WO2018137171A1

WO2018137171A1 - Data processing method and communication system for lawful interception

Info

Publication number: WO2018137171A1
Application number: PCT/CN2017/072594
Authority: WO
Inventors: 聂胜贤; 周润泽; 陈中平
Original assignee: 华为技术有限公司
Priority date: 2017-01-25
Filing date: 2017-01-25
Publication date: 2018-08-02

Abstract

Provided is a data processing method and a communication system for lawful interception. A user plane entity no longer sends user plane information in a packet data header event to a control plane entity, wherein same can reduce an interface burden between the user plane entity and the control plane entity. The method comprises: a user plane entity receiving interception management information sent by a control plane entity, wherein the interception management information comprises destination address information about user plane information in a packet data header event for lawful interception; the control plane entity generating control plane information in the packet data header event according to the context, and sending the control plane information in the packet data header event to a first distribution function entity; and the user plane entity sending the user plane information in the packet header event to a second distribution function entity according to the destination address information.

Description

Data processing method and communication system for lawful interception

Technical field

The present application relates to the field of lawful interception, and in particular, to a data processing method and a communication system for lawful interception.

Background technique

Lawful interception refers to the law enforcement behavior of the law enforcement agencies (LEA) that are approved by the corresponding authorized authorities to monitor the public communication network communication services according to relevant national laws and public communication network industry norms.

In a communication architecture in which the control plane entity and the user plane entity are separated, when a user needs to be monitored, the user plane entity needs to frequently report the packet header information for lawful interception to the control plane entity through the Sx interface. However, the interface between the control plane entity and the user plane entity, in addition to carrying the information related to the lawful interception, bears other services, and the frequent reporting of the lawful interception related information will result in an interface between the user plane entity and the control plane entity. The burden is too heavy.

Summary of the invention

The present application provides a data processing method and a communication system for lawful interception, which can reduce the interface burden between the user plane entity and the control plane entity.

In one aspect, the present application provides a data processing method for lawful interception, the method comprising:

After the law enforcement interception device determines the monitored target, the monitoring function of the control plane entity is activated by the management function entity, and after the monitoring function of the control plane entity is activated, the control plane entity sends the monitoring management information to the user plane entity, and correspondingly, the user plane The entity receives the monitoring management information sent by the control plane entity, where the monitoring management information includes the destination address information of the user plane information in the packet data header event for legal interception, where the destination address information is the address of the second distribution function entity, and the user plane entity The user plane information in the packet header event is sent to the second distribution function entity according to the destination address information. The control plane entity generates control plane information in the packet header event based on the context and transmits control plane information in the packet header event to the first distribution function entity.

It can be seen that the user plane entity no longer sends the user plane information in the packet data header event to the control plane entity, which can reduce the interface burden between the user plane entity and the control plane entity.

In one possible design, the snoop management information also includes associated information.

In one possible design, the associated information includes a correlation identifier or correlation coefficient or sequence.

In a possible design, the user plane information in the packet data header event and the control plane information in the packet data header event carry associated information, and the association information is used to associate user plane information and packet data in the information associated packet header event. Control surface information in the header event.

It can be seen that the implementation of the present application can be further improved by associating the user plane information in the packet header event with the control plane information in the packet header event.

In a possible design, after the second distribution function entity receives the user plane information in the packet header event sent by the user plane entity, the second distribution function entity sends the user plane information in the packet header event to the law enforcement interception device; After the distribution function entity receives the control plane information in the packet header event sent by the control plane entity, the first distribution The function entity sends the control plane information in the packet data header event to the law enforcement interception device; after the law enforcement interception device acquires the user plane information in the packet data header event and the control plane information in the packet data header event, the packet data header may be associated according to the association information. User plane information in the event and control plane information in the packet header event.

In a possible design, after the second distribution function entity receives the user plane information in the packet header event, the second distribution function entity sends the user plane information in the packet header event to the first distribution function entity; the first distribution function After the entity acquires the user plane information in the packet data header event and the control plane information in the packet data header event, the user plane information in the packet header event and the control plane information in the packet header event may be associated according to the association information.

It can be seen that the network element of the user plane information in the associated packet data header event and the control plane information in the packet header event can be the law enforcement interception device or the first distribution function entity, which enriches the implementation manner of the embodiment of the present invention.

