Patent Description:
In the context of lawful interception, the term "task" can refer to an instance of interception at a network element carried out against a set of target identifiers. A task can start from an activate command and end with a deactivate command. Carrying out a task can result in certain information being obtained. The term "destination" can refer to a point where interception-related information can be delivered by a network element.

The term "network element" can refer generally to any component of a communication service provider's network that is provided with, or intended to be provided with, information related to lawful interception. Under some circumstances, a network element can be a network function. Alternatively, a network element can be another type of network element besides a network function.

The term "administration function" can refer to any entity that provides one or more administrative functions for lawful interception capability. An administration function (ADMF) can be configured to ensure that an intercept request from a law enforcement agency is provisioned for collection from a communication service provider's network, and that the information that is collected is delivered to a law enforcement monitoring facility.

Some aspects of lawful interception can involve communication between an ADMF and one or more network elements. Some communications between an ADMF and a network element can be related to the ADMF's provisioning of the network elements to perform interception. For example, an ADMF can add a new task to a network element, modify an existing task on the network element, deactivate a task on a network element, add a new destination to a network element, modify an existing destination on the network element, remove a destination from the network element, get information about a task and/or a destination on the network element, get information about the status of the network element, and so forth. A network element can report issues to the ADMF about tasks, destinations, and/or the network element itself.

The subject matter in the background section is intended to provide an overview of the overall context for the subject matter disclosed herein. The subject matter discussed in the background section should not be assumed to be prior art merely as a result of its mention in the background section. Similarly, a problem mentioned in the background section or associated with the subject matter of the background section should not be assumed to have been previously recognized in the prior art.

<NPL> ] describes that Lawful Interception (LI) is a requirement placed upon service providers to provide legally sanctioned official access to private communications. With the existing Public Switched Telephone Network (PSTN), Lawful Interception is performed by applying a physical 'tap' on the telephone line of the target in response to a warrant from a Law Enforcement Agency (LEA). However, Voice over IP (VoIP) technology has enabled the mobility of the end-user, so it is no longer possible to guarantee the interception of calls based on tapping a physical line. Whilst the detailed requirements for LI may differ from one jurisdiction to another, the general requirements are the same. The LI system must provide transparent interception of specified traffic only and the subject must not be aware of the interception. The service provided to other users must not be affected during interception.

TEN<NPL> ] describes an electronic interface for the transmission of intercepted information as part of Lawful Interception. This interface is used from points of interception to LI mediation functions. Typical reference models for LI define an interface between Law Enforcement Agencies (LEAs) and Communication Service Providers (CSPs), called the handover interface. They also define an internal network interface within the CSP domain between administration/mediation functions for lawful interception and network internal functions, which facilitates the interception of communication. This internal network interface typically consists of three sub-interfaces; administration (called X1), transmission of intercept related information (X2) and transmission of content of communication (X3). The document specifies a protocol for delivering X2 and X3.

<CIT> describes a system to facilitate the implementation of grid or distributed network computing by automatically organizing a group of computers into a hierarchical, or tree networked system. The computer servers are selected into subgroups with each subgroup selecting a server to act as its leader. The leader is responsible for reporting performance characteristics of the servers in the subgroup to a master catalog server housed in a centralized management facility. The hierarchical system contemplated by embodiments of the invention reduces the number of messages that must be sent between the servers in the system necessary to monitor and manage the system. This reduction in the number of messages that must be sent between the servers in the system reduces the amount of server resources dedicated to overhead monitoring and managing, freeing these resources to be dedicated to performing the common processing task that grid or distributed network system was established to perform.

One aspect of the present disclosure is directed to a method for identifying an active administration function (ADMF) in a lawful interception deployment that utilizes an ADMF set comprising a plurality of ADMFs. The method is implemented by a network element. The method comprises identifying a first ADMF among the plurality of ADMFs in the ADMF set as the active ADMF. At any given point in time only one ADMF among the plurality of ADMFs is identified as the active ADMF. The method also comprises exchanging first lawful interception signaling with the first ADMF when the first ADMF is the active ADMF. The method also comprises receiving an auditing request message from one of the plurality of ADMFs in the ADMF set. The auditing request message does not identify a specific ADMF in the ADMF set as a sender of the auditing request message. The method also comprises sending a ping request message to each ADMF in the ADMF set. The method also comprises receiving a ping response message from a second ADMF among the plurality of ADMFs in the ADMF set. The method also comprises identifying the second ADMF as the active ADMF based at least in part on receiving the ping response message from the second ADMF. The method also comprises exchanging second lawful interception signaling with the second ADMF when the second ADMF is the active ADMF.

In some embodiments, the network element can receive the auditing request message from the second ADMF in response to the first ADMF becoming unavailable.

In some embodiments, the auditing request message can be received from the second ADMF in the ADMF set. The plurality of ADMFs in the ADMF set can be associated with a same ADMF identifier. The auditing request message can be structured so that the auditing request message comprises the ADMF identifier but does not comprise any other identifier that distinguishes the second ADMF from other ADMFs in the ADMF set.

In some embodiments, the plurality of ADMFs in the ADMF set can be associated with an ADMF identifier. Each ADMF in the ADMF set can also comprise an Internet protocol (IP) address. The method can further comprise configuring the network element with the ADMF identifier and the IP address of each ADMF in the ADMF set. In some embodiments, the plurality of ADMFs in the ADMF set can be associated with an ADMF identifier. The method can further comprise sending an auditing response message that is addressed to the ADMF identifier.

In some embodiments, the auditing request message can comprise a GetAllDetails request message, and the auditing response message can comprise a GetAllDetails response message. In some embodiments, the network element does not receive any other ping response messages from any other ADMFs among the plurality of ADMFs in response to sending the ping request message.

In some embodiments, the network element can be selected from the group consisting of a point of interception, a triggering function, a mediation and delivery function, and a system information retrieval function.

Another aspect of the present disclosure is directed to a method for enabling a network element to identify an active administration function (ADMF) in a lawful interception deployment that utilizes an ADMF set comprising a plurality of ADMFs. The method is implemented by an ADMF among the plurality of ADMFs in the ADMF set. The method comprises transitioning from a standby state into an active state in which the ADMF is the active ADMF. At any given point in time only one ADMF among the plurality of ADMFs in the ADMF set is the active ADMF. The method also comprises sending an auditing request message to the network element after transitioning into the active state. The method also comprises receiving a ping request message from the network element after sending the auditing request message to the network element. The method also comprises sending a ping response message to the network element in response to receiving the ping request message. The method also comprises exchanging lawful interception signaling with the network element when the ADMF is the active ADMF.

In some embodiments, the auditing request message can be sent to the network element in response to a prior active ADMF becoming unavailable.

In some embodiments, the plurality of ADMFs in the ADMF set can be associated with a same ADMF identifier. The auditing request message can be structured so that the auditing request message comprises the ADMF identifier but does not comprise any other identifier that distinguishes the ADMF from other ADMFs in the ADMF set.

In some embodiments, the plurality of ADMFs in the ADMF set can be associated with an ADMF identifier. The method can further comprise receiving an auditing response message that is addressed to the ADMF identifier.

In some embodiments, the auditing request message can comprise a GetAllDetails request message, and the auditing response message can comprise a GetAllDetails response message.

