of the first SMF <NUM>-<NUM>. In act <NUM>-<NUM>, the NRF <NUM> notifies the third SMF <NUM>-<NUM> about the failure of the first SMF <NUM>-<NUM>.

Reference is now made to <FIG>. In acts <NUM> through <NUM> of the method <NUM>, an audit mechanism is performed to see who will become the new owner of the first auditing record <NUM>-<NUM> corresponding to the first SMF <NUM>-<NUM>. In accordance with the audit mechanism, only one SMF in the SMF set <NUM> will be able to become the new owner of the first auditing record <NUM>-<NUM> corresponding to the first SMF <NUM>-<NUM>. The new owner will then be responsible for the cleanup of hanging LI resources corresponding to the first SMF <NUM>-<NUM>.

In accordance with the audit mechanism, every SMF in the SMF set <NUM> tries to update the first auditing record <NUM>-<NUM> corresponding to the first SMF <NUM>-<NUM> with the NEID of the first SMF <NUM>-<NUM> (NEID1) as the claimant field in the query and their own NEID as the claimant attribute in the update record. The UDSF <NUM> is configured so that it only permits an auditing record to be modified if the claimant attribute present in the auditing record matches the claimant field present in the query of the update request.

In act <NUM> of the method <NUM>, the second SMF <NUM>-<NUM> sends an update request <NUM>-<NUM> to the UDSF <NUM>. The update request <NUM>-<NUM>, which is shown in <FIG>, is a request to update the claimant attribute <NUM>-<NUM> of the first auditing record <NUM>-<NUM>, which (as noted above) corresponds to the first SMF <NUM>-<NUM>. The update request <NUM>-<NUM> includes a claimant field <NUM>-<NUM> and an update record <NUM>-<NUM>. The update record <NUM>-<NUM> includes a claimant attribute <NUM>-<NUM>. In the present example, the value of the claimant field <NUM>-<NUM> is the NEID of the first SMF <NUM>-<NUM> (NEID1). Because the value of the claimant attribute <NUM>-<NUM> in the first auditing record <NUM>-<NUM> matches the value of the claimant field <NUM>-<NUM> that is present in the update request <NUM>-<NUM>, the UDSF <NUM> grants the update request <NUM>-<NUM>. Therefore, referring to both <FIG> and <FIG>, in act <NUM> of the method <NUM> the UDSF <NUM> modifies the claimant attribute <NUM>-<NUM> in the first auditing record <NUM>-<NUM> to the value of the claimant attribute <NUM>-<NUM> in the update record <NUM>-<NUM> of the update request <NUM>-<NUM> (namely, NEID2 in this example).

In act <NUM> of the method <NUM>, the third SMF <NUM>-<NUM> sends another update request <NUM>-<NUM> to the UDSF <NUM>. The update request <NUM>-<NUM>, which is shown in <FIG>, is another request to update the claimant attribute <NUM>-<NUM> of the first auditing record <NUM>-<NUM> corresponding to the first SMF <NUM>-<NUM>. The update request <NUM>-<NUM> includes a claimant field <NUM>-<NUM> and an update record <NUM>-<NUM>. The update record <NUM>-<NUM> includes a claimant attribute <NUM>-<NUM>. The value of the claimant field <NUM>-<NUM> is the NEID of the first SMF <NUM>-<NUM> (NEID1). However, because the value of the claimant attribute <NUM>-<NUM> in the first auditing record <NUM>-<NUM> has been changed (from NEID1 to NEID2, as discussed above), the value of the claimant attribute <NUM>-<NUM> in the first auditing record <NUM>-<NUM> does not match the value of the claimant field <NUM>-<NUM> that is present in the update request <NUM>-<NUM>. Therefore, referring to both <FIG> and <FIG>, in act <NUM> of the method <NUM> the UDSF <NUM> denies the update request <NUM>-<NUM> sent by the third SMF <NUM>-<NUM>.