In a possible design, before the control plane entity sends the monitoring management information to the user plane entity, the control plane entity receives the first monitoring activation message sent by the management function entity, and the first monitoring activation message is used to activate the monitoring function of the control plane entity. It is also used to instruct the control plane entity to listen to packet header events.

In a possible design, before the control plane entity sends the monitoring management information to the user plane entity, the second distribution function entity receives the second monitoring activation message sent by the management function entity, and the second monitoring activation message is used to activate the second distribution function. The intercepting function of the entity is further configured to instruct the second distribution function entity to forward the user plane information in the packet data header event sent by the user plane entity.

In a possible design, before the control plane entity sends the monitoring management information to the user plane entity, the first distribution function entity receives a third monitoring activation message sent by the management function entity, and the third monitoring activation message is used to activate the first distribution function. The listening function of the entity is further configured to instruct the first distribution function entity to associate the user plane information in the packet data header event with the control plane information in the packet data header event.

In a possible design, the first monitoring activation message is specifically used to instruct the control plane entity to listen to the packet data header event and the communication content, and the monitoring management information is further used to activate the data backup function of the user plane entity, and receive the control plane on the user plane entity. After the interception management information sent by the entity, the user plane entity sends the communication content to the second distribution function entity.

In another aspect, the present application further provides a communication system, where the system includes a user plane entity and a control plane entity, wherein the user plane entity is configured to receive the monitoring management information sent by the control plane entity, and the monitoring management information includes: The destination address information of the user plane information in the packet header event, and the user plane information in the packet header event sent to the second distribution function entity according to the destination address information. The control plane entity is configured to generate control plane information in the packet header event based on the context and to send control plane information in the packet header event to the first distribution function entity.

In a possible design, the user plane information in the packet data header event and the control plane information in the packet header event carry associated information, and the association information is used to associate user plane information and packet header events in the packet header event. Control surface information in .

In one possible design, the system also includes a second distribution function entity and a first distribution function entity and law enforcement Listening to the device, wherein the second distribution function entity is configured to send the user plane information in the packet data header event to the law enforcement interception device; the first distribution function entity is configured to send the control plane information in the packet data header event to the law enforcement interception device; The listening device is configured to associate the user plane information in the packet data header event with the control plane information in the packet header event according to the association information.

In a possible design, the system further includes a second distribution function entity and a first distribution function entity, wherein the second distribution function is configured to send the user plane information in the packet data header event to the first distribution function entity; The distribution function entity is configured to associate the user plane information in the packet header event and the control plane information in the packet header event according to the association information.

In a possible design, the control plane entity is further configured to receive a first monitoring activation message sent by the management function entity, where the first monitoring activation message is used to activate the monitoring function of the control plane entity, and is further used to instruct the control plane entity to listen to the packet data. Head event.

In a possible design, the second distribution function entity is further configured to receive a second monitoring message sent by the management function entity, where the second monitoring activation message is used to activate the monitoring function of the second distribution function entity, and is further used to indicate the second The distribution function entity forwards the user plane information in the packet header event sent by the user plane entity.

In a possible design, the first distribution function is further configured to receive a third monitoring activation message sent by the management function entity, where the third monitoring activation message is used to activate the monitoring function of the first distribution function entity, and is also used to indicate the first distribution. The functional entity associates the user plane information in the packet header event with the control plane information in the packet header event.

In a possible design, the first monitoring activation message is specifically used to instruct the control plane entity to listen to the packet data header event and the communication content, and the monitoring management information is also used to activate the data backup function of the user plane entity, and the user plane entity receives the monitoring. After the management information, the user plane entity further sends the communication content to the second distribution function entity.

In a further aspect, the application further provides a data processing method for lawful interception, the method comprising:

The user plane entity receives the monitoring management information sent by the control plane entity, and the monitoring management information includes the destination address information of the user plane information in the packet data header event for legal interception, where the destination address information is the address of the first distribution function entity, and the user The polygon entity sends the user plane information in the packet header event to the first distribution function entity according to the destination address information. The control plane entity generates control plane information in the packet header event based on the context and transmits control plane information in the packet header event to the first distribution function entity.