Another aspect of the present disclosure is directed to a system for identifying an active administration function (ADMF) in a lawful interception deployment that utilizes an ADMF set comprising a plurality of ADMFs. The system comprises one or more processors, memory in electronic communication with the one or more processors, and instructions stored in the memory. The instructions are executable by the one or more processors to cause a network element to identify a first ADMF among the plurality of ADMFs in the ADMF set as the active ADMF. At any given point in time only one ADMF among the plurality of ADMFs is identified as the active ADMF. The instructions are also executable by the one or more processors to cause the network element to exchange first lawful interception signaling with the first ADMF when the first ADMF is the active ADMF. The instructions are also executable by the one or more processors to cause the network element to receive an auditing request message from one of the plurality of ADMFs in the ADMF set. The auditing request message does not identify a specific ADMF in the ADMF set as a sender of the auditing request message. The instructions are also executable by the one or more processors to cause the network element to send a ping request message to each ADMF in the ADMF set. The instructions are also executable by the one or more processors to cause the network element to receive a ping response message from a second ADMF among the plurality of ADMFs in the ADMF set. The instructions are also executable by the one or more processors to cause the network element to identify the second ADMF as the active ADMF based at least in part on receiving the ping response message from the second ADMF. The instructions are also executable by the one or more processors to cause the network element to exchange second lawful interception signaling with the second ADMF when the second ADMF is the active ADMF.

In some embodiments, the plurality of ADMFs in the ADMF set can be associated with an ADMF identifier. Each ADMF in the ADMF set can also comprise an Internet protocol (IP) address. The system can further comprise additional instructions that are executable by the one or more processors to configure the network element with the ADMF identifier and the IP address of each ADMF in the ADMF set.

In some embodiments, the plurality of ADMFs in the ADMF set can be associated with an ADMF identifier. The system can further comprise additional instructions that are executable by the one or more processors to cause the network element to send an auditing response message that is addressed to the ADMF identifier.

In some embodiments, the network element does not receive any other ping response messages from any other ADMFs among the plurality of ADMFs in response to sending the ping request message.

Additional features and advantages will be set forth in the description that follows. Features and advantages of the disclosure may be realized and obtained by means of the systems and methods that are particularly pointed out in the appended claims. Features of the present disclosure will become more fully apparent from the following description and appended claims, or may be learned by the practice of the disclosed subject matter as set forth hereinafter.

In order to describe the manner in which the above-recited and other features of the disclosure can be obtained, a more particular description will be rendered by reference to specific embodiments thereof which are illustrated in the appended drawings. For better understanding, the like elements have been designated by like reference numbers throughout the various accompanying figures. Understanding that the drawings depict some example embodiments, the embodiments will be described and explained with additional specificity and detail through the use of the accompanying drawings in which:.

Some lawful interception deployments can include a plurality of ADMFs for redundancy or other purposes. A plurality of ADMFs that are deployed in this way can be referred to as a set of ADMFs. There are at least two possible ways that such deployments can be implemented. In a first possible implementation, a network element can present itself as a separate network element to each ADMF. However, in a second possible implementation, a network element can present itself as a single network element to each ADMF. In this second implementation, all of the ADMFs in the ADMF set can use the same ADMF identifier. The ADMF set can be configured so that only one ADMF in the ADMF set is in an active state at any given point in time, and other ADMFs in the ADMF set are in a standby state.

As discussed above, a network element can send messages (e.g., reports) to an ADMF. In lawful interception deployments that include an ADMF set implemented according to the second implementation described above, a network element can be configured to send messages to the active ADMF. However, because all of the ADMFs in the ADMF set use the same ADMF identifier, it can be difficult for a network element to determine which ADMF is the active ADMF. This problem can be particularly difficult when the active ADMF changes (e.g., the active ADMF becomes unavailable and another ADMF in the ADMF set becomes the new active ADMF).

The present disclosure is generally related to identifying the active ADMF in a lawful interception deployment. The techniques disclosed herein involve communication between a network element and an ADMF set comprising a plurality of ADMFs. All of the ADMFs in the ADMF set use the same ADMF identifier, and only one ADMF in the ADMF set can be in an active state at any given point in time. In accordance with the present disclosure, whenever an ADMF becomes the active ADMF, it sends an auditing request message (e.g., a GetAllDetails request message) to the network element. The auditing request message itself does not inform the network element which ADMF is the active ADMF. However, the auditing request message causes the network element to initiate a process that enables the network element to find out which ADMF is the active ADMF. In particular, when the network element receives the auditing request message, the network element sends a ping request message to each ADMF in the ADMF set. Only the active ADMF responds to the ping request message. Therefore, once the network element has received a response to the ping request message, the network element is able to identify the sender of the ping request message as the active ADMF.

<FIG> illustrates an example of a system <NUM> in which the techniques disclosed herein can be utilized. The system <NUM> includes an ADMF set <NUM>. In the depicted example, the ADMF set <NUM> includes two ADMFs <NUM>: a first ADMF <NUM>-<NUM> and a second ADMF <NUM>-<NUM>. Of course, an ADMF set in accordance with the present disclosure can include more than two ADMFs.

The ADMF set <NUM> includes an ADMF ID <NUM>. Each ADMF <NUM> in the ADMF set <NUM> has the same ADMF ID <NUM>. In other words, the ADMF ID <NUM> is associated with both the first ADMF <NUM>-<NUM> and the second ADMF <NUM>-<NUM>.

The ADMF set <NUM> can be configured so that only one ADMF <NUM> in the ADMF set <NUM> is permitted to be active at any given point in time. In other words, the ADMF set <NUM> can be configured so that only one of the ADMFs <NUM> in the ADMF set <NUM> is in an active state, and other ADMFs <NUM> in the ADMF set <NUM> are in a standby state. Thus, if the first ADMF <NUM>-<NUM> is in the active state, then the second ADMF <NUM>-<NUM> is in the standby state (or vice versa).

The system <NUM> also includes a network element <NUM> that is communicatively coupled to the active ADMF <NUM> in the ADMF set <NUM>. Communication between the network element and the active ADMF <NUM> in the ADMF set <NUM> can occur in both directions. Examples of messages that the active ADMF <NUM> in the ADMF set <NUM> can send to the network element <NUM> will be described below. Examples of messages that the network element <NUM> can send to the active ADMF <NUM> in the ADMF set <NUM> will also be described below.

The network element <NUM> can be configured with certain information about the ADMF set <NUM>. For example, the network element <NUM> can be configured with the ADMF ID <NUM>. In addition, the network element <NUM> can be configured with the IP addresses <NUM> of each ADMF <NUM> in the ADMF set <NUM>. In particular, the network element <NUM> can be configured with the IP address of the first ADMF <NUM>-<NUM> (which will be referred to as the first IP address <NUM>-<NUM>) and the IP address of the second ADMF <NUM>-<NUM> (which will be referred to as the second IP address <NUM>-<NUM>). The network element <NUM> can also include an indication of which ADMF <NUM> in the ADMF set <NUM> is the active ADMF <NUM>. This indication may be referred to as an active ADMF indicator <NUM>.

<FIG> and <FIG> illustrate an example of a method <NUM> for a network element <NUM> to identify an active ADMF <NUM> in a lawful interception deployment that utilizes an ADMF set <NUM> comprising a plurality of ADMFs <NUM>. The method <NUM> will be described in relation to the system <NUM> shown in <FIG>. The entities that are involved in performing the method <NUM> include the first ADMF <NUM>-<NUM>, the second ADMF <NUM>-<NUM>, and the network element <NUM>.

Reference is initially made to <FIG>. At <NUM>, an ADMF set <NUM> is formed. The ADMF set <NUM> comprises the first ADMF <NUM>-<NUM> and the second ADMF <NUM>-<NUM>. At <NUM>, the first ADMF <NUM>-<NUM> and the second ADMF <NUM>-<NUM> are assigned the same ADMF ID <NUM>. At <NUM>, the first ADMF <NUM>-<NUM> is selected as the active ADMF <NUM>. At <NUM>, the first ADMF <NUM>-<NUM> enters the active state. At <NUM>, the second ADMF <NUM>-<NUM> enters the standby state.

