WO2022037848A1

WO2022037848A1 - Correlating lawful interception messages initiated by interception points present in multiple virtual network functions

Info

Publication number: WO2022037848A1
Application number: PCT/EP2021/069305
Authority: WO
Inventors: Nagaraja Rao
Original assignee: Nokia Technologies Oy
Priority date: 2020-08-17
Filing date: 2021-07-12
Publication date: 2022-02-24

Abstract

Systems, methods, apparatuses, and computer program products for correlating lawful interception messages initiated by interception points present in multiple virtual network functions. A method may include establishing communications with a first network function providing lawful interception of a target communication session. The method may also include receiving from the first network function, a first Correlation Message related to the target communication session. The method may further include receiving a first Intercept Product from the first network function, the first Intercept Product including intercepted data of the target communication session. Further, the method may include associating the first Correlation Message received from the first network function to the target communication session.

Description

TITLE:

CORRELATING LAWFUL INTERCEPTION MESSAGES INITIATED BY INTERCEPTION POINTS PRESENT IN MULTIPLE VIRTUAL NETWORK FUNCTIONS

CROSS-REFERENCE TO RELATED APPLICATIONS:

[0001] This application claims priority from U.S. provisional patent application no. 63/066,599 filed on August 17, 2020. The contents of this earlier filed application are hereby incorporated by reference in their entirety.

FIELD:

[0002] Some example embodiments may generally relate to mobile or wireless telecommunication systems, such as Long Term Evolution (LTE) or fifth generation (5G) radio access technology or new radio (NR) access technology, or other communications systems. For example, certain example embodiments may relate to apparatuses, systems, and/or methods for correlating lawful interception messages initiated by interception points present in multiple virtual network functions.

BACKGROUND:

[0003] Examples of mobile or wireless telecommunication systems may include the Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access Network (UTRAN), Long Term Evolution (LTE) Evolved UTRAN (E-UTRAN), LTE- Advanced (LTE- A), MulteFire, LTE- A Pro, and/or fifth generation (5G) radio access technology or new radio (NR) access technology. Fifth generation (5G) wireless systems refer to the next generation (NG) of radio systems and network architecture. 5G is mostly built on a new radio (NR), but the 5G (or NG) network can also build on E-UTRAN radio. It is estimated that NR will provide bitrates on the order of 10-20 Gbit/s or higher, and will support at least enhanced mobile broadband (eMBB) and ultra-reliable low-latency-communication (URLLC) as well as massive machine type communication (mMTC). NR is expected to deliver extreme broadband and ultra-robust, low latency connectivity and massive networking to support the Internet of Things (IoT). With loT and machine-to-machine (M2M) communication becoming more widespread, there will be a growing need for networks that meet the needs of lower power, low data rate, and long battery life. It is noted that, in 5G, the nodes that can provide radio access functionality to a user equipment (i.e., similar to Node B in UTRAN or eNB in LTE) are named gNB when built on NR radio and named NG-eNB when built on E-UTRAN radio.

SUMMARY:

[0004] Some example embodiments may be directed to a method. The method may include establishing communications with a first network node providing lawful interception of a target communication session. The method may also include receiving from the first network node, a first Correlation Message related to the target communication session. The method may further include receiving a first Intercept Product from the first network node, the first Intercept Product including intercepted data of the target communication session. In addition, the method may include associating the first Correlation Message received from the first network node to the target communication session.

[0005] Other example embodiments may be directed to an apparatus. The apparatus may include at least one processor and at least one memory including computer program code. The at least one memory and computer program code may also be configured to, with the at least one processor, cause the apparatus at least to establish communications with a first network node providing lawful interception of a target communication session. The apparatus may also be caused to receive from the first network node, a first Correlation Message related to the target communication session. The apparatus may further be caused to receive a first Intercept Product from the first network node, the first Intercept Product including intercepted data of the target communication session. In addition, the apparatus may be caused to associate the first Correlation Message received from the first network node to the target communication session.

[0006] Other example embodiments may be directed to an apparatus. The apparatus may include means for establishing communications with a first network node providing lawful interception of a target communication session. The apparatus may also include means for receiving from the first network node, a first Correlation Message related to the target communication session. The apparatus may further include means for receiving a first Intercept Product from the first network node, the first Intercept Product including intercepted data of the target communication session. In addition, the apparatus may include means for associating the first Correlation Message received from the first network node to the target communication session.

[0007] In accordance with other example embodiments, a non-transitory computer readable medium may be encoded with instructions that may, when executed in hardware, perform a method. The method may include establishing communications with a first network node providing lawful interception of a target communication session. The method may also include receiving from the first network node, a first Correlation Message related to the target communication session. The method may further include receiving a first Intercept Product from the first network node, the first Intercept Product including intercepted data of the target communication session. In addition, the method may include associating the first Correlation Message received from the first network node to the target communication session.

[0008] Other example embodiments may be directed to a computer program product that performs a method. The method may include establishing communications with a first network node providing lawful interception of a target communication session. The method may also include receiving from the first network node, a first Correlation Message related to the target communication session. The method may further include receiving a first Intercept Product from the first network node, the first Intercept Product including intercepted data of the target communication session. In addition, the method may include associating the first Correlation Message received from the first network node to the target communication session.

[0009] Other example embodiments may be directed to an apparatus that may include circuitry configured to establish communications with a first network node providing lawful interception of a target communication session. The apparatus may also include circuitry configured to receive from the first network node, a first Correlation Message related to the target communication session. The apparatus may further include circuitry configured to receive a first Intercept Product from the first network node, the first Intercept Product including intercepted data of the target communication session. In addition, the apparatus may include circuitry configured to associate the first Correlation Message received from the first network node to the target communication session.

[0010] Certain example embodiments may be directed to a method. The method may include establishing communications with a mediation delivery function. The method may also include receiving from the mediation delivery function a first lawful Intercept Product related to a first lawful interception function of a first network node, and a second lawful Intercept Product related to a second lawful interception function of a second network node according to a first approach, or the first lawful Intercept Product, the second lawful Intercept Product, and a Correlation Message according to a second approach. According to certain example embodiments, the first lawful Intercept Product may include first correlation information, and the second lawful Intercept Product may include second correlation information. According to other example embodiments, receiving according to the first approach or the second approach may be based on whether the first correlation information and the second information is the same or different. According to some example embodiments, when the receiving is according to the second approach, the method may further include associating the Correlation Message with the first lawful interception product and the second lawful interception product for a same target communication session.

[0011] Other example embodiments may be directed to an apparatus. The apparatus may include at least one processor and at least one memory including computer program code. The at least one memory and computer program code may be configured to, with the at least one processor, cause the apparatus at least to establish communications with a mediation delivery function. The apparatus may also be caused to receive from the mediation delivery function a first lawful Intercept Product related to a first lawful interception function of a first network node, and a second lawful Intercept Product related to a second lawful interception function of a second network node according to a first approach, or the first lawful Intercept Product, the second lawful Intercept Product, and a Correlation Message according to a second approach. According to certain example embodiments, the first lawful Intercept Product may include first correlation information, and the second lawful Intercept Product may include second correlation information. According to other example embodiments, receiving according to the first approach or the second approach may be based on whether the first correlation information and the second information is the same or different. According to some example embodiments, when the receiving is according to the second approach, the method may further include associating the Correlation Message with the first lawful interception product and the second lawful interception product for a same target communication session. [0012] Other example embodiments may be directed to an apparatus. The apparatus may include means for establishing communications with a mediation delivery function. The apparatus may also include means for receiving from the mediation delivery function a first lawful Intercept Product related to a first lawful interception function of a first network node, and a second lawful Intercept Product related to a second lawful interception function of a second network node according to a first approach, or the first lawful Intercept Product, the second lawful Intercept Product, and a Correlation Message according to a second approach. According to certain example embodiments, the first lawful Intercept Product may include first correlation information, and the second lawful Intercept Product may include second correlation information. According to other example embodiments, receiving according to the first approach or the second approach may be based on whether the first correlation information and the second information is the same or different. According to some example embodiments, when the receiving is according to the second approach, the method may further include associating the Correlation Message with the first lawful interception product and the second lawful interception product for a same target communication session.

[0013] In accordance with other example embodiments, a non-transitory computer readable medium may be encoded with instructions that may, when executed in hardware, perform a method. The method may include establishing communications with a mediation delivery function. The method may also include receiving from the mediation delivery function a first lawful Intercept Product related to a first lawful interception function of a first network node, and a second lawful Intercept Product related to a second lawful interception function of a second network node according to a first approach, or the first lawful Intercept Product, the second lawful Intercept Product, and a Correlation Message according to a second approach. According to certain example embodiments, the first lawful Intercept Product may include first correlation information, and the second lawful Intercept Product may include second correlation information. According to other example embodiments, receiving according to the first approach or the second approach may be based on whether the first correlation information and the second information is the same or different. According to some example embodiments, when the receiving is according to the second approach, the method may further include associating the Correlation Message with the first lawful interception product and the second lawful interception product for a same target communication session.

[0014] Other example embodiments may be directed to a computer program product that performs a method. The method may include establishing communications with a mediation delivery function. The method may also include receiving from the mediation delivery function a first lawful Intercept Product related to a first lawful interception function of a first network node, and a second lawful Intercept Product related to a second lawful interception function of a second network node according to a first approach, or the first lawful Intercept Product, the second lawful Intercept Product, and a Correlation Message according to a second approach. According to certain example embodiments, the first lawful Intercept Product may include first correlation information, and the second lawful Intercept Product may include second correlation information. According to other example embodiments, receiving according to the first approach or the second approach may be based on whether the first correlation information and the second information is the same or different. According to some example embodiments, when the receiving is according to the second approach, the method may further include associating the Correlation Message with the first lawful interception product and the second lawful interception product for a same target communication session. [0015] Other example embodiments may be directed to an apparatus that may include circuitry configured to establish communications with a mediation delivery function. The apparatus may also include circuitry configured to receive from the mediation delivery function a first lawful Intercept Product related to a first lawful interception function of a first network node, and a second lawful Intercept Product related to a second lawful interception function of a second network node according to a first approach, or the first lawful Intercept Product, the second lawful Intercept Product, and a Correlation Message according to a second approach. According to certain example embodiments, the first lawful Intercept Product may include first correlation information, and the second lawful Intercept Product may include second correlation information. According to other example embodiments, receiving according to the first approach or the second approach may be based on whether the first correlation information and the second information is the same or different. According to some example embodiments, when the receiving is according to the second approach, the method may further include associating the Correlation Message with the first lawful interception product and the second lawful interception product for a same target communication session.

BRIEF DESCRIPTION OF THE DRAWINGS:

[0016] For proper understanding of example embodiments, reference should be made to the accompanying drawings, wherein:

[0017] FIG. 1 illustrates an example of an IP multimedia subsystem (IMS) lawful interception (LI) model.

[0018] FIG. 2 illustrates an example of Li-specific dedicated interfaces.

[0019] FIG. 3 illustrates an example signal flow of intercept related information (IRI)-point of interception (POI) and call content (CC)-POI in the same network function (NF). [0020] FIG. 4 illustrates an example signal flow of IRI-POI and CC-triggering function (TF) in the same NF.

[0021] FIG. 5 illustrates an example of an abstraction syntax notation 1.

[0022] FIG. 6 illustrates Correlation Messages sent from an LI function to a mediation and delivery function (MDF), and from the MDF to a law enforcement monitoring facility (LEMF), according to certain example embodiments.

[0023] FIG. 7 illustrates an example signal flow associating the Correlation Message from two different LI functions, according to certain example embodiments.

[0024] FIG. 8 illustrates an example signal flow where correlation information in the LI Product is sent to the LEMF, according to certain example embodiments.

[0025] FIG. 9 illustrates an example signal flow where the Correlation Message is used with LI functions in multiple NFs, according to certain example embodiments.

[0026] FIG. 10 illustrates an example signal flow of a Correlation Message being used with LI functions in multiple NFs, according to certain example embodiments.

[0027] FIG. 11 illustrates an example signal flow with multiple MDFs in one case, according to certain example embodiments.

[0028] FIG. 12 illustrates an example signal flow with multiple MDF in another case, according to certain example embodiments.

[0029] FIG. 13 illustrates an example signal flow with multiple MDFs in another case, according to certain example embodiments.

[0030] FIG. 14 illustrates an LI scenario of Party A (target) originating an IP multimedia subsystem (IMS) session with Party B, according to certain example embodiments. [0031] FIG. 15 illustrates an LI scenario of Party B (target) receiving an IMS session from Party A, according to certain example embodiments.

[0032] FIG. 16 illustrates an LI scenario of an incoming call to Party B (target) that is redirected to Party C, according to certain example embodiments.

[0033] FIG. 17 illustrates an LI scenario of a conferencing call, according to certain example embodiments.

[0034] FIG. 18 illustrates an example signal flow of a Correlation Message sent from CC-TF to IRI-POI, according to certain example embodiments.

[0035] FIG. 19 illustrates an example signal flow of a Correlation Message sent from IRI-POI to CC-TF, according to certain example embodiments.