In a possible design, after the first distribution function entity receives the user plane information in the packet header event and the control plane information in the packet header event, the first distribution function entity associates the user in the packet header event according to the association information. Control surface information in face information and packet header events.

In a possible design, before the control plane entity sends the monitoring management information to the user plane entity, the control plane entity receives the first monitoring activation message sent by the management function entity, where the first monitoring activation message is used to instruct the control plane entity to listen to the packet data. Head event.

In a possible design, before the control plane entity sends the monitoring management information to the user plane entity, the first distribution function entity receives a third monitoring activation message sent by the management function entity, and the third monitoring activation message is used to indicate the first distribution function. The entity associates the user plane information in the packet header event and the control plane information in the packet header event.

In a possible design, the first monitoring activation message is specifically used to instruct the control plane entity to listen to the packet data header event and the communication content, and the monitoring management information is further used to activate the data backup function of the user plane entity, and receive the control plane on the user plane entity. After the monitoring management information sent by the entity, the user plane entity further sends the communication content to the second distribution function entity.

In another aspect, the application further provides a communication system, where the system includes a user plane entity and a control plane entity, wherein the user plane entity is configured to receive the monitoring management information sent by the control plane entity, and the monitoring management information includes: The destination address information of the user plane information in the packet data header event, the destination address information is an address of the first distribution function entity, and the user plane entity is further configured to send the packet data header event to the first distribution function entity according to the destination address information. User face information in . The control plane entity is configured to generate control plane information in the packet header event according to the context and send control plane information in the packet header event to the first distribution function entity.

In one possible design, the system further includes a first distribution function entity for associating user plane information in the packet header event and control plane information in the packet header event based on the association information.

In a possible design, the control plane entity is further configured to receive a first interception activation message sent by the management function entity, where the first interception activation message is used to instruct the control plane entity to listen to the packet data header event.

In a possible design, the first distribution function entity is further configured to receive a third interception activation message sent by the management function entity, where the third interception activation message is used to indicate that the first distribution function entity associates the user plane information in the packet data header event. And control plane information in packet header events.

In a possible design, the first monitoring activation message is specifically used to instruct the control plane entity to listen to the packet data header event and the communication content, and the monitoring management information is also used to activate the data backup function of the user plane entity, and the user plane entity is also used for The communication content is sent to the second distribution function entity.

The user plane entity receives the interception management information sent by the control plane entity, and the interception management information includes destination address information and associated information of the user plane information in the packet data header event for legal interception, where the destination address information is the second distribution function entity The address or the address of the third distribution function entity, the user plane entity sends the user plane information in the packet data header event to the second distribution function entity or the third distribution function entity according to the destination address information, wherein the user in the packet data header event The face information carries the associated information, and the associated information is used to associate the user plane information in the packet header event with the control plane information in the packet header event.

In a possible design, the monitoring management information is used to activate the data backup function of the user plane entity. After receiving the monitoring management information sent by the control plane entity, the user plane entity further includes the user plane entity sending the communication content to the second distribution function entity.

In another aspect, the present application further provides a data processing method for lawful interception, the method comprising:

The control plane entity sends the monitoring management information to the user plane entity, where the monitoring management information includes destination address information and associated information of the user plane information in the packet data header event for legal interception, and the destination address information is the address of the second distribution function entity. Or the address of the third distribution function entity. The control plane entity generates control plane information in the packet data header event according to the context, and sends control plane information in the packet data header event to the first distribution function entity, where the control plane information in the packet data header event carries the association information, where The association information is used to associate the user plane information in the packet header event with the control plane information in the packet header event.

In one possible design, the first snoop activation message is specifically used to instruct the control plane entity to listen to packet header events and communication content for lawful interception.

The law enforcement intercepting device receives the control plane information in the packet data header event sent by the first distribution function entity, wherein the control plane information in the packet data header event carries the associated information. The law enforcement intercepting device receives the user plane information in the packet data header event sent by the second distribution function entity, where the user plane information in the packet data header event carries the associated information. The law enforcement interception device associates the control plane information in the packet header event with the user plane information in the packet header event according to the association information.

In one possible design, the law enforcement interception device receives the communication content sent by the second distribution function entity, wherein The communication content carries the associated information, and the law enforcement interception device associates the control plane information in the packet header event, the user plane information in the packet header event, and the communication content according to the association information.