At <NUM>, the network element <NUM> is configured with the ADMF ID <NUM> and the IP addresses <NUM> of the first ADMF <NUM>-<NUM> and the second ADMF <NUM>-<NUM>.

The active ADMF can be configured so that it sends an auditing request message whenever a new network element is added. Thus, at <NUM>, when the network element <NUM> is added, the first ADMF <NUM>-<NUM> sends an auditing request message to the network element <NUM>. At <NUM>, when the network element <NUM> receives the auditing request message, the network element <NUM> sends an auditing response message that is received by the first ADMF <NUM>-<NUM>.

In this context, the term "auditing request message" can refer to a message that an ADMF <NUM> sends to a network element <NUM> to request information related to lawful interception from the network element <NUM>. The term "auditing response message" can refer to a message that a network element <NUM> sends to an ADMF <NUM> in response to an auditing request message. In the depicted example, the auditing request message can take the form of a GetAllDetails request message, and the auditing response message can take the form of a GetAllDetails response message.

The GetAllDetails request message can include the ADMF ID <NUM>. However, because the same ADMF ID <NUM> is associated with each ADMF <NUM> in the ADMF set <NUM>, the network element <NUM> does not know from the GetAllDetails request message which ADMF <NUM> is the active ADMF <NUM>.

To find out which ADMF <NUM> is the active ADMF <NUM>, the network element <NUM> can send a ping request message to each ADMF <NUM> in the ADMF set <NUM>. The network element <NUM> can send these ping request messages on receiving the GetAllDetails request message.

At <NUM>, the network element <NUM> sends a first ping request message to the first ADMF <NUM>-<NUM>. At <NUM>, the network element <NUM> sends a second ping request message to the second ADMF <NUM>-<NUM>. The first ping request message can be sent to the first IP address <NUM>-<NUM> (which, as noted above, corresponds to the first ADMF <NUM>-<NUM>), and the second ping request message can be sent to the second IP address <NUM>-<NUM> (which, as noted above, corresponds to the second ADMF <NUM>-<NUM>). The network element <NUM> is able to send these ping request messages because the network element <NUM> has been configured with the IP address <NUM> of each ADMF <NUM> in the ADMF set <NUM>.

The ADMFs <NUM> in the ADMF set <NUM> can be configured so that only the active ADMF <NUM> responds to the ping request message sent by the network element <NUM>. Therefore, in the present example, the first ADMF <NUM>-<NUM> responds to the ping request message sent by the network element <NUM>. In particular, at <NUM>, the first ADMF <NUM>-<NUM> sends a ping response message back to the network element <NUM>. When the network element <NUM> receives the ping response message, the network element <NUM> is aware that the ping response message was sent by the first ADMF <NUM>-<NUM>. In some embodiments, the network element <NUM> is aware that the ping response message was sent by the first ADMF <NUM>-<NUM> because both the ping request message and the ping response message are associated with the same logical connection (e.g., HTTP connection), and the logical connection is associated with the first ADMF <NUM>-<NUM>. More specifically, a ping request message can be sent as an HTTP request over TCP. Each ping request message can be sent over a different connection. Therefore, when a response comes back, the network element is able to identify which ADMF has responded based on the connection through which the response is received.

In a cloud native environment, there may be multiple client IP addresses for the ADMF, and as a server it may have a different IP address than the client IP addresses. The network element can be configured to use the server IP address when it is initiating a request.

Because the second ADMF <NUM>-<NUM> is in a standby state and is not the active ADMF <NUM>, the second ADMF <NUM>-<NUM> does not respond to the ping request message sent by the network element <NUM>. At <NUM>, the ping request message that the network element <NUM> sends to the second ADMF <NUM>-<NUM> times out.

At <NUM>, after the network element <NUM> has received the ping response message from the first ADMF <NUM>-<NUM>, the network element <NUM> updates its records to indicate that the first ADMF <NUM>-<NUM> is the active ADMF <NUM>. For example, the network element <NUM> can update the active ADMF indicator <NUM> to reflect the fact that the first ADMF <NUM>-<NUM> is the active ADMF <NUM>.

At <NUM>, lawful interception signaling occurs between the network element <NUM> and the first ADMF <NUM>-<NUM>. The lawful interception signaling can include one or more messages related to lawful interception that are sent from the first ADMF <NUM>-<NUM> to the network element <NUM>. Alternatively, or in addition, the lawful interception signaling can include one or more messages related to lawful interception that are sent from the network element <NUM> to the first ADMF <NUM>-<NUM>. Some examples of message(s) that can be exchanged as part of the lawful interception signaling will be described below.

Reference is now made to <FIG>. At <NUM>, the first ADMF <NUM>-<NUM> becomes unavailable. There are several possible reasons why the first ADMF <NUM>-<NUM> could become unavailable. For example, the first ADMF <NUM>-<NUM> could become unavailable due to a hardware and/or software failure. As another example, a network operator could intentionally make the first ADMF <NUM>-<NUM> unavailable by taking the first ADMF <NUM>-<NUM> offline (e.g., in order to perform a maintenance operation).

At <NUM>, when the first ADMF <NUM>-<NUM> becomes unavailable, the first ADMF <NUM>-<NUM> is transitioned from the active state to the standby state. At <NUM>, when the first ADMF <NUM>-<NUM> becomes unavailable, the second ADMF <NUM>-<NUM> is transitioned from the standby state to the active state. Thus, the second ADMF <NUM>-<NUM> becomes the new active ADMF <NUM>.

At <NUM>, after the second ADMF <NUM>-<NUM> transitions from the standby state to the active state, the second ADMF <NUM>-<NUM> sends an auditing request message to the network element <NUM>. At <NUM>, the network element <NUM> receives the auditing request message. At <NUM>, the network element <NUM> sends an auditing response message that is received by the second ADMF <NUM>-<NUM>. As before, the auditing request message can be a GetAllDetails request message, and the auditing response message can be a GetAllDetails response message. The GetAllDetails request message can include the ADMF ID <NUM>. However, because the same ADMF ID <NUM> is associated with each ADMF <NUM> in the ADMF set <NUM>, the network element <NUM> does not know from the GetAllDetails request message which ADMF <NUM> is the active ADMF <NUM>.

To find out which ADMF <NUM> is the active ADMF <NUM>, the network element <NUM> can send a ping request message to each ADMF <NUM> in the ADMF set <NUM>. Receiving the GetAllDetails request message can cause the network element <NUM> to send these ping request messages.

The ADMFs <NUM> in the ADMF set <NUM> can be configured so that only the active ADMF <NUM> responds to the ping request message sent by the network element <NUM>. Therefore, in the present example, the second ADMF <NUM>-<NUM> responds to the ping request message sent by the network element <NUM>. In particular, at <NUM>, the second ADMF <NUM>-<NUM> sends a ping response message back to the network element <NUM>. When the network element <NUM> receives the ping response message, the network element <NUM> is aware that the ping response message was sent by the second ADMF <NUM>-<NUM>. In some embodiments, the network element <NUM> is aware that the ping response message was sent by the second ADMF <NUM>-<NUM> because both the ping request message and the ping response message are associated with the same logical connection (e.g., HTTP connection), and the logical connection is associated with the second ADMF <NUM>-<NUM>.

Because the first ADMF <NUM>-<NUM> is no longer the active ADMF <NUM> (and also because the first ADMF <NUM>-<NUM> is no longer available), the first ADMF <NUM>-<NUM> does not respond to the ping request message sent by the network element <NUM>. At <NUM>, the ping request message that the network element <NUM> sends to the first ADMF <NUM>-<NUM> times out.

