Patent Description:
Lawful Interception (LI) allows law enforcement agencies (LEAs) to obtain data from a communication network pursuant to lawful authority, e.g., a warrant, for the purpose of analysis or evidence. See, e.g., 3GPP Technical Specification (TS) <NUM> v17. <NUM> for LI as specified by 3GPP. According to LI, a point of interception (POI) in the communication network intercepts data and transfers the intercepted data to a network mediation device that is the mediator between the communication network and a law enforcement monitoring facility. After conditioning the intercepted data for transport, the network mediation device sends the data over a handover interface to the law enforcement monitoring facility.

The law enforcement monitoring facility's analysis of intercepted data may benefit from being able to discriminate intercepted data based on which of potentially multiple POls intercepted the data. According to known approaches, such as those captured in ETSI TS <NUM><NUM>-<NUM> V1. <NUM>, ETSI TS <NUM><NUM>-<NUM> V3. <NUM>, and ETSI TS <NUM><NUM>-<NUM> V3. <NUM>, the POI can send an identifier of the POI to the network mediation device along with the intercepted data, whereupon the network mediation device can transparently forward that identifier to the law enforcement monitoring facility. Problematically, though, the POI may not send its identifier under some circumstances, as it is optional to do so and only supported for certain services. Challenges exist, then, in reliably informing a law enforcement monitoring facility about the identity of a POI that intercepted data. The ETSI document LI(<NUM>)P57009R3, "Inclusion of an extended IPID parameter within the <NUM><NUM>-<NUM> PSHeader", discloses an Extended Interception Point Identifier (EIPID) in a PSHeader.

One object of the invention is to enable a more reliable way of lawful interception.

Some embodiments herein equip a network mediation device in a communication network with the ability to itself differentiate lawfully intercepted data based on which point of interception (POI) intercepted that data. Indeed, rather than just naively forwarding a POI identifier from the POI to a law enforcement monitoring facility, the network mediation device herein may actually determine which POI intercepted the data, e.g., based on information representing the network's topology, and then signal the identity of that POI to the law enforcement monitoring facility, e.g., by labeling the data with a header field whose value identifies the POI. With the network mediation device itself able to decide which identifier to use for identifying the POI that lawfully intercepted data, some embodiments herein provide POI identity information to a law enforcement monitoring facility in a more reliable way, with less reliance on the POI, so as to increase the value of lawful interception.

More particularly, embodiments herein include a method performed by a network mediation device in a communication network of a communication service provider. The method comprises receiving data intercepted at a point of interception in the communication network as part of a lawful interception service, and labelling the data with a field that has a value set to identify the point of interception at which the data was intercepted. In this case, labeling the data comprises determining the value to which to set the field based on information stored in the network mediation device indicating different values to which to respectively set the field for different possible points of interception in the communication network. The method also comprises sending the labeled data over a handover interface from the network mediation device towards a law enforcement monitoring facility.

In some embodiments, the value to which to set the field is determined based on a name of a network device at which the data was intercepted, and an interface used by the network device to provide the data to the network mediation device.

In some embodiments, the information in the network mediation device maps different possible combinations of values for identifying parameters to different possible values for the field, and the different possible combinations of values for the identifying parameters are respectively associated with the different possible points of interception in the communication network. In one such embodiment, labeling the data comprises determining which combination of values for the identifying parameters is associated with the point of interception at which the data was intercepted, consulting the information stored in the network mediation device to determine which possible value for the field is mapped to the determined combination of values, and setting the value of the field to the determined value.

In some embodiments, the field is an interceptionPointlD field within a packet switched header.

In some embodiments, the method also comprises receiving the information from a lawful interception administrative device in the communication network.

In some embodiments, the labeling comprises labeling the data with another field that has a value set to identify the network mediation device.

Other embodiments include a method performed by a lawful interception administrative device in a communication network of a communication service provider. The method comprises transmitting, to a network mediation device in the communication network, information indicating, for each of different possible points of interception at which data is interceptable as part of a lawful interception service in the communication network, a value of a field with which the network mediation device is to label the data for sending over a handover interface towards a law enforcement monitoring facility.

In some embodiments, the value of the field with which the network mediation device is to label the data is a function of a name of a network device at which the data was intercepted, and an interface used by the network device to provide the data to the network mediation device. In one or more of these embodiments, the value of the field with which the network mediation device is to label the data is a function also of a name of the communication service provider or the communication network within which the network device is deployed, and a country within which the data was intercepted.

In some embodiments, the information maps different possible combinations of values for identifying parameters to different possible values for the field, and the different possible combinations of values for the identifying parameters are respectively associated with the different possible points of interception in the communication network. In one or more of these embodiments, the identifying parameters include a device parameter whose value indicates a name of a network device at which the data was intercepted, an interface parameter whose value indicates an interface used by the network device to provide the data to the network mediation device, a parameter whose value indicates a name of the communication service provider or the communication network within which the network device is deployed, and a country parameter whose value indicates a country within which the data was intercepted. In one or more of these embodiments, the method further comprises generating, for each of the different possible combinations of values for the identifying parameters, the possible value for the field mapped to that possible combination of values for the identifying parameters as a hash of that possible combination of values.

Other embodiments herein include a network mediation device configured for use in a communication network of a communication service provider. The network mediation device is configured to receive data intercepted at a point of interception in the communication network as part of a lawful interception service, and label the data with a field that has a value set to identify the point of interception at which the data was intercepted, In this case, labeling the data comprises determining the value to which to set the field based on information stored in the network mediation device indicating different values to which to respectively set the field for different possible points of interception in the communication network. The network mediation device is also configured to send the labeled data over a handover interface from the network mediation device towards a law enforcement monitoring facility.

In some embodiments, the network mediation device is configured to perform the method described above for a network mediation device.

Other embodiments herein include a lawful interception administrative device configured for use in a communication network of a communication service provider. The lawful interception administrative device is configured to transmit, to a network mediation device in the communication network, information indicating, for each of different possible points of interception at which data is interceptable as part of a lawful interception service in the communication network, a value of a field with which the network mediation device is to label the data for sending over a handover interface towards a law enforcement monitoring facility.

In some embodiments, the lawful interception administrative device is configured to perform the method described above for the lawful interception administrative device.

<FIG> shows a communication network <NUM> of a communication service provider (CSP) according to some embodiments. The communication network <NUM> provides communication service to one or more communication devices, one of which is shown as communication device <NUM>. In the specific example of <FIG>, the communication network <NUM> is a wireless communication network, in which case the communication network <NUM> provides the communication service over a wireless communication interface with communication device(s).

