PCSI LI Support

Overview

The CALEA network solution design requires the CALEA Intercept Access Point (IAP) vendors to implement support for multiple (two instances) regionally deployed SS8 Delivery Function systems.

• Audio
• Video
• MSRP
• FECC
• BFCP-TCP

Lawful Interception solution has three interfaces between the network element and mediation server. These are used to provide provisioning, call data (signaling), and call content (media) information. These interfaces are created after the connection is established between the mediation server (DF – delivery function) and the network element (AF – access function). The interface from the mediation server to the lawful interception agency is standardized. The interfaces between AF and DF are defined as:

• X1 or INI-1 interface for provisioning targets
• X2 or INI-2 interface for providing signaling information for the subject
• X3 or INI-3 interface for providing media or call content for the subject

Where, X interface is specified by 3GPP standard while INI is specified by ETSi standard.

P-Com.Session-Info (PCSI) LI solution requires Sonus network elements (EMS, PSX and

Supported Lawful Interception (LI) elements (

Call Flow

1. Provision the intercept server X1 transport address and TLS certificate that EMS has to use to initiate a transport connection over the X1 interface. These are individually specified for the mediation servers in the network.
2. Provision the
   Unable to show "metadata-from": No such page "_space_variables"
    using Sonus EMS X3 intercept transport address and required IPsec details. This address is used to send X3 messages. These are individually specified for the mediation servers in the network.
   
3. The EMS establishes a connection with the SS8 intercept server and executes the necessary authentication procedures to bring up the transport connection.
4. SS8 Intercept server, using the X1 interface, provisions the target URI which is sent to the PSX over the PIPE interface by EMS. This is fully specified SIP/SIPS or TEL URI. This completes the provisioning of a target using the X1 interface. Any call received by this target is intercepted.
5. The IMS network sends a SIP INVITE/18x/200 OK or re-INVITE/200 OK that contains a P-Com-Session-Info header. This header contains a correlation ID and one of more prospective target URI, which is looked into the target table maintained in the PSX.
6. The
   Unable to show "metadata-from": No such page "_space_variables"
    receives a P-Com-Session-Info header in any of the above listed SIP messages and sends a policy request with the target URI to PSX. PSX uses this to perform a lookup in the target table created using the X1 provisioning interface. Assuming that a target URI matches, PSX provides the X3 transport address that is stored along with the target URI. This information is received by SBC in the policy response.

7. The

   Unable to show "metadata-from": No such page "_space_variables"
    finds the LI information in the policy response and understands that the call has to be intercepted. It uses the correlation ID received in SIP messages as well as X3 transport address received from the PSX to fork the media stream to the appropriate mediation server using the X3 interface. This interface forks the media stream over TCP that is established over a secured IPsec tunnel.

   PCSI Call Flow

   

EMS Enhancement

The SS8 mediation server is represented as DF (Delivery Function). The EMS and PSX together are represented as AF (Access Function). The LI database operations are performed on the PSX and X1 provisioning interface is implemented on the EMS. For any X1 operation which has impact on PSX LI database operation, EMS uses PIPE interface with the PSX.

This transport connection is with or without TLS depending upon the configuration. The EMS sends the Authentication Request towards DF with the following IEs when the transport connection is successfully established:

• Generic Message Header: This header uses an IE Access Function Identifier set to zero in Authentication Request.
• Transaction Identity: EMS generates a unique transaction identifier and saves a copy of this.
• Interface Type: Is set to 0x01 – INI1.
• Serial Number: EMS maps it from system configuration.
• MAC Address: EMS maps it from system configuration.
• Model Number: EMS maps it from system configuration.
• Software Revision: EMS maps it from system configuration.
• Provisioning State:
  
  • Set to 0x00 when PSX LI DB is not initialized.
  • Set to 0xDC when PSX LI DB is initialized.
• Hash: NA

The EMS accepts Global Info Set Request coming from DF with the following IE:

• Link Polling Frequency
• Link Inactivity Interval
• AF Database Clean-up Interval

It checks that the Access Function Identifier IE of Generic Message Header in Global Info Set Request has non zero value. If Access Function Identifier is a non-zero value, EMS stores this value and uses it in subsequent EMS generated messages. EMS sends the Transaction Identifier that it receives in the Global Info Set Request message. It also accepts the Service Provider Identity.

Link Options IE is enumerated type with following sub fields, which EMS saves and uses during session maintenance and release procedures:

• Link Polling Frequency
• Link Inactivity Interval
• AF Database Clean-up Interval

The EMS checks that data type for all these sub fields is integer and stores their respective values. Time Stamp data type for this IE is in time format. If AF (PSX) Provisioning State database is empty, it accepts the zero value of this IE.  Any IE received with incorrect data type is rejected with message Operation Result with IEs.

If Access Function Identifier is set to zero then the EMS rejects using Operation Result message with following IEs.

The EMS supports session maintenance, session release, and database clean up procedures using the timers mentioned below:

• Link Polling Frequency (LPF) or Keepalive Interval
• Link Inactivity Interval (LII)
• AF Database Clean-up Interval (DCI)
  

For configuring the EMS for this feature, refer Managing Mediation Servers.

PSX Enhancement

The EMS configures the PSX LI DB over PIPE interface. It creates entry for Target Service List and other parameters. LI DB performs validation of data type for each parameter.

The PSX queries the LI DB based on key Target Service List received in Warrant Info Get Request and returns all parameters. If Target Service List is missing in Warrant Info Get Request, the query is based on key DF1 ID next Target Service List in LI DB.

The PSX provides the following LI information in POL-RES:

• IP address type
• IP address
• Transport protocol type
• Port
• Encryption 
  

SBC Enhancement

The

• Initial INVITE
• 18x SIP response
• 200 OK response to the initial INVITE
• re-INVITE and the 200 OK response to the re-INVITE for scenarios such as call transfer.

Where P-Com.Session-Info format is:

P-Com.Session-info = "P-Com.Session-Info" HCOLON= 
corrID *( SEMI involved-party )
corrID = "corrID" EQUAL word [ "@" word ]
involved-party = LAQUOT involved-uri RAQUOT
involved-uri = SIP-URI / TEL-URI / SIPS-URI

 SIP-URI / TEL-URI / SIPS-URI is specified and can be in a different format as mentioned in the following table:

The

The

• Transport Type = TCP
• Encryption = None/IPsec
• IP Address Type = IPv4 or IPv6

The Mediation Server creates a connection with IPsec over TCP connection towards IP and Port received in LI information of POL-RES and meets the following IPsec requirements:

• Transport mode and Authentication algorithm pre-shared key.
• Hash algorithm SHA1 with Encryption algorithm 3des-cbc
  

The Mediation Server IP, port and pre-shared keys for X3 connection are already configured on the

 If there is a change in mediation server through X1 interface for a target URI between Invite and Re-INVITE message, the