At <NUM>, when the network element <NUM> receives the ping response message from the second ADMF <NUM>-<NUM>, the network element <NUM> updates its records to indicate that the second ADMF <NUM>-<NUM> is the active ADMF <NUM>. For example, the network element <NUM> can update the active ADMF indicator <NUM> to reflect the fact that the second ADMF <NUM>-<NUM> is now the active ADMF <NUM>.

At <NUM>, lawful interception signaling occurs between the network element <NUM> and the second ADMF <NUM>-<NUM>. The lawful interception signaling can include one or more messages sent from the second ADMF <NUM>-<NUM> to the network element <NUM>. Alternatively, or in addition, the lawful interception signaling can include one or more messages sent from the network element <NUM> to the second ADMF <NUM>-<NUM>. Some examples of message(s) that can be exchanged as part of the lawful interception signaling will be described below.

<FIG> illustrates an example of a method <NUM> for identifying an active ADMF <NUM> in a lawful interception deployment that utilizes an ADMF set <NUM> comprising a plurality of ADMFs <NUM>. The method <NUM> will be described in relation to the system <NUM> shown in <FIG>. The method <NUM> can be performed by a network element <NUM>.

At <NUM>, the network element <NUM> identifies a first ADMF <NUM>-<NUM> among the plurality of ADMFs <NUM> in the ADMF set <NUM> as the active ADMF <NUM>. In some embodiments, a first ADMF <NUM>-<NUM> can send an auditing request message (e.g., a GetAllDetails request message) when the network element <NUM> is added. The auditing request message can cause the network element <NUM> to send a ping request message to each ADMF <NUM> in the ADMF set <NUM>. The active ADMF <NUM> (which in this case is the first ADMF <NUM>-<NUM>) is the only ADMF <NUM> in the ADMF set <NUM> that responds to the ping request message. Therefore, when the network element <NUM> receives the ping request message from the first ADMF <NUM>-<NUM>, the network element <NUM> infers that the first ADMF <NUM>-<NUM> is the active ADMF <NUM>.

At <NUM>, the network element <NUM> exchanges lawful interception signaling with the first ADMF <NUM>-<NUM> when the first ADMF <NUM>-<NUM> is the active ADMF <NUM>. Exchanging lawful interception signaling with the first ADMF <NUM>-<NUM> can include sending one or more lawful interception messages to the first ADMF <NUM>-<NUM>. Alternatively, or in addition, exchanging lawful interception signaling with the first ADMF <NUM>-<NUM> can include receiving one or more lawful interception messages from the first ADMF <NUM>-<NUM>.

At <NUM>, the network element <NUM> receives an auditing request message from one of the plurality of ADMFs <NUM> in the ADMF set <NUM>. The auditing request message does not identify a specific ADMF <NUM> in the ADMF set <NUM> as a sender of the auditing request message. Although the auditing request message includes the ADMF ID <NUM>, the ADMF ID <NUM> does not inform the network element <NUM> which ADMF <NUM> is the active ADMF <NUM> because all of the ADMFs <NUM> in the ADMF set <NUM> use the same ADMF ID <NUM>.

At <NUM>, the network element <NUM> sends a ping request message to each ADMF <NUM> in the ADMF set <NUM>. Receiving the auditing request message can cause the network element <NUM> to send these ping request messages. At <NUM>, the network element <NUM> receives a ping response message from a second ADMF <NUM>-<NUM> among the plurality of ADMFs <NUM> in the ADMF set <NUM>. Only the active ADMF <NUM> responds to the ping request message. Therefore, once the network element <NUM> has received a response to the ping request message, the network element <NUM> is able to identify the sender of the ping response message as the active ADMF <NUM>. At <NUM>, the network element <NUM> identifies the second ADMF <NUM>-<NUM> as the active ADMF <NUM> based on receiving the ping response message from the second ADMF <NUM>-<NUM>.

At <NUM>, the network element <NUM> exchanges lawful interception signaling with the second ADMF <NUM>-<NUM> when the second ADMF <NUM>-<NUM> is the active ADMF <NUM>. Exchanging lawful interception signaling with the second ADMF <NUM>-<NUM> can include sending one or more lawful interception messages to the second ADMF <NUM>-<NUM>. Alternatively, or in addition, exchanging lawful interception signaling with the second ADMF <NUM>-<NUM> can include receiving one or more lawful interception messages from the second ADMF <NUM>-<NUM>.

<FIG> illustrates an example of a method <NUM> for enabling a network element <NUM> to identify an active ADMF <NUM> in a lawful interception deployment that utilizes an ADMF set <NUM> comprising a plurality of ADMFs <NUM>. The method <NUM> will be described in relation to the system <NUM> shown in <FIG>. The method <NUM> can be performed by an ADMF <NUM> among the plurality of ADMFs <NUM> in the ADMF set <NUM>. In the discussion that follows, it will be assumed that the method <NUM> is being performed by the second ADMF <NUM>-<NUM> in the ADMF set <NUM>.

At <NUM>, the second ADMF <NUM>-<NUM> transitions from a standby state into an active state in which the second ADMF <NUM>-<NUM> is the active ADMF <NUM>. At any given point in time only one ADMF <NUM> among the plurality of ADMFs <NUM> in the ADMF set <NUM> is the active ADMF <NUM>. Thus, by transitioning into the active state, the second ADMF <NUM>-<NUM> becomes the only active ADMF <NUM> in the ADMF set <NUM>.

The ADMF set <NUM> can be configured so that whenever an ADMF <NUM> transitions into the active state, the ADMF <NUM> sends an auditing request message to the network element <NUM>. Thus, at <NUM>, the second ADMF <NUM>-<NUM> sends an auditing request message to the network element <NUM> in response to transitioning into the active state. In some embodiments, the auditing request message can take the form of a GetAllDetails request message.

The auditing request message does not specifically identify the second ADMF <NUM>-<NUM>. Although the auditing request message can include the ADMF ID <NUM>, the same ADMF ID <NUM> is associated with each ADMF <NUM> in the ADMF set <NUM>. Therefore, the ADMF ID <NUM> does not inform the network element <NUM> which ADMF <NUM> sent the auditing request message. To find out which ADMF <NUM> is the active ADMF <NUM>, the network element <NUM> sends a ping request message to each ADMF <NUM> in the ADMF set <NUM>. Thus, at <NUM>, the second ADMF <NUM>-<NUM> receives a ping request message from the network element <NUM>. The auditing request message that the second ADMF <NUM>-<NUM> sends to the network element <NUM> triggers the ping request message from the network element <NUM>.

At <NUM>, the second ADMF <NUM>-<NUM> sends a ping response message to the network element <NUM> in response to receiving the ping request message. The second ADMF <NUM>-<NUM> is the only ADMF <NUM> in the ADMF set <NUM> that responds to the ping request message. This informs the network element <NUM> that the second ADMF <NUM>-<NUM> is now the active ADMF <NUM>, and the network element <NUM> can update its records accordingly.

At <NUM>, the second ADMF <NUM>-<NUM> exchanges lawful interception signaling with the network element <NUM> when the second ADMF <NUM>-<NUM> is the active ADMF <NUM>. Exchanging lawful interception signaling with the network element <NUM> can include sending one or more lawful interception messages to the network element <NUM>. Alternatively, or in addition, exchanging lawful interception signaling with the network element <NUM> can include receiving one or more lawful interception messages from the network element <NUM>.

To ensure systematic procedures for carrying out lawful interception procedures, while also lowering the costs of lawful interception solutions, industry groups and government agencies worldwide have attempted to standardize the technical processes behind lawful interception. One organization that is involved with such standardizing is the European Telecommunications Standards Institute (ETSI). ETSI is a standardization organization that is officially recognized by the European Union as a European Standards Organization (ESO). ETSI is responsible for the standardization of information and communication technologies (ICT). ETSI supports the development and testing of global technical standards for ICT-enabled systems, applications and services.