[0036] FIG. 20 illustrates a signal flow of a Correlation Message sent from IRI-POI to pseudo IRI-POI to CC-TF, according to certain example embodiments.

[0037] FIG. 21 illustrates a flow diagram of a method, according to certain example embodiments.

[0038] FIG. 22 illustrates a flow diagram of another method, according to certain example embodiments.

[0039] FIG. 23(a) illustrates an apparatus, according to certain example embodiments.

[0040] FIG. 23(b) illustrates another apparatus, according to certain example embodiments.

DETAILED DESCRIPTION:

[0041] It will be readily understood that the components of certain example embodiments, as generally described and illustrated in the figures herein, may be arranged and designed in a wide variety of different configurations. The following is a detailed description of some example embodiments of systems, methods, apparatuses, and computer program products for correlating lawful interception (LI) messages initiated by interception points present in multiple virtual network functions (NFs) (e.g., network node).

[0042] The features, structures, or characteristics of example embodiments described throughout this specification may be combined in any suitable maimer in one or more example embodiments. For example, the usage of the phrases “certain embodiments,” “an example embodiment,” “some embodiments,” or other similar language, throughout this specification refers to the fact that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment. Thus, appearances of the phrases “in certain embodiments,” “an example embodiment,” “in some embodiments,” “in other embodiments,” or other similar language, throughout this specification do not necessarily refer to the same group of embodiments, and the described features, structures, or characteristics may be combined in any suitable manner in one or more example embodiments.

[0043] As described herein, “target” may refer to a user whose communications are authorized for lawful interception. Further, “LI product” may refer to the intercepted data delivered to the law enforcement monitoring facility (LEMF). In addition, “Intercept Product” may refer to the intercepted data generated at the LI function present in a NF. Furthermore, intercept related information (IRI) may refer to the signaling related LI product delivered to the LEMF. In addition, “xIRI” may refer to the signaling related Intercept Product, and “CC” may refer to communication content, which may be the media related LI product delivered to the LEMF. “xCC” may refer to the media related Intercept Product, and “point of interception (POI)” may refer to an LI specific function present within a NF. In certain example embodiments, the POI may perform the interception of a target communication. [0044] As further described herein, “IRI-POI” may represent the POI that generates the signaling related Intercept Product, and “CC-POI” may refer to the POI that generates the media related Intercept Product. In addition, “trigger function (TF)” may refer to an LI specific function within an NF that triggers the interception at a POI. “IRI-TF” may refer to the TF that triggers an IRI-POI, and “CC-TF” may refer to the TF that triggers a CC-POI. Furthermore, “MDF” may refer to the mediation delivery function that receives the interception product from the POI, and delivers the same to the LEMF as an LI product. In certain example embodiments, MDF2 may be used to mediate and deliver the signaling related LI product to the LEMF, and MDF3 may be used to mediate and deliver the media related LI product to the LEMF.

[0045] As described herein “LI HI2” may refer to the interface between the MDF2 and the LEMF, and used to deliver the IRI from MDF2 to LEMF. In addition, “LI HI3” may refer to the interface between MDF3 and the LEMF, and used to deliver the CC from MDF2 to LEMF. Furthermore, “LI X2” may refer to the interface between IRI-POI and MDF2, and used to deliver the xIRI from IRI-POI to MDF2. Additionally, “LI X3” may refer to the interface between CC-POI and MDF3, and used to deliver the xCC from CC-POI to MDF3. Moreover, “LI T2” may refer to the triggering interface between an IRI-TF and IRI-POI, and “LI T3” may refer to the trigger interface between a CC-TF and CC-POI.

[0046] Additionally, if desired, the different functions or procedures discussed below may be performed in a different order and/or concurrently with each other. Furthermore, if desired, one or more of the described functions or procedures may be optional or may be combined. As such, the following description should be considered as merely illustrative of the principles and teachings of certain example embodiments, and not in limitation thereof. [0047] Certain example embodiments may relate to LI where multiple NFs in a cellular service provider’s (CSPs) network may be involved in providing the LI functions for a target communication with a need to correlate (i.e., associate; associating the data to the same session) the LI related data (gathered from those multiple LI functions), and delivered to the law enforcement agencies (LEAs). In certain example embodiments, the NFs may be deployed in a virtualized environment.

[0048] FIG. 1 illustrates an example of an IP multimedia subsystem (IMS) LI model. As illustrated in FIG. 1, the LI of a target’s communications may involve IRI being delivered over the LI HI2 to LEMF (from MDF2), and CC delivered over LI HI3 (from MDF2) to LEMF may be correlated. In certain cases, the NF involved in providing the interception of IMS-based services may be determined based on a deployment option, the network configuration, LI service scope, and/or the IMS session including roaming scenarios. The IRI-POI functions may be provided by the network functions that handle the session initiation protocol (SIP) messages (those network functions may be referred to as IMS signaling functions), and triggering CC-POI functions may be provided by the NFs that handle the media (these network functions may be referred to as IMS media functions). Further, the CC-TF functions may be provided by the NFs that handle the SIP messages (referred to as IMS signaling functions), and manage the IMS media functions. In addition, the NFs that provide the CC-TF functions may be different from the NFs that provide the IRI-POI functions.

[0049] When multiple NFs are involved in providing the LI functions for a target’s communication session, the LI related data (Intercept Product) gathered from the multiple LI functions when delivered to the LEAs (LI product), may be correlated. For example, in an IMS LI session, the IRI and CC delivered to the LEMF may be correlated. However, the method that can be used to provide such correlation is currently not defined when different NFs are involved in providing the LI functions.

[0050] In certain cases, when multiple NFs are involved in providing the LI functions for a target’s communication, the LI related data may be delivered from those LI functions to the MDFs. The LI related data received from those LI functions and delivered to the LEMF may be correlated. That is, the correlation information between the LI functions present in different NFs may be exchanged prior to using it.

[0051] With the advent of virtualization of the NFs, the security measures associated with the LI process may prohibit any two NFs exchanging any LI specific information that pertains to a target’s communication. 3rd Generation Partnership Project (3GPP) describe that the LI functions residing within the NFs can know about the LI and, thus, if necessary, can communicate. However, NFs themselves cannot have any knowledge about LI. Therefore, if such a method is followed, then in order for the two LI functions to exchange the correlation information, a new interface may need to be defined between the two LI functions. One of the criteria used with the recent LI specifications is that such an interface, if it were to be realized, may be different from the interface that may exist between the two respective home NFs due to security reasons. The existing IMS LI model may pass the correlation information when the two NFs exchange the signaling information related to the session. However, such an approach may not be acceptable as per the newer LI specifications.

[0052] Unless the LI functions have a need for an interaction for some other reason (e.g., they already have an LI specific interface), having an interaction just to negotiate the correlation information may introduce additional interfaces. Further, extending the approach to the standardized LI specific interfaces may be complex in a virtualized environment when new security requirements are taken into consideration. In addition, this may become complex if more NFs are involved.

[0053] FIG. 2 illustrates an example of Li-specific dedicated interfaces. As illustrated in the example of FIG. 2, six NFs have LI functions. FIG. 2 also assumes that NF-1 has non-LI interfaces defined to the six NFs. As illustrated in FIG. 2, NF-1 may be involved in the target’s communication for all scenarios, and the other NFs may be involved on specific scenarios. Accordingly, the LI function in NF-1 may be involved in the interception of target communication for all scenarios, and the LI functions in the other NFs may be involved in the interception of target communication on specific scenarios.

[0054] As illustrated in FIG. 2, if the LI function in NF-1 needs to negotiate the correlation information with the LI functions residing in the other NFs, the LI function in NF-1 may have to have a dedicated LI specific interface to the LI functions residing in those other NFs. From a deployment perspective in a virtualized network, this can be complex. In addition, for this, the LI function in NF-1 should be aware of where all other LI functions reside. Considering the situation of the IMS LI model example, the IRI-POI may reside in the S- CSCF, and CC-TF may reside in P-CSCF, IBCF, MGCF, or an AS/MRFC. In some scenarios, the IRI-POI in the S-CSCF may be unaware of CC-TF’s host NF (e.g., redirecting session scenarios). Further, as illustrated in FIG. 2, the situation may become complex when more NFs are involved, and every NF that has an LI function may end up having a need to support yet another LI specific interface.

[0055] Currently, there is not a method defined in the LI standards that defines how the correlation information can be handled when the LI functions reside in multiple NFs, in a more general way. However, certain LI functions related to IRI-POI, CC-TF, and CC-POI have been defined in 3 GPP. [0056] FIG. 3 illustrates an example signal flow of IRI-POI and CC-POI in the same NF. As illustrated in FIG. 3, when the IRI-POI and CC-POI are in the same NF (e.g., IMS based push to talk over cellular), establishing the correlation may be presumed to be easy. FIG. 3 also illustrates that the LI function present in the NF may use the same correlation information (shown as Cor-Id-1) in the Intercept Product la sent to the MDF2 and Intercept Product lb sent to the MDF3. In addition, the LI Product 1 is sent from the MDF2 to the LEMF and the LI Product 2 is sent from MDF3 to the LEMF, which makes it possible to have the same correlation information (Cor-Id-1). [0057] FIG. 4 illustrates an example signal flow of IRI-POI and CC-TF in the same NF. In certain cases, when the IRI-POI and CC-TF are in the same NF (e.g., SMF, P-CSCF), then the concept illustrated in FIG. 3 may still be used with the Intercept Trigger sent from the CC-TF to CC-POI carrying the correlation information. Here, the two LI functions present in different NFs may already have an LI specific direct interface to share other LI specific information. In addition, that interface may be reused to negotiate the correlation information.

[0058] As illustrated in FIG. 4, the IRI-POI in NF-1 may provide the correlation information (Cor-Id-1) to the MDF2 in the Intercept Product 1. Further, the CC-TF in NF-1 may provide the correlation information (Cor-Id- 1) to the CC-POI in NF-2 in the Intercept Trigger. In addition, CC-POI in NF- 2 may provide the correlation information (Cor-Id-1) to the MDF3 in the Intercept Product 3. Additionally, LI Product 1 and LI Product 2 may be delivered by the MDF2 and MDF3 and, thus, may have the same correlation information (Cor-Id-1).

[0059] In certain cases, IRI-POI and CC-TF may be in different NFs (e.g., S- CSCF, P-CSCF, S-CSCF, and IBCF). Some of the deployed IMS LI models may follow a proprietary method of passing the correlation information between the NFs that have the LI functions as and when they exchange the signaling information related to the session setup. Since the NFs exchange the correlation information, not the LI functions in the NFs, the method cannot be standardized as they do not meet the new security requirements. Furthermore, such methods are used when the NFs are deployed in a non- virtualized environment, and the method used to carry the correlation information is not standardized. In addition, no method has been defined (i.e., standardized) when the IRI-POI and CC-TF are provided in separate NFs.

[0060] 3GPP for IMS VoIP LI allows the use of a combination of multiple correlation related information in the IRI messages. The related ASN. l is shown in FIG. 5. As can be seen in FIG. 5, the IMS-VoIP-Correlation may be a set of the sequence that consists of a correlation information used in the IRI, and correlation information used in the CC. However, there is still no definition of the IMS LI system that allows the MDFs to accomplish this goal. [0061] In addition, the LI functions defined in 3GPP relate to scenarios of multiple NFs having LI functions that have several flavors. When the distribution is limited to two NFs with one having the IRI-POI, CC-TF, and the other having the CC-POI, the functions defined in 3 GPP may be used. In addition, when the involved LI functions already have an Li-specific dedicated interface between them, that existing interface may be used to negotiate the correlation information.

[0062] In certain cases, when two LI functions present in two NFs already have an LI specific interface, they may negotiate the use of the same correlation information over that LI specific interface. However, if the LI functions in the two NFs do not already have a dedicated LI specific interface, and if the Intercept Products generated at those LI functions need to be correlated before delivering the same to the LEMF as LI Product (via MDF), then introducing a new LI specific dedicated interface for the purpose of negotiating the correlation information between the two may result in a complex deployment scenario based on the number of NFs that may have such LI functions. Thus, to resolve these issues, certain example embodiments may provide a method that does not depend on (or require to have) such additional LI specific dedicated interfaces. For instance, certain example embodiments may introduce a new message referred to as a Correlation Message sent from the LI function in an NF to the MDF, and forwarded from the MDF to the LEMF.

[0063] According to certain example embodiments, when used between the LI function in an NF and the MDF, the Correlation Message may carry the correlation information that is intended to be used by that LI function in the Intercept Product for a target’s communication session. The Correlation Message may also carry the information needed to identify the target’s communication session so that the MDF can associate the correlation information received from two LI functions present in two different NFs. In other example embodiments, additional information may also be sent.

[0064] According to certain example embodiments, when used between the MDF and the LEMF, the Correlation Message may carry the multiple correlation information values associated with the target’s communication session that the LEMF may receive in the LI Products. In certain example embodiments, use of a Correlation Message from MDF to LEMF may be conditional in the sense it may be required when the LEMF is expected to receive different correlation information in the LI Products.