The communication network <NUM> as shown provides a lawful interception (LI) service to a law enforcement agency (LEA) <NUM>. The communication network <NUM> in this regard intercepts data <NUM> pursuant to lawful authority, e.g., a warrant, and provides the intercepted data <NUM> to a law enforcement monitoring facility <NUM> associated with the LEA <NUM>, for the purpose of analysis or evidence. The law enforcement monitoring facility <NUM> may for example comprise one or more law enforcement devices, e.g., configurable to monitor data <NUM> intercepted by the LI service.

In some embodiments, the data <NUM> that the communication network <NUM> intercepts as part of LI includes copies of the content of communications transmitted to and/or from a communication device <NUM>. The content of communications may, for example, include any material or information concerning the substance, purport, or meaning of the communications. Alternatively or additionally, the intercepted data <NUM> may include material or information related to the interception of communications transmitted to and/or from a communication device <NUM>. Such intercepted-related information (IRI) may for example include dialing, signaling, or addressing information that identifies the origin, direction, destination, or termination of each communication generated or received by a subscriber by means of any equipment, facility, or service of a service provider. This may include for instance parameters of the signaling information that can be used as a means to subscribe to or activate features of the service, or establish and control a communication attempt. Generally, then, in some embodiments, the data <NUM> that the communication network <NUM> intercepts may include copies of network traffic that contain material related to IRI or material related to IRI and the content of communications.

There are multiple points <NUM> in the communication network <NUM> at which data <NUM> can be intercepted as part of LI. Each such point <NUM> is referred to herein as a point of interception (POI). A POI <NUM> may be a physical, logical, or functional point at which data <NUM> is intercepted. A POI <NUM> may for instance be, or be hosted at, an access element, a network connectivity element, or a service element in the communication network <NUM>, e.g., as defined in ETSI TR <NUM><NUM>. A POI <NUM> may correspondingly intercept data <NUM> at one or more protocol layers, e.g., physical, data link, network, or application layer. In embodiments where the communication network <NUM> has a service-based architecture with a set of interconnected network functions (NFs), a POI <NUM> may be a sub-function of an NF in the communication network <NUM>, e.g., where each NF may implement one or more POls. Where the communication network <NUM> is a <NUM> network, for instance, the communication network <NUM> may include NFs such as an Access and Mobility Function (AMF), a Session Management Function (SMF), a User Data Management (UDM) function, etc., in which case a POI <NUM> may be a sub-function of an AMF, SMF, UDM, etc. Different POls <NUM> may intercept different types of data <NUM> and/or in different formats. For example, a POI <NUM> implemented as an access element may produce intercepted data <NUM> in the form of a Physical layer Protocol Data Unit (PDU), a Data Link layer PDU, or a Network layer (e.g., Internet Protocol, IP) Datagram, whereas a POI <NUM> implemented at a network connectivity element may produce intercepted data <NUM> in the form of a Network layer (e.g., IP) Datagram and a POI <NUM> implemented at a service element may produce intercepted data <NUM> in the form of an Application layer transaction or application level PDU.

No matter the particular nature of the POIs <NUM> in the communication network <NUM>, the communication network <NUM> according to embodiments herein sends the law enforcement monitoring facility <NUM> information that identifies at which POI <NUM> data <NUM> was intercepted. Some embodiments herein advantageously provide this identity information to the law enforcement monitoring facility <NUM> in a reliable way, so as to increase the value of lawful interception to the LEA <NUM>.

Some embodiments in this regard exploit a network mediation device <NUM> for this purpose. In one embodiment, the network mediation device <NUM> implements or hosts a mediation function (MF), e.g. as defined by ETSI TS <NUM><NUM> V1. <NUM>, or a mediation and delivery function (MDF), e.g., as defined by ETSI TS <NUM><NUM>-<NUM> V3.

The network mediation device <NUM> as shown receives data <NUM> intercepted at a POI <NUM> as part of the LI service. The POI <NUM> may for example encapsulate the intercepted data <NUM> into PDUs defined for an interface <NUM> between the POI <NUM> and then send a binary stream of the PDUs to the network mediation device <NUM> over the interface <NUM>, e.g., where each PDU may contain intercepted data <NUM> as well as a set of header fields and/or a set of attributes for conveying identifiers, routing information, correlation information, and/or metadata about the intercepted data <NUM>. In one embodiment, for instance, the interface <NUM> between the POI <NUM> and the network mediation device <NUM> may be an X2 interface or an X3 interface, e.g., as specified by ETSI TS <NUM><NUM>-<NUM> V1.

In receipt of the intercepted data <NUM> from the POI <NUM>, the network mediation device <NUM> performs any necessary translation, correlation, and/or mediation for onward handover of the intercepted data <NUM> to the law enforcement monitoring facility <NUM>. The network mediation device <NUM> in this regard labels the intercepted data <NUM> with one or more fields, e.g., to allow the intercepted data <NUM> to be identified, ordered, etc. In some embodiments, the field(s) are prepended to the intercepted data <NUM> in the form of a header, although the field(s) may be added anywhere (e.g., in a footer) or as part of an overall enveloping process. No matter the particular type or location of the added field(s), by labeling the intercepted data <NUM> in this way, the network mediation device <NUM> produces labeled data <NUM>. The network mediation device <NUM> then sends this labeled data <NUM> over a handover interface <NUM> towards the law enforcement monitoring facility <NUM>.

For example, in some embodiments where the network mediation device <NUM> receives the intercepted data <NUM> from the POI <NUM> as a binary stream of PDUs defined for the interface <NUM>, the network mediation device <NUM> produces, from that binary stream of PDUs, labeled data <NUM> in the form of one or more PDUs defined for a handover interface <NUM> with the law enforcement monitoring facility <NUM>. The network mediation device <NUM> may for instance aggregate a set of PDUs received on the interface <NUM> with the POI <NUM>, and then label the aggregated PDUs with one or more fields, to produce labeled data <NUM> in the form of a PDU defined for the handover interface <NUM>.

In any event, the network mediation device <NUM> as shown labels the intercepted data <NUM> with a field <NUM> that has a value set to identify the POI <NUM> at which the data <NUM> was intercepted. The field <NUM> may for instance be a field defined on the handover interface <NUM>, e.g., such that the POI <NUM> at which the data <NUM> was intercepted is identifiable at the handover interface level. For example, in some embodiments, the field <NUM> is an interceptionPointlD field within a packet switched (PS) header. In these and other embodiments, the intercepted data <NUM> may be labeled with such a field <NUM> in addition to another field (e.g., a Network Element ID field) which has a value set to identify the network mediation device <NUM>.