Thus, the result of the audit mechanism is that the second SMF <NUM>-<NUM> becomes the new owner of the first auditing record <NUM>-<NUM>. Consequently, the second SMF <NUM>-<NUM> takes responsibility for the cleanup of hanging LI resources corresponding to the first SMF <NUM>-<NUM>. In the depicted method <NUM>, the second SMF <NUM>-<NUM> cleans up hanging LI resources corresponding to the first SMF <NUM>-<NUM> in acts <NUM> through <NUM>. In particular, in act <NUM> of the method <NUM>, the second SMF <NUM>-<NUM> sends a request to the UPF <NUM> to deactivate all LI tasks associated with the first SMF <NUM>-<NUM>. In act <NUM> of the method <NUM>, the second SMF <NUM>-<NUM> sends a request to the UPF <NUM> to remove all LI destinations associated with the first SMF <NUM>-<NUM>. In act <NUM> of the method <NUM>, the second SMF <NUM>-<NUM> sends a request to the UDSF <NUM> to remove the first auditing record <NUM>-<NUM>.

<FIG> and <FIG> illustrate another example of a method <NUM> for cleaning up hanging LI resources when an SMF fails. The entities that are involved in performing the method <NUM> include an SMF set <NUM> that includes a first SMF <NUM>-<NUM>, a second SMF <NUM>-<NUM>, and a third SMF <NUM>-<NUM>. Other entities that are involved in performing the method <NUM> include an access and mobility function (AMF) <NUM>, a lawful interception provisioning function (LIPF) <NUM>, a UDSF <NUM>, an NRF <NUM>, a UPF <NUM>, and a mediation and delivery function (MDF) <NUM>.

Reference is initially made to <FIG>. In act <NUM> of the method <NUM>, the SMF set <NUM> is created. In act <NUM> of the method <NUM>, each of the SMFs in the SMF set <NUM> is configured with identifying information about the other SMFs in the SMF set <NUM>. The identifying information for a particular SMF can include the NRF registered UUID and the NEID corresponding to that SMF. For example, the first SMF <NUM>-<NUM> can be configured with the NRF registered UUID and the NEID for the second SMF <NUM>-<NUM> and the third SMF <NUM>-<NUM>. The second SMF <NUM>-<NUM> can be configured with the NRF registered UUID and the NEID for the first SMF <NUM>-<NUM> and the third SMF <NUM>-<NUM>. The third SMF <NUM>-<NUM> can be configured with the NRF registered UUID and the NEID for the first SMF <NUM>-<NUM> and the second SMF <NUM>-<NUM>.

In act <NUM> of the method <NUM>, each of the SMFs in the SMF set <NUM> creates a record in the UDSF <NUM>.

In act <NUM> of the method <NUM>, each of the SMFs in the SMF set <NUM> is configured with the same UPF list as its LI peers to send the LI messages.

In act <NUM> of the method <NUM>, each of the SMFs in the SMF set <NUM> creates an auditing record in the UDSF <NUM>. More specifically, act <NUM> of the method <NUM> includes act <NUM>-<NUM> performed by the first SMF <NUM>-<NUM>, act <NUM>-<NUM> performed by the second SMF <NUM>-<NUM>, and act <NUM>-<NUM> performed by the third SMF <NUM>-<NUM>. In act <NUM>-<NUM>, the first SMF <NUM>-<NUM> creates a first auditing record in the UDSF <NUM>. The claimant attribute of the first auditing record is set to an identifier corresponding to the first SMF <NUM>-<NUM> (e.g., NEID1). In act <NUM>-<NUM>, the second SMF <NUM>-<NUM> creates a second auditing record in the UDSF <NUM>. The claimant attribute of the second auditing record is set to an identifier corresponding to the second SMF <NUM>-<NUM> (e.g., NEID2). In act <NUM>-<NUM>, the third SMF <NUM>-<NUM> creates a third auditing record in the UDSF <NUM>. The claimant attribute of the third auditing record is set to an identifier corresponding to the third SMF <NUM>-<NUM> (e.g., NEID3).