[0065] FIG. 6 illustrates Correlation Messages sent from LI function to MDF, and from MDF to LEMF, according to certain example embodiments. In particular, as illustrated in FIG. 6, the correlation information used by the LI functions present in different NFs may be different (Cor-Id-1 and Cor-Id-2), and there may not be a need to have a new LI specific interface between the two LI functions present in two NFs. As illustrated in FIG. 6, the Correlation Message from an LI function in a NF to the MDF may be sent over one of the LI specific interfaces that has already been defined. Such an interface between the LI function that generates the Correlation Message and the MDF may already be present even if not used in some scenarios. In addition, the session ID shown in FIG. 6 may allow the MDF to associate the two Correlation Messages received from two different LI functions to the target’s communication (i.e., the MDF may determine that the two Correlation Messages relate to the same communication session).

[0066] According to certain example embodiments, when the MDF receives the Correlation Messages from LI functions present in different NFs with differing correlation information for a particular session of the target’s communication, the MDF may determine the correlation information that it wants to include in the LI Product sent to the LEMF. In other example embodiments, the MDF may also use the same correlation information (Cor- Id-x as shown in Approach #1 of FIG. 6) in all of the LI Products that it sends to the LEMF, irrespective of the correlation information that it receives from the LI functions present in the different NFs. For example, in certain example embodiments, the MDF need not use the correlation information that it receives from the POIs. In certain example embodiments, Cor-Id-x may be used to indicate that what MDF uses can be different. According to certain example embodiments, the LEAs may be able to correlate different communication related information that they receive. If all the messages have the same correlation information (e.g., 100), then there is no need to send the Correlation Message. On the other hand, in other example embodiments, if MDF uses 100 in some messages and 200 in some other messages, and if those two sets of messages are related to the same session and need to be correlated, then a Correlation Message can indicate that the 100 and 200 belong to the same session.

[0067] Alternatively, the MDF may use the correlation information in the LI Products as received in the associated Intercept Products (as shown in Approach #2 of FIG. 6). In the latter case, the MDF may send a Correlation Message to the LEMF. Thus, certain example embodiments may provide a method that allows the MDFs to correlate the Intercept Products received from LI functions present in different NFs. In addition, certain example embodiments may not require the LI functions present in those different NFs to have any new LI specific interface for the purpose of negotiating the correlation information. Further, according to certain example embodiments, the Correlation Message from MDF to LEMF may be different from the Correlation Message sent from NF1 to MDF and NF2 to MDF. For example, NF1/NF2/POI to MDF, the Correlation Message carries the Session Id information to indicate to which the correlation information is associated with. Here, each Correlation Message may have a Correlation Number (such as Cor-Id-1) and Session Id (such as Session Id). On the other hand, in the Correlation Message sent from MDF to LEMF, the two or more Correlation Numbers may be linked such as, for example, Cor-Id-1 and Cor-Id-2.

[0068] According to certain example embodiments, a Correlation Message may be treated as an intercept related information or IRE In some example embodiments, it may be an xIRI when used between the LI function and the MDF, and it be an IRI message when used between the MDF and the LEMF. Accordingly, the IRI may be sent over the LI X2 (from LI function to MDF), and over LI HI2 (from MDF to LEMF). In certain example embodiments, use of Correlation Message from MDF to LEMF may be conditional and optional in some situations.

[0069] In certain example embodiments, the Correlation Message from an LI function to the MDF may include correlation information (e.g., Cor-Id-1 or Cor-Id-2), intercepted target’s session information, scope of the Intercept Product, any other information (e.g., see FIGs. 11 and 12, and intercept ID) needed to associate with the warrant, or a combination of any one or more of these. According to certain example embodiments, the use of correlation information and intercepted target’s session information (shown as session Id in FIG. 6) are described above. In some example embodiments, the scope of the Intercept Product may indicate to the MDF how the correlation information may be used. For example, the scope may refer to IRI versus CC. Furthermore, any other information needed to associate with the warrant may be used to help the MDF to associate the Correlation Message with a particular intercept. This may help the MDF associate the Correlation Message with the other Intercept Products associated with the same target’s communication session (e.g., MDF can conclude that they relate to the same intercept).

[0070] According to certain example embodiments, the MDF may follow various approaches. For example, the MDF may use the same correlation information that it receives from the LI functions in the LI Products delivered to the LEMF. The MDF may also use the correlation that it receives from one of the LI functions for all LI Products sent to the LEMF. In addition, the MDF may have separate correlation information that applies to the entire target’s communication session independent of the LI functions’ home NFs. In the former approach, the MDF may send a Correlation Message to the LEMF to indicate that multiple correlation information would be seen in the LI Products related to a session. For instance, if the MDF forwards the Cor-Id-1 to LEMF and forwards the Cor-Id-2 to LEMF, then a Correlation Message may be needed to let LEMF know Cor-Id-1 and Cor-Id-2 are linked. Thus, in some example embodiments, the Correlation Message that is sent from MDF to LEMF may include information such as a set of correlation information or a set of LI Product scope, or any other information useful to associate with the warrant.

[0071] According to certain example embodiments, the set of correlation information and LI Product scope may provide different correlation information the LEMF may receive along with the associated scope of LI Products (e.g. IRI, CC). Any other information necessary to associate with the warrant may allow the LEMF to associate the correlation information with the warrant. This allows the LEMF to associate the Correlation Message with the other LI Products received for the same target’s communication session.

[0072] In certain example embodiments, the Correlation Message from MDF to LEMF may still be necessary depending on whether the same MDF is involved in delivering the complete package of LI Products to the LEMF. For example, in the 3GPP defined LI model, the MDF2 delivers the IRI messages and MDF3 generates the CC. In this situation, the MDF2 may generate a Correlation Message to the LEMF to establish the relationship between the correlation information delivered in the IRI messages, and the correlation information delivered in the CC.

[0073] According to certain example embodiments, two NFs that have the LI functions may not be adjacent to each other and, thus, the use of a Session Id to identify the target’s session may not be realistic. To resolve this problem, certain example embodiments may provide extensions to the embodiments described above.

[0074] Associating the Correlation Message from two different LI functions [0075] Certain example embodiments may associate the Correlation Messages from two different LI functions. According to certain example embodiments, when the two or more NFs are involved in handling the target’s communication session, those NFs do communicate with each other for a normal non-LI specific session related information exchange (e.g., session setup related signaling). Such information exchanges may have an identity so as to allow the two NFs to associate the information exchanged at different times. An example of such identity is the SIP Call Id used in the SIP messages between the two NFs. Alternatively, it may also be the charging ID which may be used among NFs that are present on the signaling path. As described herein, that identity may be referred to as transaction ID or Trans-Id. In certain example embodiments, the Trans-Id may have nothing to do with the LI. [0076] In certain example embodiments, the Correlation Message sent by the LI functions to the MDF may carry the transaction ID that the home NF uses in the non-LI related information exchange with the other NF. In doing so, if information exchanged between the two NFs that handle the target’s communication session use a Trans-Id-1 as the transaction ID, then the Correlation Messages by the respective LI functions present in those two NFs may also carry the Trans-Id-1. In addition, the MDF that receives the two Correlation Messages from the two LI functions can that way associate the respective Intercept Products. For example, the MDF may associate or link Intercept Product 1 and Intercept Product 2 with Trans-Id-1 of the communication between NF- 1 and NF-2.

[0077] FIG. 7 illustrates an example signal flow associating the Correlation Message from two different LI functions, according to certain example embodiments. As illustrated in FIG. 7, the NF-1 and NF-2 use the Trans-Id-1 in the signaling related information exchanged between the two in the handling of the target’s communication session. In certain example embodiments, Trans-Id-1 may be used independent of whether the target’s communication needs interception. In other example embodiments, the Correlation Message generated by the LI function present in a NFs may also carry the Trans-Id -1. Thus, the Correlation Message sent by the LI function present in NF-1 may carry the Cor-Id-1 and Trans-Id-1. In addition, the Correlation Message sent by the LI function present in NF-2 may carry the Cor-Id-2 and Trans-Id-1. Furthermore, the MDF that receives the two Correlation Message may be able to associate the Intercept Products received from the LI functions present in two different NFs.

[0078] FIG. 8 illustrates an example signal flow where correlation information in the LI Product is sent to the LEMF, according to certain example embodiments. According to certain example embodiments, the MDF may use one of the two (Cor-Id-1 or Cor-Id-2) or a different Id. In some example embodiments, the MDF may be able to associate the Intercept Products received from the LI functions present in different NFs. In FIG. 8, the MDF may use a Cor-Id-x (to show that it does not have to be one of the Cor-Id-1 or Cor-Id-2) in the LI Product. In this example embodiment, both LI functions may send the Intercept Products to the MDF to which they send the Correlation Messages. As illustrated in FIG. 8, the MDF may also choose one of the Cor-Id-1 and Cor-Id-2 as the correlation information in the LI Products. Alternatively, in other example embodiments, the MDF may use both Cor-Id- 1 and Cor-Id-2 in the LI Products sent to the LEMF, and in that case, it may send a Correlation Message to the LEMF as illustrated in Approach #2 in FIG. 8.

[0079] Multiple NFs having the LI functions

[0080] FIG. 9 illustrates an example signal flow where the Correlation Message is used with LI functions in multiple NFs, according to certain example embodiments. In certain example embodiments, multiple NFs may have the LI functions. For example, a target’s communication session may involve LI functions in more than two NFs. In this situation, the flow shown in FIG. 9 may expand to cover additional LI functions, such as three LI functions in three different NFs.

[0081] In particular, FIG. 9 illustrates a flow with three LI functions in three different NFs. In addition, FIG. 9 illustrates the possibility of an LI function sending two Correlation Messages to the MDF. As illustrated in FIG. 9, all the LI functions send the Intercept Products to the MDF to which they send the Correlation Message. FIG. 9 also illustrates that the NF-2 may have a relationship (in establishing the target’s communication) with NF-1 and NF- 3. In addition, according to certain example embodiments, the NF-2 may use the Trans-Id-21 in the information that it exchanges with NF-1 and the Trans- Id-32 in the information that it exchanges with NF-3. [0082] In certain example embodiments, the LI function in NF-2 as shown in the flow of FIG. 9, may use two Correlation Messages showing that Cor-Id-2 is for the Trans-Id-21 and Trans-32. In addition, the MDF in this case may assume that Cor-Id-1 (used by the LI functions in NF-1) and Cor-Id-2 (used by the LI functions in NF-2) are associated with the same session due to the presence of Trans-Id-21 in the Correlation Messages that it receives from the LI functions in NF-1 and NF-2. Furthermore, the MDF may assume that Cor- Id-2 (used by the LI function in NF-2) and Cor-Id-3 (used by the LI function in NF-3) are associated with the same session due to the presence of Trans- Id-31 in the Correlation Messages received from LI functions in NF-2 and NF-3. In other words, according to certain example embodiments, the MDF may determine that the Cor-Id-1, Cor-Id-2, and Cor-Id-3 are all related to same session of target’s communication. Accordingly, the MDF may use the Cor-Id -x for the LI Products derived from the Intercept Products received from the LI functions present in all three NFs, or use all three. The latter case may be the same as the Approach #2 shown in FIG. 6 and, thus, the MDF may send a Correlation Message to the LEMF correlating Cor-Id-1, Cor-Id-2 and Cor-Id-3.

[0083] LI functions not in adjacent NFs

[0084] As previously noted herein, according to certain example embodiments, a target’s communication session may involve multiple NFs while the NFs that have the LI functions may not be adjacent to each other. To support such scenarios, certain example embodiments may use an identifier available at the two non-adjacent NF s which can identify the session uniquely. Alternatively, other example embodiments may introduce the pseudo LI functions in-between NFs that change the transaction IDs.

[0085] According to certain example embodiments, when using the identifier available at the two non-adjacent NFs, it can be viewed as an extension of the procedure described above with regard to associating the Correlation Message from two different LI functions. This may be possible since the LI functions are able to use the same transaction ID in the Correlation Messages that they send to the MDF.

[0086] In certain example embodiments, in the method of introducing the pseudo LI functions to in-between NFs, the NFs that do not have the LI functions but reside (on the signaling path) in-between those NFs that have the LI functions, may have a pseudo LI function to send the Correlation Message. According to some example embodiments, this may be done in the event the LI functions observe a change in the transaction ID on the two sides of the session that it handles. Those NFs may have the LI functions and, thus, the interface to the MDF to support the LI for other scenarios (e.g., a different session scenario).

[0087] FIG. 10 illustrates an example signal flow of a Correlation Message being used with LI functions in multiple NFs, according to certain example embodiments. As illustrated in FIG. 10, the NF-2 may have a relationship (in establishing the target’s communication) with NF-1 and NF-3. Further, NF-2 may use the Trans-Id-21 in the information that it exchanges with NF-1, and the Trans-Id-32 in the information that it exchanges with NF-3. In this example, the NF-2 does not normally provide any LI functions for the session scenario. In certain example embodiments, the pseudo LI function in NF-2 as shown in FIG. 10, may use two Correlation Messages showing that Cor-Id-2 is for the Trans-Id-21 and Trans-Id-32. In some example embodiments, the MDF, in this case, may assume that Cor-Id-1 (used by the LI functions in NF- 1) and Cor-Id-2 are associated with the same session due to the presence of Trans-Id-21 in the Correlation Messages that it receives from the LI functions in NF-1 and NF-2. Furthermore, the MDF may assume that Cor-Id-2 and Corid- 3 (used by the LI function in NF-3) are associated with the same session due to the presence of Trans-Id-32 in the Correlation Messages received from LI functions in NF-2 and NF-3. That is, the MDF may be able determine that Cor-Id-1, Cor-Id-2, and Cor-Id-3 are all related to the same session of the target’s communication.