In some embodiments, the techniques disclosed herein can be utilized in a lawful interception deployment that is configured in accordance with ETSI TS <NUM><NUM>-<NUM>. ETSI TS <NUM><NUM>-<NUM> defines an electronic interface for the exchange of information relating to the establishment and management of lawful interception. The interface defined in ETSI TS <NUM><NUM>-<NUM> can be used between a central lawful interception ADMF and the network's internal interception points. Typical reference models for lawful interception define (a) an interface between law enforcement agencies (LEAs) and communication service providers (CSPs), and (b) an internal network interface within the CSP domain between administration and mediation functions for lawful interception and network internal functions, which facilitates the interception of communication. Interface (b) can include three sub-interfaces: administration (called X1), transmission of intercept related information (X2), and transmission of content of communication (X3). ETSI TS <NUM><NUM>-<NUM> specifies the administration interface X1.

The X1 interface can be based on communication between two entities: a controlling function (e.g., a CSP ADMF) and a controlled function (e.g., a network element or network function). A CSP ADMF can use the X1 interface to provision one or more network elements to perform interception.

An X1 transaction can include a request followed by a response. A request can be sent in either direction. In other words, either the ADMF or the network element can initiate the request. The side initiating the request may be referred to as the requester. The other side (which receives and responds to the request) may be referred to as the responder. An ADMF can send a request in order to distribute information and/or request status from a network element. A network element can send a request in order to deliver fault reports or other information.

A task on the X1 interface can be uniquely identified by an X1 identifier (XID). A task can be handled independently of all other tasks. An XID can be assigned as a universally unique identifier (UUID). An XID for a particular task can be released once the task has ended.

Intercepted traffic can be delivered by a network element to a destination. A destination can be uniquely identified by a destination identifier (DID), and can be handled independently from details of the task. A task can be associated with one or more destinations.

Warnings can be sent in response to problems that are not affecting traffic (e.g., causing intercept-related information to be lost). For example, warnings can be related to resources being nearly exhausted but not yet affecting traffic. Warnings can be sent by the network element and then not referred to again over the X1 interface. Warnings can be reported using issue-reporting messages. A lawful interception deployment can be configured so that warnings are not included in any future status-getting messages. A network element can log any warnings for audit reasons.

Faults can be related to problems that a network element should try to manage and/or rectify. Any issue that causes traffic to be lost can be categorized as a fault. A network element can remember which of the XIDs are in fault and whether the network element itself is in a fault situation. An issue report can be sent at the start of a fault. A network element can report faults when responding to a status-getting message. A network element can also indicate when a fault has been cleared.

Messages sent via the X1 interface can include the following information: an ADMF ID that identifies the ADMF to the network element, a network element identifier that identifies the network element to the ADMF, a message timestamp indicating the time the message was sent by the requester, a version identifier indicating the version of ETSI TS <NUM><NUM>-<NUM> that was used for encoding the message, and an X1 transaction identifier that is used to correlate a request and a response. In addition to the information just described, a request message sent via the X1 interface can indicate the type of request being made and contain the appropriate request parameters for that type of request.

ETSI TS <NUM><NUM>-<NUM> defines several different types of messages that can be sent via the X1 interface. Some messages can be sent from the ADMF to the network element. Examples of such messages include an ActivateTask message, a ModifyTask message, a DeactivateTask message, a DeactivateAllTasks message, a CreateDestination message, a ModifyDestination message, a RemoveDestination message, a RemoveAllDestinations message, a GetTaskDetails message, a GetDestinationDetails message, a GetNEStatus message, a GetAllDetails message, and a ListAllDetails message. Some messages can be sent from the network element to the ADMF. Examples of such messages include a ReportTaskIssue message, a ReportDestinationIssue message, and a ReportNEIssue message. Any of these messages can be exchanged as part of the lawful interception signaling that occurs at <NUM> and <NUM> in the method <NUM> shown in <FIG> and <FIG>, at <NUM> and <NUM> in the method <NUM> shown in <FIG>, and at <NUM> in the method <NUM> shown in <FIG>.

An ActivateTask message can be sent from the ADMF to the network element. An ActivateTask message can be used by the ADMF to add a new task to a network element. In some embodiments, an ActivateTask message can be defined in accordance with section <NUM>. <NUM> of ETSI TS <NUM><NUM>-<NUM> version <NUM>.

A ModifyTask message can be sent from the ADMF to the network element. A ModifyTask message can be used by the ADMF to modify an existing task on the network element. In some embodiments, a Modify Task message can be defined in accordance with section <NUM>. <NUM> of ETSI TS <NUM><NUM>-<NUM> version <NUM>.

A DeactivateTask message can be sent from the ADMF to the network element. A DeactivateTask message can be used by the ADMF to deactivate (e.g., permanently stop and remove) an existing task on the network element. In some embodiments, a DeactivateTask message can be defined in accordance with section <NUM>. <NUM> of ETSI TS <NUM><NUM>-<NUM> version <NUM>.

A DeactivateAllTasks message can be sent from the ADMF to the network element. When an ADMF sends a DeactivateAllTasks message to a network element, this can cause the network element to deactivate (e.g., permanently stop and remove) all existing tasks on the network element. In some embodiments, a DeactivateAllTasks message can be defined in accordance with section <NUM>. <NUM> of ETSI TS <NUM><NUM>-<NUM> version <NUM>.

A CreateDestination message can be sent from the ADMF to the network element. A CreateDestination message can be used by the ADMF to add a new destination to the network element. In some embodiments, a CreateDestination message can be defined in accordance with section <NUM>. <NUM> of ETSI TS <NUM><NUM>-<NUM> version <NUM>.

A ModifyDestination message can be sent from the ADMF to the network element. A ModifyDestination message can be used by the ADMF to modify an existing destination on the network element. In some embodiments, a ModifyDestination message can be defined in accordance with section <NUM>. <NUM> of ETSI TS <NUM><NUM>-<NUM> version <NUM>.

A RemoveDestination message can be sent from the ADMF to the network element. A RemoveDestination message can be used by the ADMF to remove a destination from the network element. In some embodiments, a RemoveDestination message can be defined in accordance with section <NUM>. <NUM> of ETSI TS <NUM><NUM>-<NUM> version <NUM>.

A RemoveAllDestinations message can be sent from the ADMF to the network element. When an ADMF sends a RemoveAllDestinations message to a network element, this can cause the network element to completely and permanently remove all destinations on the network element. In some embodiments, a RemoveAllDestinations message can be defined in accordance with section <NUM>. <NUM> of ETSI TS <NUM><NUM>-<NUM> version <NUM>.

A GetTaskDetails message can be sent from the ADMF to the network element. A GetTaskDetails message can be used by the ADMF to retrieve the details of a particular task. In some embodiments, a GetTaskDetails message can be defined in accordance with section <NUM>. <NUM> of ETSI TS <NUM><NUM>-<NUM> version <NUM>.

A GetDestinationDetails message can be sent from the ADMF to the network element. A GetDestinationDetails message can be used by the ADMF to retrieve the details of a particular destination. In some embodiments, a GetDestinationDetails message can be defined in accordance with section <NUM>. <NUM> of ETSI TS <NUM><NUM>-<NUM> version <NUM>.

A GetNEStatus message can be sent from the ADMF to the network element. A GetNEStatus message can be used by the ADMF to determine the status of the network element. In some embodiments, a GetNEStatus message can be defined in accordance with section <NUM>. <NUM> of ETSI TS <NUM><NUM>-<NUM> version <NUM>.