In act <NUM> of the method <NUM>, each of the SMFs in the SMF set <NUM> registers with the NRF <NUM>. More specifically, act <NUM> of the method <NUM> includes acts <NUM>-1a and <NUM>-1b performed by the first SMF <NUM>-<NUM> and the NRF <NUM>, acts <NUM>-2a and <NUM>-2b performed by the second SMF <NUM>-<NUM> and the NRF <NUM>, and acts <NUM>-3a and <NUM>-3b performed by the third SMF <NUM>-<NUM> and the NRF <NUM>. In act <NUM>-1a, the first SMF <NUM>-<NUM> registers with the NRF <NUM>. As part of registering with the NRF <NUM>, the first SMF <NUM>-<NUM> sends the NRF <NUM> an identifier (e.g., UUID1) corresponding to the first SMF <NUM>-<NUM>. In act <NUM>-1b, the NRF <NUM> acknowledges the registration of the first SMF <NUM>-<NUM>. In act <NUM>-2a, the second SMF <NUM>-<NUM> registers with the NRF <NUM>. As part of registering with the NRF <NUM>, the second SMF <NUM>-<NUM> sends the NRF <NUM> an identifier (e.g., UUID2) corresponding to the second SMF <NUM>-<NUM>. In act <NUM>-1b, the NRF <NUM> acknowledges the registration of the second SMF <NUM>-<NUM>. In act <NUM>-3a, the third SMF <NUM>-<NUM> registers with the NRF <NUM>. As part of registering with the NRF <NUM>, the third SMF <NUM>-<NUM> sends the NRF <NUM> an identifier (e.g., UUID3) corresponding to the third SMF <NUM>-<NUM>. In act <NUM>-1b, the NRF <NUM> acknowledges the registration of the third SMF <NUM>-<NUM>.

In act <NUM> of the method <NUM>, destinations are provisioned on all of the SMFs in the SMF set <NUM>.

In act <NUM> of the method <NUM>, the LIPF <NUM> activates a task request for each of the SMFs in the SMF set <NUM>. More specifically, act <NUM> of the method <NUM> includes acts <NUM>-1a and <NUM>-1b performed by the LIPF <NUM> and the first SMF <NUM>-<NUM>, acts <NUM>-2a and <NUM>-2b performed by the LIPF <NUM> and the second SMF <NUM>-<NUM>, and acts <NUM>-3a and <NUM>-3b performed by the LIPF <NUM> and the third SMF <NUM>-<NUM>. In act <NUM>-1a, the LIPF <NUM> sends an activate task request message to the first SMF <NUM>-<NUM>. In act <NUM>-1b, the first SMF <NUM>-<NUM> sends an activate task response message to the LIPF <NUM>. In act <NUM>-2a, the LIPF <NUM> sends an activate task request message to the second SMF <NUM>-<NUM>. In act <NUM>-2b, the second SMF <NUM>-<NUM> sends an activate task response message to the LIPF <NUM>. In act <NUM>-3a, the LIPF <NUM> sends an activate task request message to the third SMF <NUM>-<NUM>. In act <NUM>-3b, the third SMF <NUM>-<NUM> sends an activate task response message to the LIPF <NUM>.

In act <NUM> of the method <NUM>, the AMF <NUM> receives a message that causes the AMF <NUM> to establish a PDU session with the first SMF <NUM>-<NUM>. In act <NUM> of the method <NUM>, the AMF <NUM> establishes a PDU session with the first SMF <NUM>-<NUM>.

In act <NUM> of the method <NUM>, the first SMF <NUM>-<NUM> sends a message to the MDF <NUM> to establish an Intercept Related Information (IRI) event.

In act <NUM> of the method <NUM>, a destination is created with respect to the first SMF <NUM>-<NUM>. More specifically, act <NUM> of the method <NUM> includes acts <NUM>-<NUM> and <NUM>-<NUM> performed by the first SMF <NUM>-<NUM> and the UPF <NUM>. In act <NUM>-<NUM>, the first SMF <NUM>-<NUM> sends a CreateDestination request message to the UPF <NUM>. The CreateDestination request message is sent only if the first task is getting provisioned. In act <NUM>-<NUM>, the UPF <NUM> sends a CreateDestination response message to the first SMF <NUM>-<NUM> (if the CreateDestination request message is sent). The CreateDestination response message acknowledges the receipt of the CreateDestination request message and indicates that the request to create the destination has been completed.

In act <NUM> of the method <NUM>, a task is activated with respect to the first SMF <NUM>-<NUM>. More specifically, act <NUM> of the method <NUM> includes acts <NUM>-<NUM> and <NUM>-<NUM> performed by the first SMF <NUM>-<NUM> and the UPF <NUM>. In act <NUM>-<NUM>, the first SMF <NUM>-<NUM> sends an ActivateTask request message to the UPF <NUM>. In act <NUM>-<NUM>, the UPF <NUM> sends an ActivateTask response message to the first SMF <NUM>-<NUM>. The ActivateTask response message acknowledges the receipt of the ActivateTask request message and indicates that the request to activate the task has been completed.