Notably, the network mediation device <NUM> in some embodiments determines the value to which to set the field <NUM> based on information <NUM> in the network mediation device <NUM> (i.e. stored in the network mediation device) indicating different values V-<NUM>. V-N to which to respectively set the field <NUM> for different possible POIs (POI-<NUM>. POI-N) in the communication network <NUM>. As shown in <FIG>, for instance, the information <NUM> indicates the network mediation device <NUM> is to set the field <NUM> to value V-<NUM> to indicate that data <NUM> was intercepted at POI-<NUM>, to value V-N to indicate that data <NUM> was intercepted at POI-N, etc. The information <NUM> may thereby map POIs <NUM> in the communication network <NUM> to respective values for the field <NUM>, e.g., based on or consistent with a topology of the communication network <NUM>. The value of the field <NUM> may thereby effectively operate as an identity of the POI <NUM> that intercepted data <NUM>, e.g., an identity of the internal network point where the data <NUM> was fetched. For instance, different values of the field <NUM> may function as identities of different POIs <NUM>. In one or more embodiments, a lawful interception administrative device <NUM> (e.g., implementing an Administrative Function, ADMF) configures the network mediation device <NUM> with this information <NUM>, e.g., according to the network topology.

By equipping the network mediation device <NUM> with this information <NUM>, some embodiments effectively equip the network mediation device <NUM> with the ability to itself decide which value to signal on the handover interface <NUM> for identifying which POI <NUM> intercepted the data <NUM>. In one or more embodiments, for example, the network mediation node <NUM> may actually determine which POI <NUM> intercepted the data <NUM> and then determine, from the information <NUM>, to which value to set the field <NUM> for identifying that POI <NUM> to the law enforcement monitoring facility <NUM>. Especially in embodiments where the network mediation device <NUM> receives the information <NUM> from a lawful interception administrative device <NUM> (e.g., implementing an Administrative Function, ADMF), the network mediation device's ability to inform the law enforcement monitoring facility <NUM> about the identity of the POI <NUM> that intercepted the data <NUM> is not dependent on the POI <NUM> informing the network mediation device <NUM> about what identity the network mediation device <NUM> is to use for identifying the POI <NUM> over the handover interface <NUM>. That is, in embodiments herein, the network mediation device <NUM> need not rely on the POI <NUM> to send its POI identifier over interface <NUM> in order for the network mediation device <NUM> to be able to identify that POI <NUM> on the handover interface <NUM> as the origin of the intercepted data <NUM>. Indeed, the network mediation device <NUM> in some embodiments does not need to receive a POI identifier from the POI <NUM> on interface <NUM> and/or does not just naively forward such a POI identifier to the law enforcement monitoring facility <NUM> over the handover interface <NUM>. Rather, the network mediation device <NUM> itself implements the logic to determine, based on information <NUM>, to what value to set the field <NUM> for identifying the POI <NUM> to the law enforcement monitoring facility <NUM>.

With the network mediation device <NUM> itself able to decide which value to use for identifying the POI <NUM> that lawfully intercepted data <NUM>, some embodiments herein identify the POI <NUM> to the law enforcement monitoring facility <NUM> in a more reliable way, with less reliance on the POI <NUM> and/or the interface <NUM> with the POI <NUM>. In fact, some embodiments herein are able to identify the POI <NUM> to the law enforcement monitoring facility <NUM> on the handover interface <NUM> even if the POI <NUM> does not signal any identity over interface <NUM> that the network mediation device <NUM> could forward on the handover interface <NUM> for identifying the POI <NUM>, e.g., which may be the case for certain services and/or for certain POIs that lack support for signaling such identity over interface <NUM>. Some embodiments accordingly are able to identify the POI <NUM> on the handover interface <NUM> in a service-agnostic way and/or in a way that is more resilient to POI capabilities and/or signaling. By improving the availability and/or reliability of information on the handover interface <NUM> that identifies the POI <NUM> which intercepted data <NUM>, embodiments herein increase the value of lawful interception to law enforcement.

More particularly, in some embodiments, different POIs <NUM> in the communication network <NUM> are associated with different combinations of values for certain parameters, e.g., as signaled over interface <NUM> or as otherwise determinable by the network mediation device <NUM>. <FIG> shows one example implementation of information <NUM> in the network mediation device <NUM> in these embodiments, where there are X identifying parameters, shown as PARAM-<NUM> through PARAM-X. As shown, N different possible combinations <NUM>-<NUM>. <NUM>-N of values for the identifying parameters PARAM-<NUM>. PARAM-X are respectively associated with N different possible POIs, namely POI-<NUM>. The information <NUM> in the network mediation device <NUM> maps these N different possible combinations <NUM>-<NUM>. <NUM>-N of values for the identifying parameters PARAM-<NUM>. PARAM-X to different possible values V-<NUM>. V-N for the field <NUM>. For example, for each of the N different possible combinations <NUM>-<NUM>. <NUM>-N of values for the identifying parameters PARAM-<NUM>. PARAM-X, the possible value for the field <NUM> mapped to that possible combination may be a hash of that possible combination of values. As shown in the example of <FIG>, for instance, the combination <NUM>-<NUM> of values associated with POI-<NUM> is mapped to a value V-<NUM> equal to a hash of that combination <NUM>-<NUM> of values, e.g., where the hash comprises a hash of a concatenation of those values. Similarly, the combination <NUM>-N of values associated with POI-N is mapped to a value V-N equal to a hash of that combination <NUM>-N of values. In one example, the hash function may be implemented with a Cyclic Redundancy Check (CRC) function which guarantees the uniqueness of the output with the same input, e.g., a CRC-<NUM> function guarantees an <NUM> character length string value.

In these and other embodiments, the network mediation device <NUM> may receive or otherwise determine a combination of values for the identifying parameters which is asserted as being associated with the POI <NUM> at which the data <NUM> was intercepted, e.g., where the asserted combination may be asserted by the POI <NUM> itself and received from the POI <NUM> over interface <NUM> along with the intercepted data <NUM>. The network mediation device <NUM> may then consult the information <NUM> in the network mediation device <NUM> (e.g., a look-up of the information stored in a look-up table in the network mediation device <NUM>)) to determine which possible value V-<NUM>. V-N for the field <NUM> is mapped to the asserted combination of values. The network mediation device <NUM> in this case sets the value of the field <NUM> to the determined value.

Note, though, before consulting the information <NUM> in the network mediation device <NUM> to determine which possible value V-<NUM>. V-N for the field <NUM> is mapped to the asserted combination of values, the network mediation device <NUM> in some embodiments validates the asserted combination of values as being a valid combination of values in the communication network <NUM>. Such validation may for instance safeguard against unauthorized interception, e.g., maliciously attempted with a combination of values that is not defined according to the network topology. In these embodiments, then, based on validating the asserted combination of values, the network mediation device <NUM> may determine (i.e., verify) that the asserted combination of values is actually associated with the POI <NUM> at which the data <NUM> was intercepted.