[0088] According to certain example embodiments, since NF-2 may not have a role in providing the LI functions (for the session scenario) other than sending the Correlation Message, the LI function in the NF-2 may not send any Intercept Products to the MDF. To allow the MDF to distinguish this case, the pseudo LI function in NF-2 may include the scope of “None” as the Intercept Product Scope in the Correlation Message. This can ensure that the MDF uses the correlation information received in the Correlation Message for later correlation purpose.

[0089] In certain example embodiments, the MDF may still use the Cor-Id-x for the LI Products derived from the Intercept Products received from the LI functions present in NF-1 and NF-3, or use the two Cor Ids. The latter case may be the same as the Approach #2 shown in FIG. 6 and, thus, in that case, the MDF may send a Correlation Message to the LEMF correlating Cor-Id-1, Cor-Id-2, and Cor-Id-3. In addition, the scope of Intercept Product associated with the Cor-Id-2 is “None”, the MDF can skip the inclusion of Cor-Id-2 in the above Correlation Message that it sends to the LEMF.

[0090] Multiple MDFs

[0091] Certain example embodiments may include multiple MDFs. For example, an LI system in a CSP’s network may have multiple MDFs deployed to deliver the LI Product based on the scope of Intercept Product. For instance, in certain example embodiments, MDF2 may be used to deliver the IRI messages, whereas the MDF3 may be is used to deliver the CC. According to certain example embodiments, when an MDF receives a Correlation Message from an LI function present in a NF, depending on the Intercept Product Scope to which the correlation information applies, the MDF may receive the Intercept Products carrying the particular correlation information. In such scenarios, the Intercept Products from that LI function may be delivered to the LEMF via a different MDF.

[0092] According to certain example embodiments, to support the MDF handling of the Correction Message received from a LI function, the Internet Product Scope may include scopes of IRI, CC, or nothing. Further, the Internet Produce Scope may include Intercept Product expected as “yes” or “no.” In certain example embodiments, the field Intercept Product Expected may indicate to the MDF whether it is expected to receive the Intercept Products from that LI function with the indicated scope with the provided correlation information. When the Intercept Product is expected, then the MDF can use one of the two approaches shown in FIG. 6 to use the correlation information delivered to the LEMF in the LI Products. However, when the Intercept Product from that LI is not expected, the MDF does not send the related LI Products to the LEMF. In this case, the MDF may send a Correlation Message to the LEMF with all the related correlation information. The LEMF then, can associate the LI Products received from multiple MDFs as related to the target’s intercepted communication session.

[0093] FIG. 11 illustrates an example signal flow with multiple MDFs in one case, according to certain example embodiments. As illustrated in FIG. 11, the LI function in NF-1 sends a Correlation Message to the MDF#1 with Scope X for the Intercept Product, and it intends to send the Intercept Product to MDF#1. In this example, the MDF#1 may adopt Approach #1 of FIG. 6. Accordingly, it may use the same correlation information (Cor-Id-x) in all the LI Products derived from the Intercept Products with Scope X. In addition, the LI function in NF-2 may send a Correlation Message to MDF#1 with the Scope Y for the Intercept Product, and does not intend to send the Intercept Product to the MDF#1. This may trigger MDF#1 to send a Correlation Message to the LEMF linking Cor_Id-x and Cor-Id-2. [0094] As illustrated in FIG. 11, MDF#2 may not receive any Correlation Message and, thus, there is no question of it sending any Correlation Messages. Further, the LI Products delivered by MDF#1 may have the Cor- Id-x, and the LI Product delivered by the MDF#2 may have the Cor-Id-2. Accordingly, the LEMF may know that Cor-Id-x and Cor-Id-2 are for the same session of target’s communication based on the Correlation Message it received from the MDF#1.

[0095] In certain example embodiments, it may be assumed that when the scope of Intercept Product changes, the likelihood of that LI function sending the Intercept Product to a different MDF is high (based on the known usecases). However, if the LI function sends the Intercept Product to the same MDF, then the MDF may decide to skip sending of the Correlation Message to the LEMF even if the scope of the Intercept Product is changed.

[0096] FIG. 12 illustrates a signal flow with multiple MDF in another case, according to certain example embodiments. As illustrated in FIG. 12, the LI Function in an NF may provide Intercept Products with the two scopes; one going to the MDF to which it has sent the Correlation Message, and the other not. In this situation, that LI function may be expected to send two Correlation Messages. Fig. 12 also illustrates that the LI function in NF-1 may send a Correlation Message to the MDF#1 with Scope X for the Intercept Product, and may intend to send the Intercept Product to MDF#1. In this example, the MDF#1 may adopt Approach #1 of FIG. 6. Accordingly, MDF#1 may use the same correlation information (Cor-Id-x) in all the LI Products derived from the Intercept Products with Scope X.

[0097] As further illustrated in FIG. 12, the LI function in NF-2 may send a Correlation Message to MDF#1 with the Scope X for the Intercept Product and it intends to send the Intercept Product to the MDF#1. In addition, the MDF#1 may use the same Cor-Id-x for the related LI Products. As further illustrated in FIG. 12, the LI function in NF-2 may send another Correlation Message to MDF#1 with the Scope Y for the Intercept Product, and does not intend to send the Intercept Product to the MDF#1. This triggers the MDF#1 to send a Correlation Message to the LEMF linking Cor_Id-x and Cor-Id-2. Additionally, in certain example embodiments, the MDF#2 may not receive any Correlation Messages and, thus, there is no question of it sending any Correlation Messages. In other example embodiments, the LI Products delivered by MDF#1 may have the Cor-Id-x, and the LI Product delivered by the MDF#2 may have the Cor-Id-2. Accordingly, the LEMF may know that Cor-Id-x and Cor-Id-2 are for the same session of target’s communication based on the Correlation Message it received from the MDF#1.

[0098] FIG. 13 illustrates a signal flow with multiple MDFs in another case, according to certain example embodiments. As illustrated in FIG. 3, the LI function resides in a different NF that sends the Intercept Products to MDF#2 with scope Y. In addition, the LI function in NF-1 may send a Correlation Message to the MDF#1 with Scope X for the Intercept Product, and it intends to send the Intercept Product to MDF#1. In this example, MDF#1 may adopt Approach #1 of FIG. 6. Accordingly, it may use the same correlation information (Cor-Id-x) in all the LI Products derived from the Intercept Products with Scope X.

[0099] As illustrated in FIG. 13, the LI function in NF-2 may send a Correlation Message to MDF#1 with the Scope Y for the Intercept Product, and does not intend to send the Intercept Product to the MDF#1. This triggers the MDF#1 to send a Correlation Message to the LEMF linking Cor_Id-x and Cor-Id-2. In addition, in FIG. 13, MDF#2 may not receive Correlation Messages, and, thus, there is no question of it sending any Correlation Messages. Further, as illustrated in FIG. 13, the LI Products delivered by MDF#1 may have the Cor-Id-x, and the LI Product delivered by the MDF#2 may have the Cor-Id-2. Accordingly, the LEMF knows that Cor-Id-x and Cor- Id-2 are for the same session of the target’s communication based on the Correlation Message it received from the MDF#1.

[0100] According to certain example embodiments, it may be possible to provide a method to allow the MDFs to correlate the Intercept Products received from LI functions present in different NFs. In certain example embodiments, the LI functions may not be required to be present in those different NFs to have any new LI specific interface for the purpose of negotiating the correlation information. Certain example embodiments may also introduce a new message referred to as Correlation Message sent from the LI function present in a NF to the MDF. This Correlation Message may carry the correlation information the LI function uses in the Intercept Products that it will deliver to the same MDF or to a different MDF, the scope of the Intercept Product that it delivers, and transaction Identifier that would identity a target’s particular communication session. In addition, the Correlation Message may indicate whether the LI function is intended to send the Intercept Product of the indicated scope to the MDF to which it sends the Correlation Message.

[0101] According to certain example embodiments, the MDF that receives the correlation information from LI functions present in the different NFs may be able to correlate the Intercept Products received from those LI functions, based on the same transaction identifier present in the Correlation Messages received from the LI functions present in the NFs. In addition, the MDF may choose a different correlation information for the LI Products that it sends toward the LEMF, use one of the many correlation information that it receives from the different LI functions, or may use the correlation information as received in the respective Intercept Products. In the last case, the MDF may send a Correlation Message to the LEMF to indicate that the multiple correlation information that the LEMF would receive are related to the same session of a target’s communication. If any of the LI functions have indicated of not sending the Intercept Product to the MDF to which they have sent the Correlation Message, then the MDF may also send a Correlation Message to the LEMF.

[0102] In certain example embodiments, when an MDF receives a Correlation Message with the Intercept Product scope indicating “None”, the MDF may use the information to conclude that the particular LI function does not generate any Intercept Products to any of the MDFs. In this situation, the MDF may use the correlation information received from that LI function to associate the correlation information received from other LI functions. Further, the MDF that does not receive a Correlation Message may not send a Correlation Message to the LEMF.

[0103] Examples of IMS LI Scenarios

[0104] A. Application to an IMS session - originating session

[0105] FIG. 14 illustrates an LI scenario of Party A (target) originating an IMS session with Party B, according to certain example embodiments. In this example, the calling party (shown as Party A) is the target. As illustrated in FIG. 14, the S-CSCF may provide the IRI-POI functions, the Ingress P-CSCF may provide the CC-TF functions, and the IMS-AGW may provide the CC- POI functions. In FIG. 14, the session-leg between the P-CSCF and S-CSCF may have the Call-Id- 1 as the SIP Call Id. In addition, the CC-TF in P-CSCF may use the Cor-Id-1 and may send the same to the CC-POI in IMS-AGW. Further, the IMS-AGW may use Cor-Id-1 in the xCC sent over LI X3 to the MDF3, and the MDF3 may use the Cor-Id-1 in the CC sent over LI HI3 to the LEMF.

[0106] FIG. 14 also illustrates that the IRI-POI in S-CSCF may use the Cor- Id-2. Further, IRI-POI in the S-CSCF may send the Cor-Id-2 in the xIRI sent over LI X2 to the MDF2, and MDF2 may use the Cor-Id-2 in the IRI messages sent over LI HI2 to the LEMF. According to certain example embodiments, the Correlation Message sent from the CC-TF in the P-CSCF to the MDF2 over LI X2 may include information such as, for example, correlation information of Cor-Id-1, Intercept Product scope of CC, transaction ID of Call-Id- 1, and Intercept Product sent to the MDF2 of “NO.” In certain example embodiments, the LI function in a P-CSCF may already have the LI X2 interface to the MDF2 to facilitate the other scenarios.

[0107] According to certain example embodiments, the MDF2 may send a Correlation Message to the LEMF. However, since the MDF2 has not received another Correlation Message, it will not send any Correlation Message, at this time. In certain example embodiments, the Correlation Message sent from the IRI-POI in the S-CSCF to the MDF2 over LI-X2 may include correlation information of Cor-Id-2, Intercept Product scope of IRI, transaction ID of Call-Id-1, and Intercept Product sent to the MDF of “YES.” According to certain example embodiments, the MDF2 may use the Cor-Id-2 in the IRI messages sent to the LEMF. Furthermore, at this time, the MDF2 may send a Correlation Message to the LEMF with the Linked correlation information, which may include Cor-Id-1 for CC and Cor-Id-2 for IRI.

[0108] In certain example embodiments, the LEMF may be able to correlate the IRI messages received over LI HI2 (with Cor-Id-2) and CC received over LI HI3 (with Cor-Id-1). In addition, the Correlation Message may include other intercept related data that allows the MDF2 and LEMF to associate the same with the intercepted communication session.