In act <NUM> of the method <NUM>, the UPF <NUM> provides intercept data to the MDF <NUM>.

Reference is now made to <FIG>. In act <NUM> of the method <NUM>, the first SMF <NUM>-<NUM> experiences a failure and becomes unavailable.

In act <NUM> of the method <NUM>, the NRF <NUM> notifies the other SMFs in the SMF set <NUM> that the first SMF <NUM>-<NUM> has experienced a failure and is unavailable. More specifically, act <NUM> of the method <NUM> includes acts <NUM>-<NUM> and <NUM>-<NUM>. In act <NUM>-<NUM>, the NRF <NUM> notifies the second SMF <NUM>-<NUM> about the failure of the first SMF <NUM>-<NUM>. In act <NUM>-<NUM>, the NRF <NUM> notifies the third SMF <NUM>-<NUM> about the failure of the first SMF <NUM>-<NUM>.

In act <NUM> of the method <NUM>, the NRF <NUM> notifies the AMF <NUM> about the failure of the first SMF <NUM>-<NUM>.

In act <NUM> of the method <NUM>, an audit mechanism is performed. In accordance with the audit mechanism, only one SMF in the SMF set <NUM> will be able to become the new owner of the auditing record corresponding to the first SMF <NUM>-<NUM>. The new owner will then be responsible for the cleanup of hanging LI resources corresponding to the first SMF <NUM>-<NUM>. For purposes of the present example, it will be assumed that as a result of the audit mechanism the second SMF <NUM>-<NUM> becomes the new owner of the auditing record corresponding to the first SMF <NUM>-<NUM>. This is shown in act <NUM> of the method <NUM>.

As a result of becoming the new owner of the auditing record corresponding to the first SMF <NUM>-<NUM>, the second SMF <NUM>-<NUM> receives signaling in act <NUM> of the method <NUM>. The signaling can come from entities such as the PCF and/or the AMF <NUM> and/or the LIPF <NUM>.

In act <NUM> of the method <NUM>, a destination is created with respect to the second SMF <NUM>-<NUM>. More specifically, act <NUM> of the method <NUM> includes acts <NUM>-<NUM> and <NUM>-<NUM> performed by the second SMF <NUM>-<NUM> and the UPF <NUM>. In act <NUM>-<NUM>, the second SMF <NUM>-<NUM> sends a CreateDestination request message to the UPF <NUM>. The CreateDestionation request message is sent only if the first task is getting provisioned. In act <NUM>-<NUM>, the UPF <NUM> sends a CreateDestination response message to the second SMF <NUM>-<NUM> (if the CreateDestination request message is sent). The CreateDestination response message acknowledges the receipt of the CreateDestination request message and indicates that the request to create the destination has been completed.

In act <NUM> of the method <NUM>, a task is activated with respect to the second SMF <NUM>-<NUM>. More specifically, act <NUM> of the method <NUM> includes acts <NUM>-<NUM> and <NUM>-<NUM> performed by the second SMF <NUM>-<NUM> and the UPF <NUM>. In act <NUM>-<NUM>, the second SMF <NUM>-<NUM> sends an ActivateTask request message to the UPF <NUM>. In act <NUM>-<NUM>, the UPF <NUM> sends an ActivateTask response message to the second SMF <NUM>-<NUM>. The ActivateTask response message acknowledges the receipt of the ActivateTask request message and indicates that the request to activate the task has been completed.

In act <NUM> of the method <NUM>, the second SMF <NUM>-<NUM> sends a message to the MDF <NUM> to establish an IRI event.

In act <NUM> of the method <NUM>, the second SMF <NUM>-<NUM> deactivates all tasks associated with the first SMF <NUM>-<NUM>. More specifically, act <NUM> of the method <NUM> includes acts <NUM>-<NUM> and <NUM>-<NUM> performed by the second SMF <NUM>-<NUM> and the UPF <NUM>. In act <NUM>-<NUM>, the second SMF <NUM>-<NUM> sends a DeactivateAllTasks request message to the UPF <NUM>. The DeactivateAllTasks request message includes a request to delete all tasks associated with the first SMF <NUM>-<NUM>. In act <NUM>-<NUM>, the UPF <NUM> sends a DeactivateAllTasks response message to the second SMF <NUM>-<NUM>. The DeactivateAllTasks response message acknowledges the receipt of the DeactivateAllTasks request message and indicates that the request to delete all tasks associated with the first SMF <NUM>-<NUM> has been completed. In some embodiments, the DeactivateAllTasks request message is a node-level message that doesn't have to include specific target identifiers. The UPF <NUM> can identify all the targets to be deactivated based on an identifier (e.g., an ADMFID) that is included in the DeactivateAllTasks request message.