A GetAllDetails message can be sent from the ADMF to the network element. A GetAllDetails message can be used by the ADMF to determine the details of all tasks and destinations on the network element as well as to determine the status of the network element itself. In some embodiments, a GetAllDetails message can be defined in accordance with section <NUM>. <NUM> of ETSI TS <NUM><NUM>-<NUM> version <NUM>.

A ListAllDetails message can be sent from the ADMF to the network element. A ListAllDetails message can be used by the ADMF to retrieve a list of XIDs and DIDs on the network element. In some embodiments, a ListAllDetails message can be defined in accordance with section <NUM>. <NUM> of ETSI TS <NUM><NUM>-<NUM> version <NUM>.

A ReportTaskIssue message can be sent from the network element to the ADMF. A network element can send a ReportTaskIssue request message when the network element becomes aware of an issue (e.g., a warning or a fault) relating specifically to a particular XID. In some embodiments, a ReportTaskIssue message can be defined in accordance with section <NUM>. <NUM> of ETSI TS <NUM><NUM>-<NUM> version <NUM>.

A ReportDestinationIssue message can be sent from the network element to the ADMF. A network element can send a ReportDestinationIssue request message when the network element becomes aware of an issue (e.g., a warning or a fault) relating specifically to a particular DID. In some embodiments, a ReportDestinationIssue message can be defined in accordance with section <NUM>. <NUM> of ETSI TS <NUM><NUM>-<NUM> version <NUM>.

A ReportNEIssue message can be sent from the network element to the ADMF. A network element can send a ReportNEIssue request message when the network element becomes aware of an issue (e.g., a warning or a fault) relating to the whole network element. In some embodiments, a ReportNEIssue message can be defined in accordance with section <NUM>. <NUM> of ETSI TS <NUM><NUM>-<NUM> version <NUM>.

A ping message can be sent either from the network element to the ADMF or vice versa. A ping message can be sent at any time to get a response over the X1 interface. In some embodiments, a ping request message may not include any request parameters. A ping response message may include a field that includes either an OK response or an error message. In some embodiments, a ping message can be defined in accordance with section <NUM>. <NUM> of ETSI TS <NUM><NUM>-<NUM> version <NUM>. In some embodiments, the techniques disclosed herein can be utilized in a mobile telecommunications network. Mobile telecommunications networks are widely deployed to provide various communication services such as voice, text messaging, multimedia data, Internet connectivity, and the like. Mobile telecommunications networks can be multiple-access networks capable of supporting multiple users by sharing the available network resources. Mobile telecommunications networks may be referred to herein simply as mobile networks.

There are many different types of mobile devices that can be used in connection with a mobile network. Mobile devices have traditionally included smartphones, tablet computers, and laptop computers, but will increasingly include cars, drones, industrial and agricultural machines, robots, home appliances, medical devices, and so on. In the context of mobile networks, mobile devices are often referred to as user equipment (UE).

A mobile network is distributed over geographical areas that are typically referred to as "cells. " Each cell can be served by at least one base station. One or more base stations provide a cell with network coverage, which can be used for transmission of voice, data, and other types of content. When joined together, these cells provide radio coverage over a wide geographic area. In addition, a mobile network is typically connected to the Internet. Thus, a mobile network enables a mobile device to communicate with other mobile devices within the mobile network, as well as other computing devices that are connected to the Internet.

Mobile networks have undergone significant changes over the past several decades. The first two generations of mobile networks supported voice and then text messaging. Third generation (<NUM>) networks initiated the transition to broadband access, supporting data rates typically measured in hundreds of kilobits-per-second. Fourth generation (<NUM>) networks supported data rates that were significantly faster, typically measured in megabits-per-second. Today, the industry is transitioning from <NUM> to fifth generation (<NUM>) networks, with the promise of significant increases in data rates.

The Third Generation Partnership Project (3GPP) is a consortium of a number of standards organizations that develop protocols for mobile telecommunications. 3GPP is responsible for the development of Long-Term Evolution (LTE) and related <NUM> standards, including LTE Advanced and LTE Advanced Pro. 3GPP is also responsible for the development of <NUM> standards. <NUM> systems are already being deployed and are expected to become widespread in the near future.

3GPP TS <NUM> defines a lawful interception architecture for <NUM> systems. Among other things, this lawful interception architecture defines how network operators and law enforcement agents can interact. The lawful interception architecture set forth in 3GPP TS <NUM> includes the following aspects: collection where target-related data and content are extracted from the network, mediation where the data is formatted to conform to specific standards, and delivery of the data and content to the law enforcement agency.

<FIG> illustrates an example of a system <NUM> that includes a lawful interception architecture based on 3GPP TS <NUM>. In some embodiments, the techniques disclosed herein can be utilized in the depicted system <NUM>.

A law enforcement agency (LEA) <NUM> can be responsible for submitting a warrant to a communication service provider (CSP). The warrant can be a formal mechanism to require lawful interception.

A point of interception (POI) <NUM> detects the target communication(s), derives the intercept related information or communications content from the target communication(s), and delivers the POI output <NUM> to the mediation and delivery function (MDF) <NUM>. The POI output <NUM> can be determined by the type of network function associated with the POI <NUM>. A POI <NUM> can be embedded within a network function or separate from a network function with which it is associated. The lawful interception architecture shown in <FIG> shows a first POI <NUM>-<NUM> providing first POI output <NUM>-<NUM> to the MDF <NUM> and a second POI <NUM>-<NUM> providing second POI output <NUM>-<NUM> to the MDF <NUM>.

POIs <NUM> can be divided into two categories. Directly provisioned POIs <NUM> can be provisioned by the lawful interception provisioning function (LIPF) <NUM>. Triggered POIs <NUM> can be triggered by a triggering function <NUM>. The directly provisioned POIs <NUM> detect the target's communications that should be intercepted, and then derive the intercept related information or communication contents from that target's communications. The triggered POIs <NUM> detect the target's communications based on the trigger received from an associated triggering function <NUM> and then derive the intercept related information or communication contents of the target's communications. In the lawful interception architecture shown in <FIG>, the first POI <NUM>-<NUM> is triggered by a triggering function <NUM>, and the second POI <NUM>-<NUM> is directly provisioned by the LIPF <NUM>.

The triggering function <NUM> is provisioned by the LIPF <NUM> and is responsible for triggering triggered POIs <NUM> (such as the first POI <NUM>-<NUM> in <FIG>) in response to network and service events matching the criteria provisioned by the LIPF <NUM>. The triggering function <NUM> detects the target's communications and sends a trigger to the associated triggered POI <NUM>. As a part of this triggering, the triggering function <NUM> can provide the triggered POI <NUM> with various information including interception rules, forwarding rules, and target identity.

The MDF <NUM> delivers the interception product to the law enforcement monitoring facility (LEMF) <NUM>. The MDF <NUM> is provisioned by the LIPF <NUM> with information for providing the interception product to the LEMF <NUM>.

The ADMF <NUM> can provide the CSP's administrative and management functions for lawful interception capability. This can include overall responsibility for the provisioning/activating, modifying, and de-activating/de-provisioning the POIs <NUM>, triggering functions <NUM>, and the MDFs <NUM>.

A plurality of ADMFs <NUM> are included in the lawful interception architecture shown in <FIG>. The plurality of ADMFs <NUM> can form an ADMF set <NUM> as described herein. The network elements that interact with the ADMF set <NUM> can utilize the techniques disclosed herein to identify which of the plurality of ADMFs <NUM> is the active ADMF <NUM>.