[0109] B. Application to an IMS session - Terminating session

[0110] FIG. 15 illustrates an LI scenario of Party B (target) receiving an IMS session from Party A, according to certain example embodiments. In this example, the called party (shown as Party B) is the target. As illustrated in FIG. 15, the S-CSCF may provide the IRI-POI functions, the Egress P-CSCF may provide the CC-TF functions, and the IMS-AGW may provide the CC- POI functions. Further, as illustrated in FIG. 15, the session-leg between the S-CSCF and P-CSCF may have the Call-Id-2 as the SIP Call Id, and the IRI- POI in S-CSCF may use the Cor-Id-1. In addition, IRI-POI in the S-CSCF may send the Cor-Id-1 in the xIRI sent over LI X2 to the MDF2, and the MDF2 may use the Cor-Id-1 in the IRI messages sent over LI HI2 to the LEMF. As further illustrated in FIG. 15, the CC-TF in P-CSCF may use the Cor-Id-2, and may send the same to the CC-POI in IMS-AGW. Further, the IMS-AGW may use Cor-Id-2 in the xCC sent over LI X3 to the MDF3, and the MDF3 may use the Cor-Id-2 in the CC sent over LI HI3 to the LEMF. [0111] According to certain example embodiments, the Correlation Message sent from the IRI-POI in the S-CSCF may have transaction correlation information of Cor-Id-1, Intercept Product scope of IRI, Transaction ID of Call-Id-2, and Intercept Product sent to the MDF of “YES.” In certain example embodiments, MDF2 may use the Cor-Id-1 in the IRI messages sent to the LEMF. Further, the Correlation Message sent from the CC-TF in the P- CSCF to the MDF2 over LI-X2 may include correlation information of Cor- Id-2, Intercept Product scope of CC, transaction ID of Call-Id-2, and Intercept Product sent to the MDF of “NO.” In some example embodiments, the LI function in the P-CSCF may already have the LI-X2 interface to the MDF2 to facilitate other scenarios. According to certain example embodiments, the MDF2 may send a Correlation Message to the LEMF with linked correlation information, which may include Cor-Id-1 for IRI and Cor-Id-2 for CC.

[0112] In certain example embodiments, the LEMF may be able to correlate the IRI messages received over LI HI2 (with Cor-Id-1) and CC received over LI HI3 (with Cor-Id-2). Further, in other example embodiments, the Correlation Message may include other intercept related data that allows the MDF2 and LEMF to associate the same with the intercepted communication session.

[0113] C. Application to an IMS session - Redirected session

[0114] FIG. 16 illustrates an LI scenario of an incoming call to Party B (target) that is redirected to Party C, according to certain example embodiments. In this example, the called party (shown as Party B) is the target, and Party C is the redirected-to party. The S-CSCF that serves Party B may provide the IRI- POI functions, the Egress P-CSCF that serves the Party C may provide the CC-TF functions, and the IMS-AGW interacting with the Party C may provide the CC-POI functions. Further, the P-CSCF and IMS-AGW associated with the Party B are not involved in the session handling.

[0115] As illustrated in FIG. 16, the session-leg between the S-CSCF (of Party

B) and S-CSCF (Party C) may have the Call-Id-3 as the SIP Call Id. In addition, the session leg between the S-CSCF (Party C) and P-CSCF (Party

C) may have the Call-Id-4 as the SIP Call Id. Further, the IRI-POI in S-CSCF (Party B) may use the Cor-Id-1, and IRI-POI in the S-CSCF sends the Cor-Id- 1 in the xIRI sent over LI X2 to the MDF2. In addition, the MDF2 may use the Cor-Id-1 in the IRI messages sent over LI HI2 to the LEMF. As further illustrated in FIG. 16, the CC-TF in P-CSCF may use the Cor-Id-3 and may send the same to the CC-POI in IMS-AGW. In addition, the IMS-AGW may use Cor-Id-3 in the xCC sent over LI X3 to the MDF3, and the MDF3 may use the Cor-Id-3 in the CC sent over LI HI3 to the LEMF.

[0116] According to certain example embodiments, S-CSCF (Party C) may also provide some pseudo LI functions to facilitate the correlation information. As such, LI functions present in S-CSCF (Party C) does not send any LI related messages to the MDF2 other than the Correlation Message. In some example embodiments, the LI function in the S-CSCF may already have the LI X2 interface to the MDF2 to facilitate the interception of other targets. According to certain example embodiments, the Correlation Message sent from the IRI-POI in the S-CSCF (Party B) to MDF2 over LI X2 may include correlation information of Cor-Id-1, Intercept Product scope of IRI, transaction ID of Call-Id-3, and Intercept Product sent to the MDF of “YES.” In addition, the MDF2 may use the Cor-Id-1 in the IRI messages sent to the LEMF. [0117] In certain example embodiments, two Correlation Messages may be sent from the LI function in S-CSCF (Party C). For example, Correlation Message 1 may include correlation information Cor-Id-2, Intercept Product scope of “none,” transaction ID of Call-Id-3, and Intercept Product sent to the MDF of “NO.” Furthermore, Correlation Message 2 may include correlation information of Cor-Id-2, Intercept Product scope of “none,” transaction ID of Call-Id-4, and Intercept Product sent to the MDF of “NO.” Upon seeing that the Intercept Product scope as None, the MDF2 may take no action toward the LEMF, but remembers the Cor-Id-2.

[0118] In this example, the Correlation Message sent from the CC-TF in the P-CSCF may include correlation information of Cor-Id-3, Intercept Product scope of CC, transaction ID of Call-Id-4, and Intercept Product sent to the MDF of “NO.” In certain example embodiments, the LI function in the P- CSCF may have the LI X2 interface to the MDF2 to facilitate the other scenarios. In addition, in some example embodiments, the MDF2 may send a Correlation Message to the LEMF with Linked correlation information, which may include Cor-Id-1 for IRI and Cor-Id-3 for CC. According to certain example embodiments, the LEMF may be able to correlate the IRI messages received over LI HI2 (with Cor-Id-1) and CC received over LI HI3 (with Cor-Id-2. In addition, the Correlation Message may include other intercept related data that allows the MDF2 and LEMF to associate the same with the intercepted communication session.

[0119] D. Application to an IMS session - Conferencing

[0120] FIG. 17 illustrates an LI scenario of a conferencing call, according to certain example embodiments. In this example, the calling party (shown as Party A) is a target. Further, S-CSCF and the AS/MRFC on the A-side provide the IRI-POI functions. Even though the Ingress IMS-AGW may provide the CC-POI functions initially, this example assumes that the CC-POI functions are provided by the MRFP. In addition, for the CC-POI in MRFP, the AS/MRFP may provide the CC-TF functions.

[0121] As illustrated in FIG. 17, the session-leg between the P-CSCF and S- CSCF may have the Call-Id- 1 as the SIP Call Id. In addition, the forward path of the session leg between the S-CSCF and AS/MRFC may have Call-Id- 1 as the SIP Call Id. Furthermore, the return path of the session leg between the AS/MRFC and the S-CSCF may have the Call-Id-2 as the SIP Call Id. In addition, the IRI-POI in S-CSCF may use the Cor-Id-1, and IRI-POI in the S- CSCF sends the Cor-Id-1 in the xIRI sent over LI X2 to the MDF2. Further, the MDF2 may use the Cor-Id-1 in the IRI messages sent over LI HI2 to the LEMF.

[0122] In this example, the IRI-POI in the AS/MRFC may use the Cor-Id-2, and IRI-POI in the AS/MRFC may send the Cor-Id-2 in the xIRI sent over LI X2 to the MDF2. Without certain example embodiments of the invention described herein, the MDF2 may use the Cor-Id-2 in the IRI messages sent over LI HI2 to the LEMF. Additionally, in certain example embodiments, CC-TF in the AS/MRFC may use the Cor-Id-2 to the CC-POI present in the MRFP, and CC-POI in the MRFP may send the Cor-Id-2 in the xCC sent over LI_X3to the MDF3. Furthermore, MDF3 may use the Cor-Id-2 in the CC over LI HI3 to the LEMF.

[0123] According to certain example embodiments, the Correlation Message sent from the IRI-POI in the S-CSCF may include correlation information of Cor-Id-1, Intercept Product scope of IRI, transaction ID of Call-Id- 1, and Intercept Product sent to the MDF of “YES.” In addition, MDF2 may use the Cor-Id-1 in the IRI messages sent to the LEMF. According to other example embodiments, the Correlation Message sent from the IRI-POI in the AS/MRFC may include correlation information of Cor-Id-2, Intercept Product scope of IRI, transaction ID of Call-Id- 1, and Intercept Product sent to the MDF of “YES.” [0124] In certain example embodiments, the MDF2, since it has started sending the IRI messages to the LEMF using Cor-Id-1, it may use the same Cor-Id-1 in the IRI messages sent to LEMF for xIRI received from AS/MRFC with Cor-Id-2. Further, the Correlation Message sent from the CC-TF in the AS/MRFC may include correlation information of Cor-Id-2, Intercept Product scope of CC, transaction ID of Call-Id- 1, and Intercept Product sent to the MDF of “NO.” Furthermore, the MDF2 may send a Correlation Message with Linked correlation information, which may include Cor-Id- 1 for IRI and Cor- Id-2 for CC.

[0125] According to certain example embodiments, the LEMF may correlate the IRI messages received over LI HI2 (with Cor-Id-1) and CC received over LI HI3 (with Cor-Id-2). In addition, the Correlation Message may include other intercept related data that allows the MDF2 and LEMF to associate the same with the intercepted communication session.

\O126\ roblems with Alternate Methods in 3GPP

[0127] As previously described, the ASN.l encoding may allow the MDF2 to include multiple Correlation Ids in the IRI messages. With this approach, the need to send a Correlation Message from MDF to LEMF can be avoided. For example, instead of sending a Correlation Message with different Correlation Information, those different correlation information can be sent as a part of the IRI message. However, the trend in the 3GPP LI specifications is to use one Correlation Identifier value in an IRI message or the CC. Thus, extending the 3 GPP idea may not be feasible as it may not get an industry-wide acceptance.

[0128] Correlation Information Generated at Different LI Functions

[0129] The LI functions present at different NFs do not know the exact value used by the LI function residing at another NF as a part of the Correlation Information. Thus, to address this issue, each LI function of certain example embodiments may include additional information in the correlation information that would establish the required uniqueness. For example, the LI functions may use the SIP Call Id itself, has the Correlation Information, or add SIP Call Id, in part or in complete form, or add the NF-ID to the Correlation Information. According to certain example embodiments, when LI functions in different NFs send the Intercept Products for different intercepts, there is provided a way to establish the uniqueness. This disclosure assumes such schemes are implementation specific, and there are many ways such a uniqueness can be achieved.

[0130] LI Specific Triggering Interface Between CC-TF and IRI-POI

[0131] According to certain example embodiments, the IRI-POI and CC-TF may be located in different NFs, and a new LI specific interface may be introduced. In this example, the CC-TF and the IRI-POI may exchange the correlation information that use for the xCC and the xIRI are exchanged. In contrast to using the Correlation Message, a new LI specific interface may be provided between CC-TF and the IRI-POI. As described above, such an approach can result in many LI specific interfaces. However, in certain example embodiments, when the number of NFs that have such CC-TF and IRI-POI are limited, such an approach can be considered as an alternate.

[0132] E. Originating Session

[0133] FIG. 18 illustrates a signal flow of a Correlation Message sent from CC-TF to IRI-POI, according to certain example embodiments. As illustrated in FIG. 18, the Calling Party is the target. In addition, CC-TF in the P-CSCF (on the Calling Party side of the session leg) may send the Correlation Message with the correlation information (Cor-Id-1) to the IRI-POI in the S- CSCF (serving the Calling Party of the session). The CC-TF may also include the correlation information (Cor-Id-1) in the Intercept Trigger it sends to the IMS-AGW. Further, the IRI-POI and the CC-POI may use the Cor-Id-1 as the Correlation Information.

[0134] F. Terminating Session [0135] FIG. 19 illustrates a signal flow of a Correlation Message sent from IRI-POI to CC-TF, according to certain example embodiments. In this example, the Called Party is the target. As illustrated in FIG. 19, The IRI-POI in the S-CSCF (that serves the Called Party) may send the Correlation Message with the correlation information (Cor-Id-1) to the CC-TF in the P- CSCF (on the Called Party side of the session leg). In addition, the CC-TF may include the correlation information (Cor-Id-1) in the Intercept Trigger it sends to the IMS-AGW. Furthermore, the IRI-POI and the CC-POI may use the Cor-Id- 1 as the Correlation Information.

[0136] G. Redirecting Session

[0137] FIG. 20 illustrates a signal flow of a Correlation Message sent from IRI-POI to pseudo IRI-POI to CC-TF, according to certain example embodiments. In this example, the Called Party is the target, and the session is redirected to a Redirected-to Party. As illustrated in FIG. 20, the IRI-POI in the S-CSCF (serving the Called Party) may send the Correlation Message with the correlation information (Cor-Id-1) to the pseudo IRI-POI in the S- CSCF (serving the Redirected-to Party. Further, the pseudo IRI-POI in that S- CSCF may send the Correlation Message to the CC-TF in the P-CSCF that serves the Redirected-to Party. In addition, the CC-TF may include the correlation information (Cor-Id-1) in the Intercept Trigger it sends to the IMS- AGW, and the IRI-POI and the CC-POI may use the Cor-Id-1 as the Correlation Information.

[0138] FIG. 21 illustrates a flow diagram of a method, according to certain example embodiments. In certain example embodiments, the flow diagram of FIG. 21 may be performed by a network entity or network node in a 3 GPP system, such as LTE or 5G-NR. For instance, in certain example embodiments, the method of FIG. 21 may be performed by an MDF, for instance similar to apparatus 10 illustrated in FIG. 23(a). [0139] According to certain example embodiments, the method of FIG. 21 may include, at 100, establishing communications with a first network node providing lawful interception of a target communication session. The method may also include, at 105, receiving from the first network node, a first Correlation Message related to the target communication session. The method may further include, at 110, receiving a first Intercept Product from the first network node, the first Intercept Product including intercepted data of the target communication session. In addition, the method may include, at 115, associating the first Correlation Message received from the first network node to the target communication session.