In act <NUM> of the method <NUM>, the tasks associated with the first SMF <NUM>-<NUM> are removed and interception is stopped.

In act <NUM> of the method <NUM>, the second SMF <NUM>-<NUM> removes all destinations associated with the first SMF <NUM>-<NUM>. More specifically, act <NUM> of the method <NUM> includes acts <NUM>-<NUM> and <NUM>-<NUM> performed by the second SMF <NUM>-<NUM> and the UPF <NUM>. In act <NUM>-<NUM>, the second SMF <NUM>-<NUM> sends a RemoveAllDestinations request message to the UPF <NUM>. The RemoveAllDestinations request message includes a request to remove all destinations associated with the first SMF <NUM>-<NUM>. In act <NUM>-<NUM>, the UPF <NUM> sends a RemoveAllDestinations response message to the second SMF <NUM>-<NUM>. The RemoveAllDestinations response message acknowledges the receipt of the RemoveAllDestinations request message and indicates that the request to remove all destinations associated with the first SMF <NUM>-<NUM> has been completed. In some embodiments, the RemoveAllDestinations request message is a node-level message that doesn't have to include specific destination identifiers. The UPF <NUM> can identify all the destinations to be removed based on an identifier (e.g., an ADMFID) that is included in the RemoveAllDestinations request message.

In act <NUM> of the method <NUM>, the destinations associated with the first SMF <NUM>-<NUM> are removed.

In the following discussion, examples will be provided regarding various terms and phrases that are used in the above discussion.

The <NUM> system architecture includes many different network functions (NFs). A network function (NF) can refer to a functional building block within a network infrastructure. An NF can have well-defined external interfaces and well-defined functional behavior.

Some examples of NFs that are included in the <NUM> system architecture and that may be used to implement one or more aspects of the techniques disclosed herein include a user plane function (UPF), a session management function (SMF), an NF repository function (NRF), an unstructured data storage network function (UDSF), an access and mobility management function (AMF), and a lawful interception provisioning function (LIPF).

The UPF is defined in 3GPP TS <NUM>. The UPF provides the interconnect point between the mobile infrastructure and the Data Network (DN), i.e. encapsulation and decapsulation of GPRS Tunnelling Protocol for the user plane (GTP-U). The UPF also provides the Protocol Data Unit (PDU) session anchor point for providing mobility within and between Radio Access Technologies (RATs), including sending one or more end marker packets to the gNB. The UPF also provides packet routing and forwarding, including performing the role of an Uplink Classifier / UL-CL (directing flows to specific data networks based on traffic matching filters) and a branching point, when acting as an Intermediate UPF (I-UPF) multi-homed to more than one PDU session anchor (PSA). The UPF also provides application detection using Service Data Flow (SDF) traffic filter templates or <NUM>-tuple (protocol, server-side IP address and port number) Packet Flow Description (PFD) received from the SMF. The UPF also provides per-flow QoS handling, including transport level packet marking for uplink (UL) and downlink (DL), rate limiting and reflective QoS (DSCP) marking on the DL. The UPF also provides traffic usage reporting for billing and the Lawful Intercept (LI) collector interface.

A session management function (SMF) can be responsible for creating, updating, and removing PDU sessions, and managing session context with the UPF.

A network function repository function (NRF) can maintain a list of available NF instances and their profiles. The NRF can also perform service registration and discovery so that different NFs can find each other (e.g., via application programming interfaces (APIs)).

An unstructured data storage network function (UDSF) can be configured to support storage and retrieval of unstructured data by any NF.

An access and mobility management function (AMF) can be configured to receive all connection and session related information from UEs but is responsible only for handling connection and mobility management tasks. All messages related to session management can be forwarded to the SMF.

In 3GPP TS <NUM>, Intercept Related Information (IRI) is defined as the intercept related information as forwarded from the Mediation and Delivery Function <NUM> (over the LI_HI2 interface) to the Law Enforcement Monitoring Facility. An IRI event is defined as a network procedure or event that created an xIRI in the Point of Interception.