The ADMF <NUM> can include a lawful interception control function (LICF) <NUM>. The LICF <NUM> can control the management of the end-to-end lifecycle of a warrant. The LICF <NUM> can contain a master record of all sensitive information and lawful interception configuration data. The LICF <NUM> can be responsible for all decisions within the overall lawful interception system. The LICF <NUM>, via the LIPF <NUM> acting as its proxy, can be responsible for auditing other lawful interception components (e.g., POIs <NUM>, MDFs <NUM>). The LICF <NUM> can be responsible for communication with administrative systems associated with the LEA <NUM>.

The ADMF <NUM> can also include a lawful interception provisioning function (LIPF) <NUM>. The LIPF <NUM> can provision the applicable POIs <NUM>, triggering functions <NUM>, and MDFs <NUM>. The role of the LIPF <NUM> can vary depending on implementation of network functions and of the ADMF <NUM> itself.

In some implementations, the LIPF <NUM> can be a secure proxy used by the LICF <NUM> to communicate with POIs <NUM>, triggering functions <NUM>, MDFs <NUM> or other infrastructure involved in operating lawful interception within the CSP's network. In this scenario, the LIPF <NUM> can be configured so that it does not store target information and simply routes messages from and to the LICF <NUM>.

In some implementations, where the ADMF <NUM> takes an active role in triggering POIs <NUM>, the LIPF <NUM> can be responsible for receiving triggering information and forwarding the trigger to the appropriate POI <NUM>.

For directly provisioned POIs <NUM>, triggering functions <NUM>, and MDFs <NUM>, the LIPF <NUM> can forward lawful interception administration instructions from the LICF <NUM> to the intended destination POI <NUM>, triggering function <NUM>, or MDF <NUM>.

In some implementations, the LIPF <NUM> can be responsible for identifying changes to POIs <NUM>, triggering functions <NUM>, and MDFs <NUM> through interaction with the system information retrieval function (SIRF) <NUM> or underlying virtualization infrastructure. The LIPF <NUM> can be configured to notify the LICF <NUM> of changes affecting the number of active POIs <NUM> and triggering functions <NUM> or other information that the LICF <NUM> uses to maintain the master list of POIs <NUM>, triggering functions <NUM>, and MDFs <NUM>.

The LICF <NUM> and LIPF <NUM> can support selective management and provisioning of groups of POIs <NUM> and triggering functions <NUM> based on parameters of the warrant (e.g., service scope, target identities), the target UE type and profile (e.g., a smartphone, a CIoT device), and the CSP's network deployment architecture and services implementation, with the purpose of optimizing the lawful interception system operation and avoiding its over-provisioning.

The following are examples of configuration capabilities of the ADMF <NUM>: single or multiple POIs <NUM> or triggering functions <NUM> or identify event functions (IEFs); groups of one or more POIs <NUM>, triggering functions <NUM>, and IEFs of a specific parent network function type; POIs <NUM>, triggering functions <NUM>, and IEFs associated with network functions in a specific network slice; POIs <NUM>, triggering functions <NUM>, and IEFs independently where they are contained in the same parent network function; enabling only specific services or features of POIs <NUM> (individually and in groups). Selective provisioning can be supported on a per warrant basis.

The SIRF <NUM> can provide the LIPF <NUM> with the system related information for network functions that are known by the SIRF <NUM> (e.g., service topology). The information provided can allow the LIPF <NUM>/LICF <NUM> to perform operations to establish and maintain interception of the target service (e.g., provisioning POIs <NUM>, triggering functions <NUM>, and MDFs <NUM>). LIPF <NUM>/LICF <NUM> knowledge of POI <NUM>, triggering function <NUM>, and MDF <NUM> existence can be provided directly by interactions between the LIPF <NUM>/LICF <NUM> and the underlying CSP management systems that instantiate network functions.

In virtualized networks where selective per POI <NUM> provisioning of target identifiers is not required, or only limited network static network slicing is in use, implementation of the SIRF <NUM> is not required to allow the LIPF <NUM> and LICF <NUM> to meet lawful interception requirements. Entities in the lawful interception architecture shown in <FIG> that interact with the ADMF <NUM> are examples of network elements. More specifically, the POI <NUM>, the triggering function <NUM>, the MDF <NUM>, and the SIRF <NUM> are examples of network elements.

<FIG> illustrates certain components that can be included within a computing system <NUM> that can be used to implement the actions and operations described herein in connection with an ADMF. In some embodiments, a plurality of computing systems <NUM> can collectively implement the actions and operations described herein in connection with an ADMF.

The computing system <NUM> includes a processor <NUM> and memory <NUM> in electronic communication with the processor <NUM>. Instructions 605a and data 607a can be stored in the memory <NUM>. The instructions 605a can be executable by the processor <NUM> to implement some or all of the methods, steps, operations, actions, or other functionality disclosed herein related to an ADMF. Executing the instructions 605a can involve the use of the data 607a that is stored in the memory <NUM>. When the processor <NUM> executes the instructions 605a, various instructions 605b can be loaded onto the processor <NUM>, and various pieces of data 607b can be loaded onto the processor <NUM>.

Unless otherwise specified, any of the various examples of modules and components described herein in connection with an ADMF can be implemented, partially or wholly, as instructions 605a stored in memory <NUM> and executed by the processor <NUM>. Any of the various examples of data described herein in connection with an ADMF can be among the data 607a that is stored in memory <NUM> and used during execution of the instructions 605a by the processor <NUM>.

Although just a single processor <NUM> and a single memory <NUM> are shown in the computing system <NUM> of Figure <NUM>, in an alternative configuration, a combination of processors and/or a combination of memory devices could be used.

The instructions 605a in the memory <NUM> can include one or more modules that can be executable by the processor <NUM> to perform some or all aspects of the methods that have been described herein in connection with an ADMF. <FIG> shows the computing system <NUM> with an active state transition module <NUM> and a ping request handler module <NUM>. The active state transition module <NUM> and the ping request handler module <NUM> can include instructions 605a that are executable by the processor <NUM> to perform aspects of the method <NUM> shown in <FIG> and <FIG> that involve actions or operations performed by the ADMF <NUM>. The active state transition module <NUM> and the ping request handler module <NUM> can also include instructions 605a that are executable by the processor <NUM> to perform the method <NUM> shown in <FIG>.

The data 607a stored in the memory <NUM> can include any of the various examples of data described herein in connection with an ADMF. The data 607a stored in the memory <NUM> can represent data that is stored, accessed, or otherwise used in connection with the methods that have been described herein in connection with an ADMF (e.g., the method <NUM> shown in <FIG> and <FIG>, the method <NUM> shown in <FIG>). For example, the data 607a stored in the memory <NUM> can include an ADMF ID <NUM>, an IP address <NUM> for the ADMF, and network element address information <NUM>. The ADMF ID <NUM> shown in <FIG> can represent any of the ADMF IDs described herein (e.g., the ADMF ID <NUM> shown in <FIG>). The IP address <NUM> shown in <FIG> can represent any of the ADMF IP addresses described herein (e.g., any of the IP addresses <NUM> shown in <FIG>). The network element address information <NUM> can enable the ADMF to communicate with one or more network elements.

The specific instructions 605a and data 607a shown in <FIG> are provided for purposes of example only and should not be interpreted as limiting the scope of the present disclosure. A computing system <NUM> that implements any of the techniques disclosed herein can include other instructions 605a and/or other data 607a in addition to or instead of what is specifically shown in <FIG>.

The computing system <NUM> can also include various other components, including one or more communication interfaces <NUM>, one or more input devices <NUM>, and one or more output devices <NUM>.