<FIG> illustrates one example where the identifying parameters <NUM>-<NUM>. <NUM>-N include (i) a device parameter whose value indicates a name of a network device at which data <NUM> was intercepted; (ii) an interface parameter whose value indicates an interface used by the network device to provide data <NUM> to the network mediation device <NUM>; (iii) a parameter whose value indicates a name of the CSP or the communication network <NUM> within which the network device is deployed; and (iv) a country parameter whose value indicates a country within which the data <NUM> was intercepted. In this case, then, the information <NUM> in the network mediation device <NUM> comprises a first combination <NUM>-<NUM> of values for the identifying parameters, including a value <NUM>-1a for the device parameter, a value <NUM>-1b for the interface parameter, a value <NUM>-1c for the provider/network parameter, and a value <NUM>-1d for the country parameter. The information <NUM> maps this first combination <NUM>-<NUM> of values for the identifying parameters to a value V-<NUM> for the field <NUM> that is equal to a hash of the concatenation of those values <NUM>-1a, <NUM>-1b, <NUM>-1c, and <NUM>-1d. The information <NUM> maps one or more other combinations of values for the identifying parameters to one or more other values for the field <NUM> in a similar way, e.g., as shown for POI-N.

Some embodiments herein are applicable in the case where the handover interface <NUM> is specified by ETSI, e.g., according to ETSI TS <NUM><NUM> parts, ETSI TS <NUM><NUM>, and ETSI TS <NUM><NUM>-<NUM> defining the data <NUM> intercepted per service (e.g., Messaging services, L2 services, Internet Access Service, IP Multimedia and Mobile services). In one or more such embodiments, the field <NUM> herein may be an InterceptionPointID field within a PSHeader as specified by ETSI TS <NUM><NUM> parts. The value of the interceptionPointID field may be set as described above to identify the POI <NUM> which intercepted data <NUM>, regardless of the service for which data was intercepted in the communication network <NUM> and/or regardless of network conditions. In some embodiments as described below, the network mediation device <NUM> is exemplified as implementing an MDF and the lawful interception administrative device <NUM> is exemplified as implementing an ADMF.

In some embodiments, for example, the MDF receives intercepted data <NUM> from the POI <NUM> and labels the intercepted data <NUM> with a PSHeader as shown below, with the intercepted data <NUM> constituting the payload of the PS-PDU.

In some embodiments, the PSHeader is as shown below, where the field <NUM> is the interceptionPointlD field:
<IMG>
<IMG>.

Note in this regard that the interceptionPointlD field as an implementation of the field <NUM> may be distinguished from a Network Element ID (NEID) field as specified by ETSI TS <NUM><NUM> parts. The NEID field by contrast may identify the MDF.

Furthermore, the interceptionPointID field may be distinguished from an Network Function ID (NFID) field and an extended InterceptionPointID (IPID) field on the handover interface, as the network mediation device <NUM> may naively set the values of these fields to whatever values the POI <NUM> indicates (if at all) to the MDF on the interface <NUM> (e.g., X2/X3 interface), e.g., according to ETSI TS <NUM><NUM>-<NUM>. Moreover, the MDF may only receive such values from the POI <NUM> when the data <NUM> intercepted is for mobile services (TS <NUM><NUM>-<NUM>) and when the POI <NUM> supports such signaling. In fact, both the NFID field and the extended IPID field may be optional, e.g., according to TS <NUM><NUM>-<NUM>, even when transferring the 3GPP TS <NUM> payload. In one or more such embodiments, the PSHeader may be as shown below, with the field <NUM> being the interceptionPointlD field as before:
<IMG>.

In one or more embodiments where the field <NUM> is the interceptionPointlD field in the PSHeader on the handover interface, the value of the interceptionPointlD field will contain or indicate all information needed to recognize the origin of the interception data. The value of the interceptionPointID field may for instance indicate (<NUM>) the country where the LI system is deployed; (<NUM>) the name of the CSP; (<NUM>) the name of the Network Virtual Function as specified in LI system; and (<NUM>) the point of interception within the Network Virtual Function. interceptionPointID field may thereby be used by the law enforcement monitoring facility <NUM> to recognize if the received intercepted data <NUM> has been provided by the same origin in a near real time fashion.

Certain embodiments may provide one or more of the following technical advantage(s). For the operator (CSP), some embodiments identify the POI <NUM> to the law enforcement monitoring facility <NUM> acting only on the MDF in the CSP domain, i.e., not relying on the availability of the related parameters over X interface. For example, the value of the inerceptionPointID parameter may be guaranteed even in case of missing related information on the X interface with the POI <NUM> and/or in case of a non-standard X interface with the POI <NUM>. Alternatively or additionally, some embodiments identify the POI <NUM> to the law enforcement monitoring facility <NUM> regardless of the interception domain conditions and/or regardless of the type of service for which the data <NUM> is intercepted (e.g., regarding of mobile services or not).

More particularly, some embodiments exploit ADMF and MDF functions which communicate over an X1 interface (ETSI TS <NUM><NUM>-<NUM>). The ADMF function is in charge of warrant administration and for this reason it needs to know in advance the network topology involved in the interception scenarios. The network topology can be manually defined by the operator or it can be automatically configured by the LI-NFV controller once the Network Function is instantiated (ETSI GR NFV SEC-<NUM>). The MDF function is responsible to provide interception data over the handover interface <NUM>, e.g., according to ETSI and 3GPP standards.

In this context, some embodiments define a value for the "interceptionPointID" parameter (in the PSHeader on the handover interface <NUM>) that is based on information handled by the ADMF and MDF functions; in particular, (i) the country where the LI system is deployed (two digits according to "ISO <NUM>-<NUM> alpha-<NUM>" standard); (ii) the name of the CSP defined in the ADMF function in terms of a sequence of strings (i.e., "operator1", "operator2"); (iii) the name of the Network Virtual Function acting as Point Of Interception (where the name is defined by ADMF function in LI system (i.e., "AMF1", "AMF2", "SMF1", "SMF2")); and (iv) Point Of Interception (POI) which may be the IP address and port number used by the Point Of Interception function to provide interception data to LI system (i.e., "<NUM>. <NUM>:<NUM>"). In some embodiments, the value of the interceptionPointlD field itself explicitly indicates the values of (i)-(iv). In other embodiments, by contrast, the value of the interceptionPointlD field is simply based on the values of (i)-(iv), such that the interceptionPointID field has different values for different combinations of values for (i)-(iv). These latter embodiments may be appropriate for instance where the law enforcement monitoring facility <NUM> is mainly interested in quickly recognizing the origin of incoming HI2 traffic in order to group the traffic accordingly, such that it the law enforcement monitoring facility <NUM> is not so much interested in the actual values for (i)-(iv) as it is in recognizing different combinations of values for (i)-(iv).