Although the systems and methods disclosed herein have been described with reference to <NUM> standards, the scope of the present disclosure is not limited to <NUM> systems. The concepts disclosed herein may also be applied to other wireless communication systems.

<FIG> illustrates certain components that can be included within a computing system <NUM>. The computing system <NUM> can be used to implement the actions and operations that have been described herein in connection with various network elements (e.g., an SMF set, a UDSF, an NRF, a UPF). In some embodiments, a plurality of computing systems <NUM> can collectively implement the actions and operations that have been described herein in connection with various network elements.

The computing system <NUM> includes a processor <NUM> and memory <NUM> in electronic communication with the processor <NUM>. Instructions 305a and data 307a can be stored in the memory <NUM>. The instructions 305a can be executable by the processor <NUM> to implement some or all of the methods, steps, operations, actions, or other functionality disclosed herein related to various network elements. Executing the instructions 305a can involve the use of the data 307a that is stored in the memory <NUM>. When the processor <NUM> executes the instructions 305a, various instructions 305b can be loaded onto the processor <NUM>, and various pieces of data 307b can be loaded onto the processor <NUM>.

Unless otherwise specified, any of the various examples of modules and components described herein in connection with a network element can be implemented, partially or wholly, as instructions 305a stored in memory <NUM> and executed by the processor <NUM>. Any of the various examples of data described herein in connection with a network element can be among the data 307a that is stored in memory <NUM> and used during execution of the instructions 305a by the processor <NUM>.

Although just a single processor <NUM> and a single memory <NUM> are shown in the computing system <NUM> of Figure <NUM>, in an alternative configuration, a combination of processors and/or a combination of memory devices could be used.

The instructions 305a in the memory <NUM> can include one or more modules that can be executable by the processor <NUM> to perform some or all aspects of the methods that have been described herein in connection with various network elements (e.g., the method <NUM> shown in <FIG>, the method <NUM> shown in <FIG>).

For example, if the computing system <NUM> implements one or more SMFs within an SMF set (e.g., the SMF set <NUM> shown in <FIG>), the instructions 305a can include one or more audit module(s) <NUM> that are configured to perform an audit mechanism as disclosed herein (e.g., an audit mechanism corresponding to acts <NUM> through <NUM> of the method <NUM> shown in <FIG>). The instructions 305a can also include one or more LI resource cleanup module(s) <NUM> that are configured to clean up hanging LI resources as disclosed herein (e.g., as in acts <NUM> through <NUM> of the method <NUM> shown in <FIG>).

As another example, if the computing system <NUM> implements a data store such as a UDSF (e.g., the UDSF <NUM> shown in <FIG>), the instructions 305a stored in the memory <NUM> can include one or more request handling module(s) <NUM> that are configured to respond to update requests (e.g., as in acts <NUM> and <NUM> in the method <NUM> shown in <FIG>).

The data 307a stored in the memory <NUM> can include any of the various examples of data described herein in connection with various network elements. For example, the data 307a stored in the memory <NUM> can represent data that is stored, accessed, or otherwise used in connection with the methods that have been described herein in connection with various network elements (e.g., the method <NUM> shown in <FIG>, the method <NUM> shown in <FIG>).

As another example, if the computing system <NUM> implements a data store such as a UDSF (e.g., the UDSF <NUM> shown in <FIG>), the data 307a stored in the memory <NUM> can include a plurality of identifiers <NUM>. In some embodiments, as discussed above, each SMF can be configured with the NEID as well as the NF instance ID of all other SMFs in the set.

The data 307a stored in the memory <NUM> can also include a plurality of auditing records <NUM>. The auditing records <NUM> shown in <FIG> can represent any of the auditing records described herein in connection with a UDSF (e.g., the auditing records <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> shown in <FIG>).

The specific instructions 305a and data 307a shown in <FIG> are provided for purposes of example only and should not be interpreted as limiting the scope of the present disclosure. A computing system <NUM> that implements any of the techniques disclosed herein can include other instructions 305a and/or other data 307a in addition to or instead of what is specifically shown in <FIG>.

The computing system <NUM> can also include various other components, including one or more communication interfaces <NUM>, one or more input devices <NUM>, and one or more output devices <NUM>.