The first distribution function entity receives control plane information in a packet header event sent by the control plane entity, wherein the control plane information in the packet header event carries the association information. The first distribution function entity receives the user plane information in the packet data header event sent by the second distribution function entity or the user plane entity, where the user plane information in the packet data header event carries the association information. The first distribution function entity associates the control plane information in the packet header event with the user plane information in the packet header event according to the association information.

In a possible design, before the first distribution function entity receives the user plane information in the packet header event and the control plane information in the packet header event, the first distribution function entity receives the third intercept activation sent by the management function entity. The third monitoring activation message is used to activate the listening function of the first distribution function entity, and is further configured to instruct the first distribution function entity to associate the user plane information in the packet data header event with the control plane information in the packet data header event.

The second distribution function entity receives the user plane information in the packet data header event sent by the user plane entity, where the user plane information in the packet data header event carries the association information. The second distribution function entity sends the user plane information in the packet header event to the law enforcement interception device or the first distribution function entity, so that the law enforcement interception device or the first distribution function entity associates the user plane information in the packet header event according to the association information. And control plane information in packet header events.

In a possible design, before the second distribution function entity receives the user plane information in the packet data header event sent by the user plane entity, the second distribution function entity receives the second interception activation message sent by the management function entity, and the second interception The activation message is used to activate the listening function of the second distribution function entity, and is further configured to instruct the second distribution function entity to forward the user plane information in the packet data header event sent by the user plane entity.

In one possible design, the second distribution function entity receives the communication content sent by the user plane entity, wherein the communication content carries the association information. The second distribution function entity then sends the communication content to the law enforcement interception device.

In another aspect, the present application provides a user plane entity having a function of implementing user plane entity behavior in the above method example. The functions may be implemented by hardware or by corresponding software implemented by hardware. The hardware or software includes one or more modules corresponding to the functions described above.

In one possible design, the structure of the user plane entity includes a processor and a communication interface configured to support the user plane entity to perform the corresponding functions in the above methods. The communication interface is configured to support communication between the user plane entity and the control plane entity, the first distribution function entity, or the second distribution function entity. Further, the user plane entity may further include a memory for coupling with the processor, which stores program instructions and data necessary for the user plane entity.

In still another aspect, the present application provides a control plane entity having the function of implementing the behavior of a control plane entity in the above method examples. The functions may be implemented by hardware or by corresponding software implemented by hardware. The hardware or software includes one or more modules corresponding to the functions described above.

In one possible design, the structure of the control plane entity includes a processor and a communication interface, and the processor is configured Set to support the control plane entity to perform the corresponding functions in the above methods. The communication interface is configured to support communication between the control plane entity and the user plane entity, the first distribution function entity, or the management function entity. Further, the control plane entity may further comprise a memory for coupling with the processor, which stores program instructions and data necessary for the control plane entity.

In still another aspect, the present application provides a law enforcement interception device having a function of implementing the behavior of a law enforcement listening device in the above method example. The functions may be implemented by hardware or by corresponding software implemented by hardware. The hardware or software includes one or more modules corresponding to the functions described above.

In one possible design, the structure of the law enforcement interception device includes a processor and a communication interface configured to support the law enforcement listening device to perform the corresponding functions in the above methods. The communication interface is for supporting communication between the law enforcement interception device and the management function entity, the first distribution function entity, or the second distribution function entity. Further, the law enforcement listening device can also include a memory for coupling with the processor that holds program instructions and data necessary for the law enforcement listening device.

In still another aspect, the present application provides a first distribution function entity having a function of implementing the behavior of a first distribution function entity in the above method example. The functions may be implemented by hardware or by corresponding software implemented by hardware. The hardware or software includes one or more modules corresponding to the functions described above.

In one possible design, the first distribution function entity includes a processor and a communication interface configured to support the first distribution function entity to perform a corresponding function in the above method. The communication interface is configured to support communication between the first distribution function entity and the management function entity, the second distribution function entity, the control plane entity, the law enforcement interception device, or the user plane entity. Further, the first distribution function entity may further include a memory for coupling with the processor, which stores program instructions and data necessary for the law enforcement listening device.