[0140] According to certain example embodiments, the method may further include establishing communications with a second network node providing lawful interception of the target communication session. According to other example embodiments, the method may further include receiving from the second network node, a second Correlation Message related to the target communication session. In certain example embodiments, the method may also include receiving a second Intercept Product from the first network node, the second Intercept Product including additional intercepted data of the target communication session. Further, in certain example embodiments, the method may include associating the second Correlation Message received from the second network node to the target communication session.

[0141] According to further example embodiments, the first Correlation Message and the second Correlation Message may each include a respective correlation information, intercepted target’s session information, scope of an intercepted product, and additional information needed to associate the Correlation Message with a warrant. In certain example embodiments, the method may further include, based on the first Correlation Message and the second Correlation Message, sending the first Intercept Product and the second intercept product as a first lawful Intercept Product and a second lawful Intercept Product respectively to a law enforcement monitoring facility. In some example embodiments, the first lawful Intercept Product and the second lawful Intercept Product may be sent to the law enforcement monitoring facility with a same correlation information irrespective of the correlation information that is received from the first network node and the second network node. In other example embodiments, the first Intercept Product and the second Intercept Product may be sent to the law enforcement monitoring facility by using the correlation information in the first Intercept Product and the second Intercept Product, and the method may further include sending a separate Correlation Message to the law enforcement monitoring facility including correlation information contained in the first Intercept Product and correlation information contained in the second Intercept Product.

[0142] According to certain example embodiments, the first Correlation Message and the first Intercept Product may be received from a first lawful interception function, and the second Correlation Message and the second Intercept Product may be received from a second lawful interception function. According other example embodiments, the first lawful interception function may be in communication with the second lawful interception function, and the communication between the first lawful interception function and the second lawful interception function may include an identity. In certain example embodiments, the method may further include associating the first Intercept Product and the second Intercept Product with the communication between the first lawful interception function and the second lawful interception function based on the identity.

[0143] In some example embodiments, the method may further include establishing communications with a third network node providing lawful interception of the target communication session, and receiving from the third network node, a third Correlation Message related to the target communication session. In other example embodiments, the method may further include receiving a third Intercept Product from the first network node, the third Intercept Product including further intercepted data of the target communication session. According to certain example embodiments, the method may further include associating the third Correlation Message received from the third network node to the target communication session. According to further example embodiments, the first network node, the second network node, and the third network node are not adjacent to each other. In other example embodiments, the first Correlation Message and the second Correlation Message may be received over a lawful interception specific interface. Further, according to certain example embodiments, a separate correlation information may be applied to the entire target communication session independent of the first network node or the second network node.

[0144] FIG. 22 illustrates a flow diagram of another method, according to certain example embodiments. In an example embodiment, the method of FIG. 22 may be performed by a LEMF, for instance similar to apparatus 20 illustrated in FIG. 23(b).

[0145] According to certain example embodiments, the method may include, at 200, establishing communications with a mediation delivery function. The method may also include, at 205, receiving from the mediation delivery function, a first lawful Intercept Product related to a first lawful interception function of a first network node, and a second lawful Intercept Product related to a second lawful interception function of a second network node according to a first approach. Alternatively, the method may include, at 210, receiving from the mediation delivery function, the first lawful Intercept Product, the second lawful Intercept Product, and a Correlation Message according to a second approach. According to certain example embodiments, the first lawful Intercept Product may include first correlation information. According to other example embodiments, the second lawful Intercept Product may include second correlation information. In addition, in other example embodiments, receiving according to the first approach or the second approach may be based on whether the first correlation information and the second information is the same or different. In certain example embodiments, when the receiving is according to the second approach, the method may also include, at 215, associating the Correlation Message with the first lawful interception product and the second lawful interception product for a same target communication session

[0146] In certain example embodiments, first correlation information and the second correlation information are the same. In other example embodiments, the first correlation information and the second correlation information may be different. According to certain example embodiments, when the first correlation information and the second correlation information are different, the method may further include receiving a Correlation Message from the mediation delivery function. In certain example embodiments, the Correlation Message may include the first correlation information and the second correlation information, and a lawful interception scope. According to other example embodiments, the method may further include receiving a third lawful interception product related to a third lawful interception function of a third network node, and the third lawful interception product may include third correlation information.

[0147] FIG. 23(a) illustrates an apparatus 10 according to certain example embodiments. In certain example embodiments, apparatus 10 may be a node or element in a communications network or associated with such a network. For instance, in certain example embodiments, apparatus 10 may be a UE, mobile equipment (ME), mobile station, mobile device, stationary device, loT device, or other device. In other example embodiments, apparatus 10 may be an NF, MDF, or LI function. [0148] In some example embodiments, apparatus 10 may include one or more processors, one or more computer-readable storage medium (for example, memory, storage, or the like), one or more radio access components (for example, a modem, a transceiver, or the like), and/or a user interface. In some example embodiments, apparatus 10 may be configured to operate using one or more radio access technologies, such as GSM, LTE, LTE-A, NR, 5G, WLAN, WiFi, NB-IoT, Bluetooth, NFC, MulteFire, and/or any other radio access technologies. It should be noted that one of ordinary skill in the art would understand that apparatus 10 may include components or features not shown in FIG. 23(a).

[0149] As illustrated in the example of FIG. 23(a), apparatus 10 may include or be coupled to a processor 12 for processing information and executing instructions or operations. Processor 12 may be any type of general or specific purpose processor. In fact, processor 12 may include one or more of general- purpose computers, special purpose computers, microprocessors, digital signal processors (DSPs), field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), and processors based on a multi-core processor architecture, as examples. While a single processor 12 is shown in FIG. 23(a), multiple processors may be utilized according to other example embodiments. For example, it should be understood that, in certain example embodiments, apparatus 10 may include two or more processors that may form a multiprocessor system (e.g., in this case processor 12 may represent a multiprocessor) that may support multiprocessing. According to certain example embodiments, the multiprocessor system may be tightly coupled or loosely coupled (e.g., to form a computer cluster).

[0150] Processor 12 may perform functions associated with the operation of apparatus 10 including, as some examples, precoding of antenna gain/phase parameters, encoding and decoding of individual bits forming a communication message, formatting of information, and overall control of the apparatus 10, including processes illustrated in FIGs. 1-21.

[0151] Apparatus 10 may further include or be coupled to a memory 14 (internal or external), which may be coupled to processor 12, for storing information and instructions that may be executed by processor 12. Memory 14 may be one or more memories and of any type suitable to the local application environment, and may be implemented using any suitable volatile or nonvolatile data storage technology such as a semiconductor-based memory device, a magnetic memory device and system, an optical memory device and system, fixed memory, and/or removable memory. For example, memory 14 can be comprised of any combination of random access memory (RAM), read only memory (ROM), static storage such as a magnetic or optical disk, hard disk drive (HDD), or any other type of non-transitory machine or computer readable media. The instructions stored in memory 14 may include program instructions or computer program code that, when executed by processor 12, enable the apparatus 10 to perform tasks as described herein.

[0152] In certain example embodiments, apparatus 10 may further include or be coupled to (internal or external) a drive or port that is configured to accept and read an external computer readable storage medium, such as an optical disc, USB drive, flash drive, or any other storage medium. For example, the external computer readable storage medium may store a computer program or software for execution by processor 12 and/or apparatus 10 to perform any of the methods illustrated in FIGs. 1-21.

[0153] In some example embodiments, apparatus 10 may also include or be coupled to one or more antennas 15 for receiving a downlink signal and for transmitting via an uplink from apparatus 10. Apparatus 10 may further include a transceiver 18 configured to transmit and receive information. The transceiver 18 may also include a radio interface (e.g., a modem) coupled to the antenna 15. The radio interface may correspond to a plurality of radio access technologies including one or more of GSM, LTE, LTE-A, 5G, NR, WLAN, NB-IoT, Bluetooth, BT-LE, NFC, RFID, UWB, and the like. The radio interface may include other components, such as filters, converters (for example, digital-to-analog converters and the like), symbol demappers, signal shaping components, an Inverse Fast Fourier Transform (IFFT) module, and the like, to process symbols, such as OFDMA symbols, carried by a downlink or an uplink.

[0154] For instance, transceiver 18 may be configured to modulate information on to a carrier waveform for transmission by the anteima(s) 15 and demodulate information received via the anteima(s) 15 for further processing by other elements of apparatus 10. In other example embodiments, transceiver 18 may be capable of transmitting and receiving signals or data directly. Additionally or alternatively, in some example embodiments, apparatus 10 may include an input and/or output device (I/O device). In certain example embodiments, apparatus 10 may further include a user interface, such as a graphical user interface or touchscreen.

[0155] In certain example embodiments, memory 14 stores software modules that provide functionality when executed by processor 12. The modules may include, for example, an operating system that provides operating system functionality for apparatus 10. The memory may also store one or more functional modules, such as an application or program, to provide additional functionality for apparatus 10. The components of apparatus 10 may be implemented in hardware, or as any suitable combination of hardware and software. According to certain example embodiments, apparatus 10 may optionally be configured to communicate with apparatus 20 via a wireless or wired communications link 70 according to any radio access technology, such as NR.

[0156] According to certain example embodiments, processor 12 and memory 14 may be included in or may form a part of processing circuitry or control circuitry. In addition, in some example embodiments, transceiver 18 may be included in or may form a part of transceiving circuitry.

[0157] As discussed above, according to certain example embodiments, apparatus 10 may be a UE for example. According to certain embodiments, apparatus 10 may be controlled by memory 14 and processor 12 to establish communications with a first network node providing lawful interception of a target communication session. Apparatus 10 may also be controlled by memory 14 and processor 12 to receive from the first network node, a first Correlation Message related to the target communication session. Apparatus 10 may further be controlled by memory 14 and processor 12 to receive a first Intercept Product from the first network node, the first Intercept Product including intercepted data of the target communication session. In addition, apparatus 10 may be controlled by memory 14 and processor 12 to associate the first Correlation Message received from the first network node to the target communication session.

[0158] FIG. 23(b) illustrates an apparatus 20 according to certain example embodiments. In certain example embodiments, the apparatus 20 may be a network element, node, host, or server in a communication network or serving such a network. For example, apparatus 20 may be a network element including, for example, a base station, a Node B, an evolved Node B (eNB), 5G Node B or access point, next generation Node B (NG-NB or gNB), and/or WLAN access point, associated with a radio access network (RAN), such as an LTE network, 5G or NR. Alternatively, in other example embodiments, apparatus 20 may be elements of an LEMF, or elements associated with an IMS communication session. It should be noted that one of ordinary skill in the art would understand that apparatus 20 may include components or features not shown in FIG. 23(b).

[0159] As illustrated in the example of FIG. 23(b), apparatus 20 may include a processor 22 for processing information and executing instructions or operations. Processor 22 may be any type of general or specific purpose processor. For example, processor 22 may include one or more of general- purpose computers, special purpose computers, microprocessors, digital signal processors (DSPs), field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), and processors based on a multi-core processor architecture, as examples. While a single processor 22 is shown in FIG. 23(b), multiple processors may be utilized according to other example embodiments. For example, it should be understood that, in certain example embodiments, apparatus 20 may include two or more processors that may form a multiprocessor system (e.g., in this case processor 22 may represent a multiprocessor) that may support multiprocessing. In certain example embodiments, the multiprocessor system may be tightly coupled or loosely coupled (e.g., to form a computer cluster).

[0160] According to certain example embodiments, processor 22 may perform functions associated with the operation of apparatus 20, which may include, for example, precoding of antenna gain/phase parameters, encoding and decoding of individual bits forming a communication message, formatting of information, and overall control of the apparatus 20, including processes illustrated in FIGs. 1-20 and 22.

[0161] Apparatus 20 may further include or be coupled to a memory 24 (internal or external), which may be coupled to processor 22, for storing information and instructions that may be executed by processor 22. Memory 24 may be one or more memories and of any type suitable to the local application environment, and may be implemented using any suitable volatile or nonvolatile data storage technology such as a semiconductor-based memory device, a magnetic memory device and system, an optical memory device and system, fixed memory, and/or removable memory. For example, memory 24 can be comprised of any combination of random access memory (RAM), read only memory (ROM), static storage such as a magnetic or optical disk, hard disk drive (HDD), or any other type of non-transitory machine or computer readable media. The instructions stored in memory 24 may include program instructions or computer program code that, when executed by processor 22, enable the apparatus 20 to perform tasks as described herein.

[0162] In certain example embodiments, apparatus 20 may further include or be coupled to (internal or external) a drive or port that is configured to accept and read an external computer readable storage medium, such as an optical disc, USB drive, flash drive, or any other storage medium. For example, the external computer readable storage medium may store a computer program or software for execution by processor 22 and/or apparatus 20 to perform the methods illustrated in FIGs. 1-20 and 22.