The communication interface(s) <NUM> can be configured to communicate with other computing systems and/or networking devices. This includes receiving data transmissions from other computing systems and/or networking devices, and also sending data transmissions to other computing systems and/or networking devices.

The various components of the computing system <NUM> can be coupled together by one or more buses, which can include a power bus, a control signal bus, a status signal bus, a data bus, etc. For simplicity, the various buses are illustrated in Figure <NUM> as a bus system <NUM>.

The techniques disclosed herein can be implemented in hardware, software, firmware, or any combination thereof, unless specifically described as being implemented in a specific manner. Any features described as modules, components, or the like can also be implemented together in an integrated logic device or separately as discrete but interoperable logic devices. If implemented in software, the techniques can be realized at least in part by a non-transitory computer-readable medium having computer-executable instructions stored thereon that, when executed by at least one processor, perform some or all of the steps, operations, actions, or other functionality disclosed herein. The instructions can be organized into routines, programs, objects, components, data structures, etc., which can perform particular tasks and/or implement particular data types, and which can be combined or distributed as desired in various embodiments.

The term "processor" should be interpreted broadly to encompass a general-purpose processor, a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a controller, a microcontroller, a state machine, and so forth. Under some circumstances, a "processor" may refer to an application specific integrated circuit (ASIC), a programmable logic device (PLD), a field programmable gate array (FPGA), etc. The term "processor" may refer to a combination of processing devices, e.g., a combination of a digital signal processor (DSP) and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a digital signal processor (DSP) core, or any other such configuration.

The term "memory" should be interpreted broadly to encompass any electronic component capable of storing electronic information. The term "memory" may refer to various types of processor-readable media such as random access memory (RAM), read-only memory (ROM), non-volatile random access memory (NVRAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable PROM (EEPROM), flash memory, magnetic or optical data storage, registers, etc. Memory is said to be in electronic communication with a processor if the processor can read information from and/or write information to the memory. Memory that is integral to a processor is in electronic communication with the processor.

The terms "instructions" and "code" should be interpreted broadly to include any type of computer-readable statement(s). For example, the terms "instructions" and "code" may refer to one or more programs, routines, sub-routines, functions, procedures, etc. "Instructions" and "code" may comprise a single computer-readable statement or many computer-readable statements.

The term "determining" (and grammatical variants thereof) can encompass a wide variety of actions. For example, "determining" can include calculating, computing, processing, deriving, investigating, looking up (e.g., looking up in a table, a database or another data structure), ascertaining and the like.

The terms "comprising," "including," and "having" are intended to be inclusive and mean that there can be additional elements other than the listed elements. For example, any element or feature described in relation to an embodiment herein may be combinable with any element or feature of any other embodiment described herein, where compatible.

The steps, operations, and/or actions of the methods described herein may be interchanged with one another without departing from the scope of the claims. In other words, unless a specific order of steps, operations, and/or actions is required for proper functioning of the method that is being described, the order and/or use of specific steps, operations, and/or actions may be modified without departing from the scope of the claims.

In the above description, reference numbers have sometimes been used in connection with various terms. Where a term is used in connection with a reference number, this may be meant to refer to a specific element that is shown in one or more of the Figures. Where a term is used without a reference number, this may be meant to refer generally to the term without limitation to any particular Figure.

Claim 1:
A system (<NUM>) that enables hanging lawful interception, LI, resources to be cleaned up, the system comprising:
one or more processors (<NUM>);
a triggering function set comprising a plurality of triggering functions;
a data store comprising a plurality of auditing records (<NUM>) corresponding to the plurality of triggering functions in the triggering function set, wherein each auditing record comprises a claimant attribute; and
instructions that are executable by the one or more processors to:
cause each triggering function among the plurality of triggering functions to send an update request (<NUM>) to the data store in response to being notified about a failed triggering function within the triggering function set, wherein each update request (<NUM>) comprises a request to change ownership of the auditing record (<NUM>) corresponding to the failed triggering function;
select a triggering function as a new owner of the auditing record (<NUM>) corresponding to the failed triggering function based at least in part on a match between the claimant attribute (<NUM>) in the auditing record (<NUM>) and a claimant field (<NUM>) in the update request (<NUM>) sent by the triggering function; and
cause the new owner of the auditing record (<NUM>) corresponding to the failed triggering function to send at least one request to a triggered point of interception, POI, to remove an LI resource corresponding to the failed triggering function.