The communication interface(s) <NUM> can be configured to communicate with other computing systems and/or networking devices. This includes receiving data transmissions from other computing systems and/or networking devices, and also sending data transmissions to other computing systems and/or networking devices. The communication interface(s) <NUM> can be based on wired communication technology, wireless communication technology, or both.

The various components of the computing system <NUM> can be coupled together by one or more buses, which can include a power bus, a control signal bus, a status signal bus, a data bus, etc. For simplicity, the various buses are illustrated in Figure <NUM> as a bus system <NUM>.

<FIG> illustrates certain components that can be included within a computing system <NUM> that can be used to implement the actions and operations described herein in connection with a network element. In some embodiments, a plurality of computing systems <NUM> can collectively implement the actions and operations described herein in connection with a network element.

The computing system <NUM> is similar in several respects to the computing system <NUM> described previously in connection with <FIG>. The computing system <NUM> includes a processor <NUM> and memory <NUM> in electronic communication with the processor <NUM>. Instructions 705a and data 707a can be stored in the memory <NUM>. The computing system <NUM> can also include one or more communication interfaces <NUM>, one or more input devices <NUM>, and one or more output devices <NUM>. The various components of the computing system <NUM> can be coupled together by a bus system <NUM>. These components can be similar to the components described previously.

The instructions 705a can be executable by the processor <NUM> to implement some or all of the methods, steps, operations, actions, or other functionality disclosed herein related to a network element. Unless otherwise specified, any of the various examples of modules and components described herein in connection with a network element can be implemented, partially or wholly, as instructions 705a stored in memory <NUM> and executed by the processor <NUM>. Any of the various examples of data described herein in connection with a network element can be among the data 707a that is stored in memory <NUM> and used during execution of the instructions 705a by the processor <NUM>.

The instructions 705a in the memory <NUM> can include one or more modules that can be executable by the processor <NUM> to perform some or all aspects of the methods that have been described herein in connection with a network element. <FIG> shows the computing system <NUM> with an active ADMF identification module <NUM>. The active ADMF identification module <NUM> can include instructions 705a that are executable by the processor <NUM> to perform aspects of the method <NUM> shown in <FIG> and <FIG> that involve actions or operations performed by the network element. The active ADMF identification module <NUM> can also include instructions 705a that are executable by the processor <NUM> to perform the method <NUM> shown in <FIG>.

The data 707a stored in the memory <NUM> can include any of the various examples of data described herein in connection with a network element. The data 707a stored in the memory <NUM> can represent data that is stored, accessed, or otherwise used in connection with the methods that have been described herein in connection with a network element (e.g., the method <NUM> shown in <FIG> and <FIG>, the method <NUM> shown in <FIG>). For example, the data 707a stored in the memory <NUM> can include an ADMF ID <NUM>, ADMF IP addresses <NUM>, and an active ADMF indicator <NUM>. The ADMF ID <NUM> shown in <FIG> can represent any of the ADMF IDs described herein (e.g., the ADMF ID <NUM> shown in <FIG>). The ADMF IP addresses <NUM> can represent any of the ADMF IP addresses described herein (e.g., the IP addresses <NUM> shown in <FIG>). The active ADMF indicator <NUM> can represent any of the active ADMF indicators described herein (e.g., the active ADMF indicator <NUM> shown in <FIG>).

The techniques disclosed herein can be implemented in hardware, software, firmware, or any combination thereof, unless specifically described as being implemented in a specific manner. Any features described as modules, components, or the like can also be implemented together in an integrated logic device or separately as discrete but interoperable logic devices. If implemented in software, the techniques can be realized at least in part by a non-transitory computer-readable medium having computer-executable instructions stored thereon that, when executed by at least one processor, perform some or all of the steps, operations, actions, or other functionality disclosed herein. The instructions can be organized into routines, programs, objects, components, data structures, etc., which can perform particular tasks and/or implement particular data types, and which can be combined or distributed as desired in various embodiments.

The term "processor" should be interpreted broadly to encompass a general-purpose processor, a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a controller, a microcontroller, a state machine, and so forth. Under some circumstances, a "processor" may refer to an application specific integrated circuit (ASIC), a programmable logic device (PLD), a field programmable gate array (FPGA), etc. The term "processor" may refer to a combination of processing devices, e.g., a combination of a digital signal processor (DSP) and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a digital signal processor (DSP) core, or any other such configuration.

The term "memory" should be interpreted broadly to encompass any electronic component capable of storing electronic information. The term "memory" may refer to various types of processor-readable media such as random access memory (RAM), read-only memory (ROM), non-volatile random access memory (NVRAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable PROM (EEPROM), flash memory, magnetic or optical data storage, registers, etc. Memory is said to be in electronic communication with a processor if the processor can read information from and/or write information to the memory. Memory that is integral to a processor is in electronic communication with the processor.

The terms "instructions" and "code" should be interpreted broadly to include any type of computer-readable statement(s). For example, the terms "instructions" and "code" may refer to one or more programs, routines, sub-routines, functions, procedures, etc. "Instructions" and "code" may comprise a single computer-readable statement or many computer-readable statements.

The term "communicatively coupled" refers to coupling of components such that these components are able to communicate with one another through, for example, wired, wireless, or other communications media. The term "communicatively coupled" can include direct, communicative coupling as well as indirect or "mediated" communicative coupling. For example, a component A may be communicatively coupled to a component B directly by at least one communication pathway, or a component A may be communicatively coupled to a component B indirectly by at least a first communication pathway that directly couples component A to a component C and at least a second communication pathway that directly couples component C to component B. In this case, component C is said to mediate the communicative coupling between component A and component B.

The term "determining" (and grammatical variants thereof) can encompass a wide variety of actions. For example, "determining" can include calculating, computing, processing, deriving, investigating, looking up (e.g., looking up in a table, a database or another data structure), ascertaining and the like.

The terms "comprising," "including," and "having" are intended to be inclusive and mean that there can be additional elements other than the listed elements. For example, any element or feature described in relation to an embodiment herein may be combinable with any element or feature of any other embodiment described herein, where compatible.

The steps, operations, and/or actions of the methods described herein may be interchanged with one another without departing from the scope of the claims. In other words, unless a specific order of steps, operations, and/or actions is required for proper functioning of the method that is being described, the order and/or use of specific steps, operations, and/or actions may be modified without departing from the scope of the claims.

Claim 1:
A method (<NUM>) for identifying an active administration function 'ADMF' (<NUM>) in a lawful interception deployment that utilizes an ADMF set (<NUM>) comprising a plurality of ADMFs, the method being implemented by a network element (<NUM>), the method (<NUM>) comprising:
identifying (<NUM>) a first ADMF (<NUM>-<NUM>) among the plurality of ADMFs (<NUM>) in the ADMF set (<NUM>) as the active ADMF (<NUM>), wherein at any given point in time only one ADMF among the plurality of ADMFs (<NUM>) is identified as the active ADMF (<NUM>);
exchanging first lawful interception signaling with the first ADMF (<NUM>-<NUM>) when the first ADMF (<NUM>-<NUM>) is the active ADMF (<NUM>);
receiving (<NUM>) an auditing request message from one of the plurality of ADMFs (<NUM>) in the ADMF set (<NUM>), wherein the auditing request message does not identify a specific ADMF in the ADMF set (<NUM>) as a sender of the auditing request message;
sending (<NUM>) a ping request message to each ADMF in the ADMF set (<NUM>);
receiving (<NUM>) a ping response message from a second ADMF among the plurality of ADMFs (<NUM>) in the ADMF set (<NUM>);
identifying (<NUM>) the second ADMF as the active ADMF (<NUM>) based at least in part on receiving the ping response message from the second ADMF; and
exchanging (<NUM>) second lawful interception signaling with the second ADMF when the second ADMF is the active ADMF (<NUM>).