In one or more such embodiments, the MDF stores information <NUM> in the form of a memory mapping table, called "LiDataOriginTable", as exemplified in Table1 below:.

The value of the interceptionPointlD field is a hexadecimal value without 0x prefix and it is the result of a CRC-<NUM> function applied to the string composed by country, operator, node, poi without a separation character as reported below:.

The function output is saved as a string in the interceptionPointID column without "0x" prefix. The Cyclic Redundancy Check (CRC) function guarantees the uniqueness of the output with the same input. In addition, the CRC-<NUM> function guarantees an <NUM> character length string value as required by the ETSI standard.

In some embodiments, the parameters of Table <NUM>, except the interceptionPointlD field, are known at network topology configuration in the ADMF. In one such embodiment, these parameters are changed upon and according to network modification. With the network topology definition being a prerequisite for LI, the ADMF in some embodiments herein is in charge of creating and modifying the LiDataOriginTable table at the network topology definition and its modification. The table is shared among MDFs in the communication network <NUM> for consultation once LI traffic is intercepted.

<FIG> shows one example of how the ADMF creates and modifies the "LiDataOriginTable" according to some embodiments. As shown, upon the definition or modification of the network topology, the ADMF computes the interceptionPointlD for the combination of values (country, operator, node, point of interception) using a CRC-<NUM> function.

<FIG> shows use of the LiDataOriginTable by the MDF under normal operation according to some embodiments. As shown, an AMF1 intercepts data <NUM> and sends the intercepted data to the MDF. The MDF validates the intercepted data based on the network topology in order to avoid unauthorized interception. The MDF may for example validate that the intercepted data <NUM> was intercepted by a valid node (AMF1) in terms of IP address and port according to the defined network topology. The MDF may alternatively or additionally validate that the intercepted data <NUM> was intercepted based on a valid warrant.

During or after the validation check, the MDF retrieves all of the needed information to build the key for the LiDataOriginTable table: country, operator, node and Point Of Interception. The key is used to direct access the table and uniquely retrieve the value of interceptionPoindlD field. The MDF uses such value, together with the other relevant LI data, to fill the PSHeader in the HI2 packet. The MDF then sends the HI2 packet to the law enforcement monitoring facility <NUM>, shown in <FIG> as a law enforcement agency (LEA).

Note that, in some embodiments, the law enforcement monitoring facility <NUM> simply groups intercepted data <NUM> (in the form of PDUs) based on the POI <NUM> which intercepted that data <NUM>. In this case, the law enforcement monitoring facility <NUM> need not determine the combination of values for country, operator, node, and point of interception fields which correspond to the interceptionPointlD field received from the MDF. In other embodiments, though, the law enforcement monitoring facility <NUM> may actually obtain the combination of values for country, operator, node, and point of interception fields which correspond to the interceptionPointlD field received from the MDF. For example, based on the actual requirements common to European LEAs, the ETSI e-warrant interface (ETSI TS <NUM><NUM>) may be enhanced to manage the request and response dialogue between LEA and CSP to provide LEA with all relevant information to identify the internal NE/NF POls entities based on values of the above interceptionPointlD received by LEA on HI. This ETSI enhancement may guarantee backward compatibility aspects. In one such embodiment, the LEA can interrogate "LiDataOriginTable" via HI1 interface in order to fetch the details of the origin of the interception in terms of [country, operator, node, poi] according to investigation needs.

Advantageously, some embodiments herein do not introduce delay in LI processing and/or delivery. Indeed, in some embodiments, the ADMF creates the LiDataOriginTable table at customer network topology definition. Once a node is deployed in the communication network <NUM>, the operator needs to define it also on the LI system specifying several parameters included the Country, the Operator, the name of the Node and the Point Of Interception fields. In some embodiments, then, the creation of the table is not performed during LI operation, meaning that table creation does not introduce delay during operation.

Moreover, the consultation of the table performed by the MDF during LI operation is intended to not affect LI delivery performance in some embodiments, since the key to direct access the table is already retrieved at data validation checks.

Furthermore, the table in some embodiments is permanently stored in the ADMF and the table may be loaded in memory by the MDF for faster consultation.

In view of the modifications and variations herein, <FIG> depicts a method performed by a network mediation device <NUM> in a communication network <NUM> of a communication service provider in accordance with particular embodiments. The method includes receiving data <NUM> intercepted at a point of interception <NUM> in the communication network <NUM> as part of a lawful interception service (Block <NUM>). The method also comprises labelling the data <NUM> with a field <NUM> that has a value set to identify the point of interception <NUM> at which the data <NUM> was intercepted (Block <NUM>). In some embodiments, labeling the data <NUM> comprises determining the value to which to set the field <NUM> based on information <NUM> in the network mediation device <NUM> indicating different values to which to respectively set the field <NUM> for different possible points of interception in the communication network <NUM> (Block <NUM>). The method further comprises sending the labeled data over a handover interface <NUM> from the network mediation device <NUM> towards a law enforcement monitoring facility <NUM> (Block <NUM>).

In some embodiments, the method comprises receiving the information <NUM> from a lawful interception administrative device <NUM> in the communication network <NUM> (Block <NUM>).

In some embodiments, the value to which to set the field <NUM> is determined based on a name of a network device at which the data <NUM> was intercepted, and an interface used by the network device to provide the data <NUM> to the network mediation device <NUM>. In one or more of these embodiments, the value to which to set the field <NUM> is determined based also on a name of the communication service provider or the communication network <NUM> within which the network device is deployed, and a country within which the data <NUM> was intercepted.

In some embodiments, the information <NUM> in the network mediation device <NUM> maps different possible combinations of values for identifying parameters to different possible values for the field <NUM>, and the different possible combinations of values for the identifying parameters are respectively associated with the different possible points of interception in the communication network <NUM>. In one such embodiment, labeling the data <NUM> comprises determining which combination of values for the identifying parameters is associated with the point of interception <NUM> at which the data <NUM> was intercepted, consulting the information <NUM> in the network mediation device <NUM> to determine which possible value for the field <NUM> is mapped to the determined combination of values, and setting the value of the field <NUM> to the determined value. In one or more of these embodiments, the identifying parameters include a device parameter whose value indicates a name of a network device at which the data <NUM> was intercepted, an interface parameter whose value indicates an interface used by the network device to provide the data <NUM> to the network mediation device <NUM>, a parameter whose value indicates a name of the communication service provider or the communication network <NUM> within which the network device is deployed, and a country parameter whose value indicates a country within which the data <NUM> was intercepted. In one or more of these embodiments, for each of the different possible combinations of values for the identifying parameters, the possible value for the field <NUM> mapped to that possible combination of values for the identifying parameters is a hash of that possible combination of values. In one or more of these embodiments, the method further comprises receiving an asserted combination of values for the identifying parameters which is asserted as being associated with the point of interception <NUM> at which the data <NUM> was intercepted, validating the asserted combination of values as being a valid combination of values in the communication network <NUM>, and based on validating the asserted combination of values, determining that the asserted combination of values for the identifying parameters is associated with the point of interception <NUM> at which the data <NUM> was intercepted.