[0163] In certain example embodiments, apparatus 20 may also include or be coupled to one or more antennas 25 for transmitting and receiving signals and/or data to and from apparatus 20. Apparatus 20 may further include or be coupled to a transceiver 28 configured to transmit and receive information. The transceiver 28 may include, for example, a plurality of radio interfaces that may be coupled to the antenna(s) 25. The radio interfaces may correspond to a plurality of radio access technologies including one or more of GSM, NB- loT, LTE, 5G, WLAN, Bluetooth, BT-LE, NFC, radio frequency identifier (RFID), ultrawideband (UWB), MulteFire, and the like. The radio interface may include components, such as filters, converters (for example, digital-to- analog converters and the like), mappers, a Fast Fourier Transform (FFT) module, and the like, to generate symbols for a transmission via one or more downlinks and to receive symbols (for example, via an uplink).

[0164] As such, transceiver 28 may be configured to modulate information on to a carrier waveform for transmission by the anteima(s) 25 and demodulate information received via the anteima(s) 25 for further processing by other elements of apparatus 20. In other example embodiments, transceiver 18 may be capable of transmitting and receiving signals or data directly. Additionally or alternatively, in some example embodiments, apparatus 20 may include an input and/or output device (I/O device).

[0165] In certain example embodiments, memory 24 may store software modules that provide functionality when executed by processor 22. The modules may include, for example, an operating system that provides operating system functionality for apparatus 20. The memory may also store one or more functional modules, such as an application or program, to provide additional functionality for apparatus 20. The components of apparatus 20 may be implemented in hardware, or as any suitable combination of hardware and software.

[0166] According to some example embodiments, processor 22 and memory 24 may be included in or may form a part of processing circuitry or control circuitry. In addition, in some example embodiments, transceiver 28 may be included in or may form a part of transceiving circuitry.

[0167] As used herein, the term “circuitry” may refer to hardware-only circuitry implementations (e.g., analog and/or digital circuitry), combinations of hardware circuits and software, combinations of analog and/or digital hardware circuits with software/firmware, any portions of hardware processor(s) with software (including digital signal processors) that work together to cause an apparatus (e.g., apparatus 10 and 20) to perform various functions, and/or hardware circuit(s) and/or processor(s), or portions thereof, that use software for operation but where the software may not be present when it is not needed for operation. As a further example, as used herein, the term “circuitry” may also cover an implementation of merely a hardware circuit or processor (or multiple processors), or portion of a hardware circuit or processor, and its accompanying software and/or firmware. The term circuitry may also cover, for example, a baseband integrated circuit in a server, cellular network node or device, or other computing or network device. [0168] As introduced above, in certain example embodiments, apparatus 20 may be a network element, node, host, or server in a communication network or serving such a network. For example, apparatus 20 may be a AMF, SMF, satellite, base station, a Node B, an evolved Node B (eNB), 5G Node B or access point, next generation Node B (NG-NB or gNB), and/or WLAN access point, associated with a radio access network (RAN), such as an LTE network, 5G or NR. According to certain example embodiments, apparatus 20 may be controlled by memory 24 and processor 22 to perform the functions associated with any of the embodiments described herein.

[0169] For instance, in certain example embodiments, apparatus 20 may be controlled by memory 24 and processor 22 to establish communications with a mediation delivery function. Apparatus 20 may also be controlled by memory 24 and processor 22 to receive from the mediation delivery function, a first lawful Intercept Product related to a first lawful interception function of a first network node, and a second lawful Intercept Product related to a second lawful interception function of a second network fun node according to a first approach. Alternatively, Apparatus 20 may be controlled by memory 24 and processor 20 to receive from the mediation delivery function, the first lawful Intercept Product, the second lawful Intercept Product, and a Correlation Message according to a second approach. According to certain example embodiments, the first lawful Intercept Product may include first correlation information. According to other example embodiments, the second lawful Intercept Product may include second correlation information. Further, in certain example embodiments, receiving according to the first approach or the second approach may be based on whether the first correlation information and the second information is the same or different. In certain example embodiments, when the receiving is according to the second approach, apparatus 20 may also be controlled by memory 24 and processor 20 to associate the Correlation Message with the first lawful interception product and the second lawful interception product for a same target communication session.

[0170] Further example embodiments may provide means for performing any of the functions, steps, or procedures described herein. For example one example embodiment may be directed to an apparatus that includes means for establishing communications with a first network node providing lawful interception of a target communication session. The apparatus may also include means for receiving from the first network node, a first Correlation Message related to the target communication session. The apparatus may further include means for receiving a first Intercept Product from the first network node, the first Intercept Product comprising intercepted data of the target communication session. In addition, the apparatus may include means for associating the first Correlation Message received from the first network node to the target communication session.

[0171] Other example embodiments may be directed to an apparatus that includes means for establishing communications with a mediation delivery function. The apparatus may also include means for receiving from the mediation delivery function, a first lawful Intercept Product related to a first lawful interception function of a first network funct node ion, and a second lawful Intercept Product related to a second lawful interception function of a second network node according to a first approach. Alternatively, the apparatus may include means for receiving from the mediation delivery function the first lawful Intercept Product, the second lawful Intercept Product, and a Correlation Message according to a second approach. According to certain example embodiments, the first lawful Intercept Product may include first correlation information. According to other example embodiments, the second lawful Intercept Product may include second correlation information. Further, in certain example embodiments, receiving according to the first approach or the second approach may be based on whether the first correlation information and the second information is the same or different. In certain example embodiments, when the receiving is according to the second approach, the apparatus may also include means for associating the Correlation Message with the first lawful interception product and the second lawful interception product for a same target communication session.

[0172] Certain example embodiments described herein provide several technical improvements, enhancements, and /or advantages. In some example embodiments, it may be possible to provide methods that do not depend on (or require to have) additional LI specific dedicated interfaces. It may also be possible to introduce a Correlation Message from the LI function in an NF to the MDF, and from the MDF to the LEMF. In doing so, the Correlation Message may carry correlation Information that is intended to be used by that LI function in the Intercept Product for a target’s communication session so that MDF can associate the correlation information received from two LI functions present in two different NFs. As such, certain example embodiments provide a means for handling correlation information when LI functions reside in multiple NFs in a more general way. It may also be possible to provide a method that allows the MDFs to correlate the Intercept Products received from Li functions of different NFs.

[0173] A computer program product may include one or more computerexecutable components which, when the program is run, are configured to carry out some example embodiments. The one or more computer-executable components may be at least one software code or portions of it. Modifications and configurations required for implementing functionality of certain example embodiments may be performed as routine(s), which may be implemented as added or updated software routine(s). Software routine(s) may be downloaded into the apparatus. [0174] As an example, software or a computer program code or portions of it may be in a source code form, object code form, or in some intermediate form, and it may be stored in some sort of carrier, distribution medium, or computer readable medium, which may be any entity or device capable of carrying the program. Such carriers may include a record medium, computer memory, read-only memory, photoelectrical and/or electrical carrier signal, telecommunications signal, and software distribution package, for example. Depending on the processing power needed, the computer program may be executed in a single electronic digital computer or it may be distributed amongst a number of computers. The computer readable medium or computer readable storage medium may be a non-transitory medium.

[0175] In other example embodiments, the functionality may be performed by hardware or circuitry included in an apparatus (e.g., apparatus 10 or apparatus 20), for example through the use of an application specific integrated circuit (ASIC), a programmable gate array (PGA), a field programmable gate array (FPGA), or any other combination of hardware and software. In yet another example embodiment, the functionality may be implemented as a signal, a non-tangible means that can be carried by an electromagnetic signal downloaded from the Internet or other network.

[0176] According to certain example embodiments, an apparatus, such as a node, device, or a corresponding component, may be configured as circuitry, a computer or a microprocessor, such as single-chip computer element, or as a chipset, including at least a memory for providing storage capacity used for arithmetic operation and an operation processor for executing the arithmetic operation.

[0177] One having ordinary skill in the art will readily understand that the invention as discussed above may be practiced with procedures in a different order, and/or with hardware elements in configurations which are different than those which are disclosed. Therefore, although the invention has been described based upon these example embodiments, it would be apparent to those of skill in the art that certain modifications, variations, and alternative constructions would be apparent, while remaining within the spirit and scope of example embodiments. Although the above embodiments refer to 5G NR and LTE technology, the above embodiments may also apply to any other present or future 3 GPP technology, such as LTE-advanced, and/or fourth generation (4G) technology.

[0178] Partial Glossary:

[0179] 3 GPP 3rd Generation Partnership Project

[0180] 5GC 5G Core

[0181] ADMF Administration Function

[0182] AS Application Server

[0183]ASN. l Abstraction Syntax Notation 1

[0184] IBCF Interconnection Border Control Function

[0185] CC Call Content (or Communication Content or Content of

Communications)

[0186] CC-POI POI for CC

[0187] CC-TF Triggering function for CC-POI

[0188] CP Control Plane

[0189] CSCF Call Session Control Function

[0190] CSP Communication Service Provider

[0191] CUPS Control and User Plane Separation

[0192] eNB Enhanced Node B

[0193] gNB 5G or Next Generation NodeB

[0194] HR Home-Routed

[0195] HSS Home Subscriber Server

[0196] I-CSCF Interrogating CSCF

[0197] ID Identity or Identifier

[0198] IM-MGW IMS Media Gateway [0199] IMS IP Multimedia Subsystem

[0200] IMS-AGW IMS Access Gateway

[0201] IP Internet Protocol

[0202] IRI Intercept Related Information

[0203] IRI-POI POI for IRI

[0204] IRI-TF TF for IRI

[0205] LEA Law Enforcement Agency

[0206] LEMF Law Enforcement Monitoring Facility

[0207] LI Lawful Interception

[0208] LICF LI Control Function

[0209] LIPF LI Provisioning Function

[0210] LI ADMF LI internal interface between within ADMF (between LICF and LIPF)

[0211] LI HI 1 Lawful Interception Handover Interface 1 (between LEA and ADMF)

[0212J LI HI2 Lawful Interception Handover Interface 2 (between

MDF2 and LEMF

[0213J LI HI3 Lawful Interception Handover Interface 3 (between

MDF3 and LEMF)

[0214J LI MDF LI internal interface within MDF (between MDF2 and

MDF3)

[0215] LI SI LI internal interface for System Information (between SIRF and LIPF)

[0216] LI T2 LI internal interface for triggering 2 (between IRI-TF and triggered IRI-POI)

[0217] LI T3 LI internal interface for triggering 3 (between CC-TF and triggered CC-POI)

[0218] LI Xl Lawful Intercept internal Interface 1 (between LIPF and

POI or TF) [0219] LI X2 Lawful Intercept internal Interface 2 (between IRI-POI and MDF2)

[0220] LI X3 Lawful Intercept internal interface (between CC-POI and

MDF3)

[0221] LIMSF LI Mirror IMS State Function

[0222] MDF Mediation and Delivery Function

[0223] MDF2 Mediation and Delivery Function 2 (for IRI)

[0224] MDF3 Mediation and Delivery Function 3 (for CC)

[0225] MGCF Media Gateway Control Function

[0226] MRFC Multimedia Resource Function Controller

[0227] MRFP Multimedia Resource Function Processor

[0228] N9HR N9-interface based Home Routing [0229] NF Network Function [0230] NR New Radio [0231] P-CSCF Proxy CSCF [0232] PGW Packet data network Gateway (aka PDN-GW) [0233] PGW-C PGW with Control plane functions [0234] PGW-U PGW with User plane functions [0235] POI Point of Interception [0236] PTC Push to Talk over Cellular [0237] S8HR S8-interface based Home Routing [0238] S-CSCF Serving CSCF [0239] SGW Serving Gateway [0240] SGW-C SGW with Control plane functions [0241] SGW-U SGW with User plane functions [0242] SIP Session Initiation Protocol [0243] SIRF System Information Resource Function [0244] SMF Session Management Function [0245] TF Triggering Function [0246] TrGW Transit Gateway

[0247] TR Technical Report

[0248] TS Technical Specification

[0249] SX3LIF Split X3 LI Interworking Function

[0250] UDM Unified Data Management

[0251] UE User Equipment

[0252] UP User Plane

[0253] UPF User Plane Function

[0254] VoIP Voice over IP

Claims

WE CLAIM:

1. A method, comprising: establishing communications with a first network node providing lawful interception of a target communication session; receiving from the first network node, a first Correlation Message related to the target communication session; receiving a first Intercept Product from the first network node, the first Intercept Product comprising intercepted data of the target communication session; and associating the first Correlation Message received from the first network node to the target communication session.

2. The method according to claim 1, further comprising: establishing communications with a second network node providing lawful interception of the target communication session; receiving from the second network node, a second Correlation Message related to the target communication session; receiving a second Intercept Product from the first network node, the second Intercept Product comprising additional intercepted data of the target communication session; and associating the second Correlation Message received from the second network node unction to the target communication session.

3. The method according to claims 1 or 2, wherein the first Correlation Message and the second Correlation Message each comprises a respective: correlation information, intercepted target’s session information, scope of an intercepted product, and additional information needed to associate the Correlation Message with a warrant.