In still another aspect, the present application provides a second distribution function entity having a function of implementing the behavior of the second distribution function entity in the above method example. The functions may be implemented by hardware or by corresponding software implemented by hardware. The hardware or software includes one or more modules corresponding to the functions described above.

In one possible design, the structure of the second distribution function entity includes a processor and a communication interface, the processor being configured to support the second distribution function entity to perform a corresponding function in the above method. The communication interface is configured to support communication between the second distribution function entity and the management function entity, the first distribution function entity, the law enforcement interception device, or the user plane entity. Further, the second distribution function entity may further include a memory for coupling with the processor, which stores program instructions and data necessary for the law enforcement listening device.

Yet another aspect of the present application provides a computer readable storage medium having instructions stored therein that, when executed on a computer, cause the computer to perform the methods described in the above aspects.

In the technical solution provided by the application, the user plane entity receives the interception management information sent by the control plane entity, and the interception management information includes the destination address information of the user plane information in the packet data header event for legal interception, and the control plane entity generates the context information according to the context. The control plane information in the packet header event is grouped, and the control plane information in the packet header event is sent to the first distribution function entity. The user plane entity sends the user plane information in the packet header event to the second distribution function entity according to the destination address information. It can be seen that the user plane entity no longer sends the user plane information in the packet header event to the control plane entity, thereby reducing the interface burden between the user plane entity and the control plane entity.

DRAWINGS

1 is a schematic diagram of a possible network architecture provided by the present application;

2 is a schematic diagram of another possible network architecture provided by the present application;

3 is a schematic diagram of another possible network architecture provided by the present application;

4 is a schematic diagram of communication of a data processing method for lawful interception provided by the present application;

FIG. 5 is a schematic diagram of communication of another data processing method for lawful interception provided by the present application; FIG.

6 is a schematic diagram of communication of another data processing method for lawful interception provided by the present application;

7A is a schematic block diagram of a user plane entity provided by the present application;

7B is a schematic structural diagram of a user plane entity provided by the present application;

8A is a schematic block diagram of a control plane entity provided by the present application;

8B is a schematic structural diagram of a control plane entity provided by the present application;

9A is a schematic block diagram of a law enforcement listening device provided by the present application;

9B is a schematic structural diagram of a law enforcement listening device provided by the present application;

FIG. 10A is a schematic block diagram of a first distribution function entity provided by the present application; FIG.

FIG. 10B is a schematic structural diagram of a first distribution function entity provided by the present application; FIG.

11A is a schematic block diagram of a second distribution function entity provided by the present application;

FIG. 11B is a schematic structural diagram of a second distribution function entity provided by the present application.

detailed description

The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings of the embodiments of the present application.

The terms "first", "second", "third", "fourth", etc. (if present) in the specification and claims of the present application and the above figures are used to distinguish similar objects without having to use To describe a specific order or order. It is to be understood that the data so used may be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than what is illustrated or described herein. In addition, the terms "comprises" and "comprises" and "the" and "the" are intended to cover a non-exclusive inclusion, for example, a process, method, system, product, or device that comprises a series of steps or units is not necessarily limited to Those steps or units may include other steps or units not explicitly listed or inherent to such processes, methods, products or devices.

Lawful interception refers to the law enforcement behavior of the law enforcement agencies (LEA) that are approved by the corresponding authorized authorities to monitor the public communication network communication services according to relevant national laws and public communication network industry norms. The Intercept Related Information (IRI) in lawful interception includes Packet Data Header Information. Optionally, the interception related information in the lawful interception may further include other events in the lawful interception generated by the control plane entity. The packet data header event includes a packet data header report event and a packet data summary report event. The packet data header event includes control plane information in the packet data header event and user plane information in the packet data header event, and the control plane information generated by the control plane entity is a packet event, and may also be referred to as a first event. The packet data header reporting event in the first event includes but is not limited to event type (Event Type), location information (Location Information) and the like, and the packet data statistical reporting event in the first event includes but is not limited to logical function information (Logical Function) Information), User Address Information (UE Address Info) and other information. The user plane information generated by the user plane entity is a packet data header event, It may also be referred to as a second event, and the packet data header reporting event in the second event includes, but is not limited to, a destination port number, a packet size, and the like, and the packet data is reported in the second event. Events include, but are not limited to, source IP address, destination IP address, and the like. This article uses the same description for the above nouns and will not be described again.