In some embodiments, the field <NUM> is an interceptionPointlD field within a packet switched header.

<FIG> depicts a method performed by a lawful interception administrative device <NUM> in a communication network <NUM> of a communication service provider in accordance with other particular embodiments. The method includes transmitting, to a network mediation device <NUM> in the communication network <NUM>, information <NUM> indicating, for each of different possible points of interception at which data <NUM> is interceptable as part of a lawful interception service in the communication network <NUM>, a value of a field <NUM> with which the network mediation device <NUM> is to label the data <NUM> for sending over a handover interface <NUM> towards a law enforcement monitoring facility <NUM> (Block <NUM>).

In some embodiments, the method also comprises generating the values of the field <NUM> for each of the different possible points of interception (Block <NUM>).

In some embodiments, the value of the field <NUM> with which the network mediation device <NUM> is to label the data <NUM> is a function of a name of a network device at which the data <NUM> was intercepted, and an interface used by the network device to provide the data <NUM> to the network mediation device <NUM>. In one or more of these embodiments, the value of the field <NUM> with which the network mediation device <NUM> is to label the data <NUM> is a function also of a name of the communication service provider or the communication network <NUM> within which the network device is deployed, and a country within which the data <NUM> was intercepted.

In some embodiments, the information <NUM> maps different possible combinations of values for identifying parameters to different possible values for the field <NUM>, and the different possible combinations of values for the identifying parameters are respectively associated with the different possible points of interception in the communication network <NUM>. In one or more of these embodiments, the identifying parameters include a device parameter whose value indicates a name of a network device at which the data <NUM> was intercepted, an interface parameter whose value indicates an interface used by the network device to provide the data <NUM> to the network mediation device <NUM>, a parameter whose value indicates a name of the communication service provider or the communication network <NUM> within which the network device is deployed, and a country parameter whose value indicates a country within which the data <NUM> was intercepted. In one or more of these embodiments, the method further comprises generating, for each of the different possible combinations of values for the identifying parameters, the possible value for the field <NUM> mapped to that possible combination of values for the identifying parameters as a hash of that possible combination of values.

Embodiments herein also include corresponding apparatuses. Embodiments herein for instance include a network mediation device <NUM> configured to perform any of the steps of any of the embodiments described above for the network mediation device <NUM>.

Embodiments also include a network mediation device <NUM> comprising processing circuitry and power supply circuitry. The processing circuitry is configured to perform any of the steps of any of the embodiments described above for the network mediation device <NUM>. The power supply circuitry is configured to supply power to the network mediation device <NUM>.

Embodiments further include a network mediation device <NUM> comprising processing circuitry. The processing circuitry is configured to perform any of the steps of any of the embodiments described above for the network mediation device <NUM>. In some embodiments, the network mediation device <NUM> further comprises communication circuitry.

Embodiments further include a network mediation device <NUM> comprising processing circuitry and memory. The memory contains instructions executable by the processing circuitry whereby the network mediation device <NUM> is configured to perform any of the steps of any of the embodiments described above for the network mediation device <NUM>.

Embodiments herein also include a lawful interception administrative device <NUM> configured to perform any of the steps of any of the embodiments described above for the lawful interception administrative device <NUM>.

Embodiments also include a lawful interception administrative device <NUM> comprising processing circuitry and power supply circuitry. The processing circuitry is configured to perform any of the steps of any of the embodiments described above for the lawful interception administrative device <NUM>. The power supply circuitry is configured to supply power to the lawful interception administrative device <NUM>.

Embodiments further include a lawful interception administrative device <NUM> comprising processing circuitry. The processing circuitry is configured to perform any of the steps of any of the embodiments described above for the lawful interception administrative device <NUM>. In some embodiments, the lawful interception administrative device <NUM> further comprises communication circuitry.

Embodiments further include a lawful interception administrative device <NUM> comprising processing circuitry and memory. The memory contains instructions executable by the processing circuitry whereby the lawful interception administrative device <NUM> is configured to perform any of the steps of any of the embodiments described above for the lawful interception administrative device <NUM>.

More particularly, the apparatuses described above may perform the methods herein and any other processing by implementing any functional means, modules, units, or circuitry. In one embodiment, for example, the apparatuses comprise respective circuits or circuitry configured to perform the steps shown in the method figures. The circuits or circuitry in this regard may comprise circuits dedicated to performing certain functional processing and/or one or more microprocessors in conjunction with memory. For instance, the circuitry may include one or more microprocessor or microcontrollers, as well as other digital hardware, which may include digital signal processors (DSPs), special-purpose digital logic, and the like. The processing circuitry may be configured to execute program code stored in memory, which may include one or several types of memory such as read-only memory (ROM), random-access memory, cache memory, flash memory devices, optical storage devices, etc. Program code stored in memory may include program instructions for executing one or more telecommunications and/or data communications protocols as well as instructions for carrying out one or more of the techniques described herein, in several embodiments. In embodiments that employ memory, the memory stores program code that, when executed by the one or more processors, carries out the techniques described herein.

<FIG> for example illustrates a network mediation device <NUM> as implemented in accordance with one or more embodiments. As shown, the network mediation device <NUM> includes processing circuitry <NUM> and communication circuitry <NUM>. The communication circuitry <NUM> (e.g., radio circuitry) is configured to transmit and/or receive information to and/or from one or more other nodes, e.g., via any communication technology. Such communication may occur via one or more antennas that are either internal or external to the network mediation device <NUM>. The processing circuitry <NUM> is configured to perform processing described above, e.g., in <FIG>, such as by executing instructions stored in memory <NUM>. The processing circuitry <NUM> in this regard may implement certain functional means, units, or modules.

<FIG> illustrates a lawful interception administrative device <NUM> as implemented in accordance with one or more embodiments. As shown, the lawful interception administrative device <NUM> includes processing circuitry <NUM> and communication circuitry <NUM>. The communication circuitry <NUM> is configured to transmit and/or receive information to and/or from one or more other nodes, e.g., via any communication technology. The processing circuitry <NUM> is configured to perform processing described above, e.g., in <FIG>, such as by executing instructions stored in memory <NUM>. The processing circuitry <NUM> in this regard may implement certain functional means, units, or modules.