4. The method according to any of claims 1-3, further comprising, based on the first Correlation Message and the second Correlation Message, sending the first Intercept Product and the second Intercept Product as a first lawful Intercept Product and a second lawful Intercept Product respectively to a law enforcement monitoring facility.

5. The method according to claim 4, wherein the first lawful Intercept Product and the second lawful Intercept Product are sent to the law enforcement monitoring facility with a same correlation information irrespective of the correlation information that is received from the first network node and the second network node.

6. The method according to claim 4, wherein the first Intercept Product and the second Intercept Product are sent to the law enforcement monitoring facility by using the correlation information in the first Intercept Product and the second Intercept Product, and wherein the method further comprises sending a separate Correlation Message to the law enforcement monitoring facility including correlation information contained in the first Intercept Product and correlation information contained in the second Intercept Product.

7. The method according to any of claims 1-6, wherein the first Correlation Message and the first Intercept Product are received from a first lawful interception function, and wherein the second Correlation Message and the second Intercept Product are received from a second lawful interception function.

8. The method according to any of claims 1-7, wherein the first lawful interception function is in communication with the second lawful interception function, wherein the communication between the first lawful interception function and the second lawful interception function comprises an identity, and wherein the method further comprises associating the first Intercept Product and the second Intercept Product with the communication between the first lawful interception function and the second lawful interception function based on the identity.

9. The method according to any of claims 1-8, further comprising establishing communications with a third network node providing lawful interception of the target communication session; receiving from the third network node, a third Correlation Message related to the target communication session; receiving a third Intercept Product from the first network node, the third Intercept Product comprising further intercepted data of the target communication session; and associating the third Correlation Message received from the third network node to the target communication session.

10. The method according to any of claims 1-9, wherein the first network node, the second network node, and the third network node are not adjacent to each other.

11. The method according to any of claims 1-10, wherein the first Correlation Message and the second Correlation Message are received over a lawful interception specific interface.

12. The method according to any of claims 1-11, wherein a separate correlation information applies to the entire target communication session independent of the first network node or the second network node.

13. A method, comprising : establishing communications with a mediation delivery function; and receiving from the mediation delivery function a first lawful Intercept Product related to a first lawful interception function of a first network node, and a second lawful Intercept Product related to a second lawful interception function of a second network node according to a first approach, or the first lawful Intercept Product, the second lawful Intercept Product, and a Correlation Message according to a second approach, wherein the first lawful Intercept Product comprises first correlation information, and the second lawful Intercept Product comprises second correlation information, wherein receiving according to the first approach or the second approach is based on whether the first correlation information and the second information is the same or different, and wherein when the receiving is according to the second approach, the method further comprises associating the Correlation Message with the first lawful interception product and the second lawful interception product for a same target communication session.

14. The method according to claim 13, wherein first correlation information and the second correlation information are the same.

15. The method according to claim 13, wherein the first correlation information and the second correlation information are different.

16. The method according to claim 15, further comprising: receiving a Correlation Message from the mediation delivery function.

17. The method according to claim 16, wherein the Correlation Message comprises the first correlation information and the second correlation information, and a lawful interception scope.

18. The method according to any of claims 13-17, further comprising: receiving a third lawful interception product related to a third lawful interception function of a third network node, wherein the third lawful interception product comprises third correlation information.

19. The method according to any of claims 13-18, wherein the first lawful interception product, the second lawful interception product, and the third lawful interception product are received from a plurality of mediation delivery functions.

20. An apparatus, comprising: at least one processor; and at least one memory comprising computer program code, the at least one memory and computer program code are configured, with the at least one processor, to cause the apparatus at least to establish communications with a first network node providing lawful interception of a target communication session; receive from the first network node, a first Correlation Message related to the target communication session; receive a first Intercept Product from the first network node, the first Intercept Product comprising intercepted data of the target communication session; and associate the first Correlation Message received from the first network node to the target communication session.

21. The apparatus according to claim 20, wherein the at least one memory and computer program code are further configured, with the at least one processor, to cause the apparatus at least to: establish communications with a second network node providing lawful interception of the target communication session; receive from the second network node, a second Correlation Message related to the target communication session; receive a second Intercept Product from the first network node, the second Intercept Product comprising additional intercepted data of the target communication session; and associate the second Correlation Message received from the second network node unction to the target communication session.

22. The apparatus according to claims 20 or 21, wherein the first Correlation Message and the second Correlation Message each comprises a respective: correlation information, intercepted target’s session information, scope of an intercepted product, and additional information needed to associate the Correlation Message with a warrant.

23. The apparatus according to any of claims 20-22, wherein the at least one memory and computer program code are further configured, with the at least one processor, to cause the apparatus at least to: based on the first Correlation Message and the second Correlation Message, send the first Intercept Product and the second Intercept Product as a first lawful Intercept Product and a second lawful Intercept Product respectively to a law enforcement monitoring facility.

24. The apparatus according to claim 23, wherein the first lawful Intercept Product and the second lawful Intercept Product are sent to the law enforcement monitoring facility with a same correlation information irrespective of the correlation information that is received from the first network node and the second network node.

25. The apparatus according to claim 23, wherein the first Intercept Product and the second Intercept Product are sent to the law enforcement monitoring facility by using the correlation information in the first Intercept Product and the second Intercept Product, and wherein the method further comprises sending a separate Correlation Message to the law enforcement monitoring facility including correlation information contained in the first Intercept Product and correlation information contained in the second Intercept Product.

26. The apparatus according to any of claims 20-25, wherein the first Correlation Message and the first Intercept Product are received from a first lawful interception function, and wherein the second Correlation Message and the second Intercept Product are received from a second lawful interception function.

27. The apparatus according to any of claims 20-26, wherein the first lawful interception function is in communication with the second lawful interception function, wherein the communication between the first lawful interception function and the second lawful interception function comprises an identity, and wherein the method further comprises associating the first Intercept Product and the second Intercept Product with the communication between the first lawful interception function and the second lawful interception function based on the identity.

28. The apparatus according to any of claims 20-27, wherein the at least one memory and computer program code are further configured, with the at least one processor, to cause the apparatus at least to: establish communications with a third network node providing lawful interception of the target communication session; receive from the third network node, a third Correlation Message related to the target communication session; receive a third Intercept Product from the first network node, the third Intercept Product comprising further intercepted data of the target communication session; and associate the third Correlation Message received from the third network node to the target communication session.

29. The apparatus according to any of claims 20-28, wherein the first network node, the second network node, and the third network node are not adjacent to each other.

30. The apparatus according to any of claims 20-29, wherein the first Correlation Message and the second Correlation Message are received over a lawful interception specific interface.

31. The apparatus according to any of claims 20-30, wherein a separate correlation information applies to the entire target communication session independent of the first network node or the second network node.

32. An apparatus, comprising: at least one processor; and at least one memory comprising computer program code, the at least one memory and computer program code are configured, with the at least one processor, to cause the apparatus at least to establish communications with a mediation delivery function; and receive from the mediation delivery function a first lawful Intercept Product related to a first lawful interception function of a first network node, and a second lawful Intercept Product related to a second lawful interception function of a second network node according to a first approach, or the first lawful Intercept Product, the second lawful Intercept Product, and a Correlation Message according to a second approach, wherein the first lawful Intercept Product comprises first correlation information, and the second lawful Intercept Product comprises second correlation information, wherein receiving according to the first approach or the second approach is based on whether the first correlation information and the second information is the same or different, and wherein when the receiving is according to the second approach, the method further comprises associating the Correlation Message with the first lawful interception product and the second lawful interception product for a same target communication session.

33. The apparatus according to claim 32, wherein first correlation information and the second correlation information are the same.

34. The apparatus according to claim 32, wherein the first correlation information and the second correlation information are different.

35. The apparatus according to claim 34, wherein the at least one memory and computer program code are further configured, with the at least one processor, to cause the apparatus at least to: receive a Correlation Message from the mediation delivery function.

36. The apparatus according to claim 35, wherein the Correlation Message comprises the first correlation information and the second correlation information, and a lawful interception scope.

37. The apparatus according to any of claims 32-36, wherein the at least one memory and computer program code are further configured, with the at least one processor, to cause the apparatus at least to: receive a third lawful interception product related to a third lawful interception function of a third network node, wherein the third lawful interception product comprises third correlation information.

38. The apparatus according to any of claims 32-37, wherein the first lawful interception product, the second lawful interception product, and the 70 third lawful interception product are received from a plurality of mediation delivery functions.

39. An apparatus, comprising: means for establishing communications with a first network node providing lawful interception of a target communication session; means for receiving from the first network node, a first Correlation Message related to the target communication session; means for receiving a first Intercept Product from the first network node, the first Intercept Product comprising intercepted data of the target communication session; and means for associating the first Correlation Message received from the first network node to the target communication session.

40. The apparatus according to claim 39, further comprising: means for establishing communications with a second network node providing lawful interception of the target communication session; means for receiving from the second network node, a second Correlation Message related to the target communication session; means for receiving a second Intercept Product from the first network node, the second Intercept Product comprising additional intercepted data of the target communication session; and means for associating the second Correlation Message received from the second network node unction to the target communication session.

41. The apparatus according to claims 39 or 40, wherein the first Correlation Message and the second Correlation Message each comprises a respective: correlation information, 71 intercepted target’s session information, scope of an intercepted product, and additional information needed to associate the Correlation Message with a warrant.

42. The apparatus according to any of claims 39-41, further comprising, based on the first Correlation Message and the second Correlation Message, means for sending the first Intercept Product and the second Intercept Product as a first lawful Intercept Product and a second lawful Intercept Product respectively to a law enforcement monitoring facility.

43. The apparatus according to claim 42, wherein the first lawful Intercept Product and the second lawful Intercept Product are sent to the law enforcement monitoring facility with a same correlation information irrespective of the correlation information that is received from the first network node and the second network node.

44. The apparatus according to claim 42, wherein the first Intercept Product and the second Intercept Product are sent to the law enforcement monitoring facility by using the correlation information in the first Intercept Product and the second Intercept Product, and wherein the method further comprises sending a separate Correlation Message to the law enforcement monitoring facility including correlation information contained in the first Intercept Product and correlation information contained in the second Intercept Product.

45. The apparatus according to any of claims 39-44, wherein the first Correlation Message and the first Intercept Product 72 are received from a first lawful interception function, and wherein the second Correlation Message and the second Intercept Product are received from a second lawful interception function.

46. The apparatus according to any of claims 39-45, wherein the first lawful interception function is in communication with the second lawful interception function, wherein the communication between the first lawful interception function and the second lawful interception function comprises an identity, and wherein the method further comprises associating the first Intercept Product and the second Intercept Product with the communication between the first lawful interception function and the second lawful interception function based on the identity.

47. The apparatus according to any of claims 39-46, further comprising means for establishing communications with a third network node providing lawful interception of the target communication session; means for receiving from the third network node, a third Correlation Message related to the target communication session; means for receiving a third Intercept Product from the first network node, the third Intercept Product comprising further intercepted data of the target communication session; and means for associating the third Correlation Message received from the third network node to the target communication session.

48. The apparatus according to any of claims 39-47, wherein the first network node, the second network node, and the third network node are not adjacent to each other. 73

49. The apparatus according to any of claims 39-48, wherein the first Correlation Message and the second Correlation Message are received over a lawful interception specific interface.

50. The apparatus according to any of claims 39-49, wherein a separate correlation information applies to the entire target communication session independent of the first network node or the second network node.

51. An apparatus, comprising : means for establishing communications with a mediation delivery function; and means for receiving from the mediation delivery function a first lawful Intercept Product related to a first lawful interception function of a first network node, and a second lawful Intercept Product related to a second lawful interception function of a second network node according to a first approach, or the first lawful Intercept Product, the second lawful Intercept Product, and a Correlation Message according to a second approach, wherein the first lawful Intercept Product comprises first correlation information, and the second lawful Intercept Product comprises second correlation information, wherein receiving according to the first approach or the second approach is based on whether the first correlation information and the second information is the same or different, and wherein when the receiving is according to the second approach, the method further comprises associating the Correlation Message with the first lawful interception product and the second lawful interception product for a same target communication session. 74

52. The apparatus according to claim 51, wherein first correlation information and the second correlation information are the same.

53. The apparatus according to claim 51, wherein the first correlation information and the second correlation information are different.

54. The apparatus according to claim 53, further comprising: means for receiving a Correlation Message from the mediation delivery function.

55. The apparatus according to claim 54, wherein the Correlation Message comprises the first correlation information and the second correlation information, and a lawful interception scope.

56. The apparatus according to any of claims 51-55, further comprising: means for receiving a third lawful interception product related to a third lawful interception function of a third network node, wherein the third lawful interception product comprises third correlation information.

57. The apparatus according to any of claims 51-56, wherein the first lawful interception product, the second lawful interception product, and the third lawful interception product are received from a plurality of mediation delivery functions.

58. A non-transitory computer readable medium comprising program instructions stored thereon for performing the method according to any of claims 1-19. 75

59. An apparatus, comprising circuitry configured to perform the method according to any of claims 1-19.