FIG. 1 is a schematic diagram of a possible network architecture provided by the present application. The network architecture shown in FIG. 1 mainly includes the following network elements:

The Control Plane (CP) entity mainly manages and controls the user plane entity, and issues rules for the user plane. In this embodiment of the present application, the control plane entity sends the monitoring management information to the user plane entity, and sends the control plane information in the packet data header event to the first distribution function entity.

User Plane (UP) entity, mainly used for data forwarding, and accepts management of control plane entities. In the embodiment of the present application, the user plane entity does not send the user plane information in the packet data header event of the lawful interception to the control plane entity, but sends the information to the second distribution function entity, and the user plane entity may also be the second distribution function. The entity provides the communication content of the monitored target, such as the content of the data portion of the data packet.

The first distribution function entity, the first distribution function entity is the DF2 in FIG. 1 , and is mainly used to distribute the Intercept Related Information (IRI). In the embodiment of the present application, the first distribution function entity receives Control plane information in the packet header event sent by the control plane entity.

The second distribution function entity, the second distribution function entity is DF3 in FIG. 1, and is mainly used for distributing communication content, for example, the content of the data part in the data packet. In the embodiment of the present application, the second distribution function entity is further configured to receive and forward the user plane information in the packet data header event sent by the user plane entity.

The Law Enforcement Monitoring Facility (LEMF) can receive the lawful interception related information of the first distribution function entity and the communication content delivered by the second distribution function entity, and associate the lawful interception related message with the communication content. In an example, the law enforcement interception device can also associate the user plane information in the packet header event with the control plane information in the packet header event.

An Administration Function (ADMF) entity is mainly used for receiving control of the law enforcement interception device, and activating the monitoring function of the control plane entity, the first distribution function entity, and the second distribution function entity.

Referring to FIG. 4, the embodiment shown in FIG. 4 uses FIG. 1 as a network architecture. A possible data processing method in this embodiment of the present application includes:

401. The law enforcement interception device sends a fourth monitoring activation message to the management function entity.

Correspondingly, the management function entity receives the fourth monitoring activation message sent by the law enforcement interception device. After the law enforcement interception device determines the monitored target, the fourth monitoring activation message is sent to the management function entity, and the fourth monitoring activation message is used to notify the management function entity to start monitoring the monitored target.

402. The management function entity sends a third interception activation message to the first distribution function entity.

Correspondingly, the first distribution function entity receives the third monitoring activation message sent by the management function entity. The third listener activation message is used to activate the listening function of the first distribution function entity.

403. The management function entity sends a second interception activation message to the second distribution function entity.

Correspondingly, the second distribution function entity receives the second monitoring activation message sent by the management function entity. The second snoop activation message is used to activate the snooping function of the second distribution function entity. Optionally, the second monitoring activation message is further used to indicate the first The second distribution function forwards the user plane information in the packet header event sent by the user plane entity to the law enforcement interception device.

404. The management function entity sends a first interception activation message to the control plane entity.

Correspondingly, the control plane entity receives the first interception activation message sent by the management function entity. The first listener activation message is used to activate the listening function of the control plane entity. Optionally, the first interception activation message is further used to instruct the control plane entity to listen to the packet data header event.

405. The control plane entity sends the monitoring management information to the user plane entity.

Correspondingly, the user plane entity receives the monitoring management information sent by the control plane entity. The monitoring management information includes the destination address information of the user plane information in the packet data header event for the lawful interception, and is used to indicate that the user entity sends the user plane information in the packet data header event to the destination address, in this embodiment. The destination address information is an address of the second distribution function entity. Specifically, the destination address may be included in a Forwarding Action Rule (FAR).

Optionally, the monitoring management information may further include association information, including but not limited to related identifiers or correlation coefficients or sequences, etc., which may be used to control user plane information in the packet data header event and control in the packet data header event. Information.

In a possible implementation manner, the association information is a correlation number in the control plane information in the packet data header event, and the control plane entity may include the correlation coefficient in the intercept management information and send the information to the user plane entity. Thereby, the user plane information in the packet header event of the user plane entity can carry the same correlation coefficient. In the example in which the association information is a correlation coefficient, the association information of the user plane information in the packet header event is the same as the association information in the packet header event. In some possible implementations, different associations may also be used. Information, such as control plane entities and user plane entities, can each generate associated information according to preset rules, which is not limited here.