A computer program comprises instructions which, when executed on at least one processor of a network mediation device <NUM>, cause the network mediation device <NUM> to carry out any of the respective processing described above. A computer program in this regard may comprise one or more code modules corresponding to the means or units described above.

In this regard, embodiments herein also include a computer program product stored on a non-transitory computer readable (storage or recording) medium and comprising instructions that, when executed by a processor of a network mediation device <NUM>, cause the network mediation device <NUM> to perform as described above.

Embodiments further include a computer program product comprising program code portions for performing the steps of any of the embodiments herein when the computer program product is executed by a network mediation device <NUM>.

A computer program comprises instructions which, when executed on at least one processor of a lawful interception administrative device <NUM>, cause the lawful interception administrative device <NUM> to carry out any of the respective processing described above. A computer program in this regard may comprise one or more code modules corresponding to the means or units described above.

In this regard, embodiments herein also include a computer program product stored on a non-transitory computer readable (storage or recording) medium and comprising instructions that, when executed by a processor of a lawful interception administrative device <NUM>, cause the lawful interception administrative device <NUM> to perform as described above.

Embodiments further include a computer program product comprising program code portions for performing the steps of any of the embodiments herein when the computer program product is executed by a lawful interception administrative device <NUM>.

<FIG> shows an example of a communication system <NUM> in accordance with some embodiments.

In the example, the communication system <NUM> includes a telecommunication network <NUM> that includes an access network <NUM>, such as a radio access network (RAN), and a core network <NUM>, which includes one or more core network nodes <NUM>. The access network <NUM> includes one or more access network nodes, such as network nodes 910a and 910b (one or more of which may be generally referred to as network nodes <NUM>), or any other similar <NUM>rd Generation Partnership Project (3GPP) access node or non-3GPP access point. The network nodes <NUM> facilitate direct or indirect connection of user equipment (UE), such as by connecting UEs 912a, 912b, 912c, and 912d (one or more of which may be generally referred to as UEs <NUM>) to the core network <NUM> over one or more wireless connections.

For example, the telecommunications network <NUM> may provide Ultra Reliable Low Latency Communication (URLLC) services to some UEs, while providing Enhanced Mobile Broadband (eMBB) services to other UEs, and/or Massive Machine Type Communication (mMTC)/Massive loT services to yet further UEs.

In some examples, the UEs <NUM> are configured to transmit and/or receive information without direct human interaction. For instance, a UE may be designed to transmit information to the access network <NUM> on a predetermined schedule, when triggered by an internal or external event, or in response to requests from the access network <NUM>. Additionally, a UE may be configured for operating in single- or multi-RAT or multi-standard mode. For example, a UE may operate with any one or combination of Wi-Fi, NR (New Radio) and LTE, i.e. being configured for multi-radio dual connectivity (MR-DC), such as E-UTRAN (Evolved-UMTS Terrestrial Radio Access Network) New Radio - Dual Connectivity (EN-DC).

In the example, the hub <NUM> communicates with the access network <NUM> to facilitate indirect communication between one or more UEs (e.g., UE 912c and/or 912d) and network nodes (e.g., network node 910b). In some examples, the hub <NUM> may be a controller, router, content source and analytics, or any of the other communication devices described herein regarding UEs. For example, the hub <NUM> may be a broadband router enabling access to the core network <NUM> for the UEs. As another example, the hub <NUM> may be a controller that sends commands or instructions to one or more actuators in the UEs. Commands or instructions may be received from the UEs, network nodes <NUM>, or by executable code, script, process, or other instructions in the hub <NUM>. As another example, the hub <NUM> may be a data collector that acts as temporary storage for UE data and, in some embodiments, may perform analysis or other processing of the data. As another example, the hub <NUM> may be a content source. For example, for a UE that is a VR headset, display, loudspeaker or other media delivery device, the hub <NUM> may retrieve VR assets, video, audio, or other media or data related to sensory information via a network node, which the hub <NUM> then provides to the UE either directly, after performing local processing, and/or after adding additional local content. In still another example, the hub <NUM> acts as a proxy server or orchestrator for the UEs, in particular in if one or more of the UEs are low energy loT devices.

The hub <NUM> may have a constant/persistent or intermittent connection to the network node 910b. The hub <NUM> may also allow for a different communication scheme and/or schedule between the hub <NUM> and UEs (e.g., UE 912c and/or 912d), and between the hub <NUM> and the core network <NUM>. In other examples, the hub <NUM> is connected to the core network <NUM> and/or one or more UEs via a wired connection. Moreover, the hub <NUM> may be configured to connect to an M2M service provider over the access network <NUM> and/or to another UE over a direct connection. In some scenarios, UEs may establish a wireless connection with the network nodes <NUM> while still connected via the hub <NUM> via a wired or wireless connection. In some embodiments, the hub <NUM> may be a dedicated hub - that is, a hub whose primary function is to route communications to/from the UEs from/to the network node 910b. In other embodiments, the hub <NUM> may be a non-dedicated hub - that is, a device which is capable of operating to route communications between the UEs and network node 910b, but which is additionally capable of operating as a communication start and/or end point for certain data channels.

<FIG> shows a UE <NUM> in accordance with some embodiments. As used herein, a UE refers to a device capable, configured, arranged and/or operable to communicate wirelessly with network nodes and/or other UEs. Examples of a UE include, but are not limited to, a smart phone, mobile phone, cell phone, voice over IP (VolP) phone, wireless local loop phone, desktop computer, personal digital assistant (PDA), wireless cameras, gaming console or device, music storage device, playback appliance, wearable terminal device, wireless endpoint, mobile station, tablet, laptop, laptop-embedded equipment (LEE), laptop-mounted equipment (LME), smart device, wireless customer-premise equipment (CPE), vehicle-mounted or vehicle embedded/integrated wireless device, etc. Other examples include any UE identified by the 3rd Generation Partnership Project (3GPP), including a narrow band internet of things (NB-IoT) UE, a machine type communication (MTC) UE, and/or an enhanced MTC (eMTC) UE.

A UE, when in the form of an Internet of Things (IoT) device, may be a device for use in one or more application domains, these domains comprising, but not limited to, city wearable technology, extended industrial application and healthcare. Non-limiting examples of such an IoT device are a device which is or which is embedded in: a connected refrigerator or freezer, a TV, a connected lighting device, an electricity meter, a robot vacuum cleaner, a voice controlled smart speaker, a home security camera, a motion detector, a thermostat, a smoke detector, a door/window sensor, a flood/moisture sensor, an electrical door lock, a connected doorbell, an air conditioning system like a heat pump, an autonomous vehicle, a surveillance system, a weather monitoring device, a vehicle parking monitoring device, an electric vehicle charging station, a smart watch, a fitness tracker, a head-mounted display for Augmented Reality (AR) or Virtual Reality (VR), a wearable for tactile augmentation or sensory enhancement, a water sprinkler, an animal- or item-tracking device, a sensor for monitoring a plant or animal, an industrial robot, an Unmanned Aerial Vehicle (UAV), and any kind of medical device, like a heart rate monitor or a remote controlled surgical robot. A UE in the form of an loT device comprises circuitry and/or software in dependence of the intended application of the loT device in addition to other components as described in relation to the UE <NUM> shown in <FIG>.

As yet another specific example, in an loT scenario, a UE may represent a machine or other device that performs monitoring and/or measurements, and transmits the results of such monitoring and/or measurements to another UE and/or a network node. As one particular example, the UE may implement the 3GPP NB-loT standard.

In practice, any number of UEs may be used together with respect to a single use case. For example, a first UE might be or be integrated in a drone and provide the drone's speed information (obtained through a speed sensor) to a second UE that is a remote controller operating the drone. When the user makes changes from the remote controller, the first UE may adjust the throttle on the drone (e.g. by controlling an actuator) to increase or decrease the drone's speed. The first and/or the second UE can also include more than one of the functionalities described above. For example, a UE might comprise the sensor and the actuator, and handle communication of data for both the speed sensor and the actuators.

<FIG> shows a network node <NUM> in accordance with some embodiments. As used herein, network node refers to equipment capable, configured, arranged and/or operable to communicate directly or indirectly with a UE and/or with other network nodes or equipment, in a telecommunication network.

Applications <NUM> (which may alternatively be called software instances, virtual appliances, network functions, virtual nodes, virtual network functions, etc.) are run in the virtualization environment Q400 to implement some of the features, functions, and/or benefits of some of the embodiments disclosed herein.

Hardware <NUM> includes processing circuitry, memory that stores software and/or instructions executable by hardware processing circuitry, and/or other hardware devices as described herein, such as a network interface, input/output interface, and so forth. Software may be executed by the processing circuitry to instantiate one or more virtualization layers <NUM> (also referred to as hypervisors or virtual machine monitors (VMMs)), provide VMs 1308a and 1308b (one or more of which may be generally referred to as VMs <NUM>), and/or perform any of the functions, features and/or benefits described in relation with some embodiments described herein. The virtualization layer <NUM> may present a virtual operating platform that appears like networking hardware to the VMs <NUM>.

Hardware <NUM> may be implemented in a standalone network node with generic or specific components. Hardware <NUM> may implement some functions via virtualization. Alternatively, hardware <NUM> may be part of a larger cluster of hardware (e.g. such as in a data center or CPE) where many hardware nodes work together and are managed via management and orchestration <NUM>, which, among others, oversees lifecycle management of applications <NUM>. In some embodiments, hardware <NUM> is coupled to one or more radio units that each include one or more transmitters and one or more receivers that may be coupled to one or more antennas. Radio units may communicate directly with other hardware nodes via one or more appropriate network interfaces and may be used in combination with the virtual components to provide a virtual node with radio capabilities, such as a radio access node or a base station. In some embodiments, some signaling can be provided with the use of a control system <NUM> which may alternatively be used for communication between hardware nodes and radio units.

<FIG> shows a communication diagram of a host <NUM> communicating via a network node <NUM> with a UE <NUM> over a partially wireless connection in accordance with some embodiments. Example implementations, in accordance with various embodiments, of the UE (such as a UE 912a of <FIG> and/or UE <NUM> of <FIG>), network node (such as network node 910a of <FIG> and/or network node <NUM> of <FIG>), and host (such as host <NUM> of <FIG> and/or host <NUM> of <FIG>) discussed in the preceding paragraphs will now be described with reference to <FIG>.

One or more of the various embodiments improve the performance of OTT services provided to the UE <NUM> using the OTT connection <NUM>, in which the wireless connection <NUM> forms the last segment.

In some examples, a measurement procedure may be provided for the purpose of monitoring data rate, latency and other factors on which the one or more embodiments improve. There may further be an optional network functionality for reconfiguring the OTT connection <NUM> between the host <NUM> and UE <NUM>, in response to variations in the measurement results. The measurement procedure and/or the network functionality for reconfiguring the OTT connection may be implemented in software and hardware of the host <NUM> and/or UE <NUM>. In some embodiments, sensors (not shown) may be deployed in or in association with other devices through which the OTT connection <NUM> passes; the sensors may participate in the measurement procedure by supplying values of the monitored quantities exemplified above, or supplying values of other physical quantities from which software may compute or estimate the monitored quantities. The reconfiguring of the OTT connection <NUM> may include message format, retransmission settings, preferred routing etc.; the reconfiguring need not directly alter the operation of the network node <NUM>. In certain embodiments, measurements may involve proprietary UE signaling that facilitates measurements of throughput, propagation times, latency and the like, by the host <NUM>. The measurements may be implemented in that software causes messages to be transmitted, in particular empty or 'dummy' messages, using the OTT connection <NUM> while monitoring propagation times, errors, etc..

In certain embodiments, some or all of the functionality described herein may be provided by processing circuitry executing instructions stored on in memory, which in certain embodiments may be a computer program product in the form of a non-transitory computer-readable storage medium. In alternative embodiments, some or all of the functionality may be provided by the processing circuitry without executing instructions stored on a separate or discrete device-readable storage medium, such as in a hard-wired manner. In any of those particular embodiments, whether executing instructions stored on a non-transitory computer-readable storage medium or not, the processing circuitry can be configured to perform the described functionality. The benefits provided by such functionality are not limited to the processing circuitry alone or to other components of the computing device, but are enjoyed by the computing device as a whole, and/or by end users and a wireless network generally.

Claim 1:
A method performed by a network mediation device (<NUM>) in a communication network (<NUM>) of a communication service provider, the method comprising:
receiving (<NUM>) data (<NUM>) intercepted at a point of interception (<NUM>) in the communication network (<NUM>) as part of a lawful interception service;
labelling (<NUM>) the data (<NUM>) with a field (<NUM>) that has a value set to identify the point of interception (<NUM>) at which the data (<NUM>) was intercepted, wherein labeling the data (<NUM>) comprises determining the value to which to set the field (<NUM>) based on information (<NUM>) stored in the network mediation device (<NUM>) indicating different values to which to respectively set the field (<NUM>) for different possible points of interception in the communication network (<NUM>); and
sending (<NUM>) the labeled data (<NUM>) over a handover interface (<NUM>) from the network mediation device (<NUM>) towards a law enforcement monitoring facility (<NUM>).