406. The control plane entity sends control plane information in the packet data header event to the first distribution function entity.

Correspondingly, the first distribution function entity receives control plane information in a packet header event sent by the control plane entity.

It should be noted that the control plane entity generates the control plane information in the packet data header event according to the context, and the control plane entity may also generate other events in the legal listener other than the packet data header event, and simultaneously or in other steps. The first distribution function entity sends the other event. Specifically, the other events include bearer activation, bearer modification, bearer deactivation, tracking area update, user equipment (UE) requesting packet data network (PDN) connection, or UE requesting PDN disconnection. There is no limit here.

407. The first distribution function entity sends control plane information in the packet data header event to the law enforcement interception device.

Correspondingly, the law enforcement interception device receives control plane information in a packet header event sent by the first distribution function entity.

It should be noted that, if the first distribution function entity has acquired other events in the lawful interception sent by the control plane entity other than the packet header event, the first distribution function entity may send the same to the law enforcement interception device at the same time or in other steps. Other events.

408. The user plane entity sends the user plane information in the packet data header event to the second distribution function entity.

Correspondingly, the second distribution function entity receives the user plane information in the packet header event sent by the user plane entity.

It should be noted that the information generated by the user plane entity other than the user plane information in the packet header event includes using the Usage Report information, the DPI Reporting information, and the downlink data detection reporting information. The application starts reporting information and the application terminates reporting information, etc., and the user entity can be based on the control. The reporting rule (Usage reporting rule, URR) is reported to the control plane entity, and is not mentioned here.

Optionally, there is no order of execution between steps 406 and 408. In some possible implementations, the execution may also be performed in other orders.

409. The second distribution function entity sends the user plane information in the packet data header event to the law enforcement interception device.

Correspondingly, the law enforcement interception device receives the user plane information in the packet header event sent by the second distribution function entity.

410. The law enforcement interception device monitors the target user according to the control plane information in the packet data header event and the user plane information in the packet data header event.

Optionally, the law enforcement interception device may associate the control plane information in the packet data header event with the user plane information in the packet data header event according to the association information to form a complete packet data header event, thereby monitoring the target user.

Optionally, if the law enforcement interception device has obtained other events in the lawful interception generated by the control plane entity other than the packet data header event, for example, in step 407, the first distribution function entity simultaneously sends the other event to the law enforcement interception device, The law enforcement interception device can also associate the control plane information in the packet header event, the user plane information in the packet header event, and the other events to form a complete interception related information IRI.

Optionally, the law enforcement interception device may also associate the control plane information in the packet data header event with the user plane information in the packet data header event according to other preset rules, which is not limited herein.

Optionally, in some possible implementation manners, the first interception activation message is further used to indicate that the control plane entity listens to the packet data header event and the communication content. Accordingly, the monitoring management information is also used to activate the data backup function of the user plane entity. After receiving the monitoring management information of the control plane entity, the user plane entity further includes: the user plane entity sends the communication content to the second sub-function entity, the communication content carries the association information, and the second distribution function entity sends the communication content to the law enforcement interception device, Step 410 is specifically that the law enforcement interception device associates the control plane information in the packet header event, the user plane information in the packet header event, and the communication content according to the association information or other preset rules. If the law enforcement interception device has obtained other events than the packet header event in the lawful interception generated by the control plane entity, step 410 may also associate the other event, packet header event with the law enforcement interception device according to the associated information or other preset rules. Control plane information, user plane information, and communication content in packet header events.

In this embodiment, the user plane entity does not send the user plane information in the packet header event to the control plane entity, which reduces the interface burden between the user plane entity and the control plane entity, and the embodiment can retain the existing network. Architecture, no need to add additional interfaces.

2 is a schematic diagram of a possible network architecture provided by the present application. The network architecture shown in FIG. 2 mainly includes the following network elements:

The control plane entity mainly manages and controls the user plane entity, and issues rules for the user plane. In this embodiment of the present application, the control plane entity sends the monitoring management information to the user plane entity, and sends the control plane information in the packet data header event to the first distribution function entity.

The user plane entity is mainly used for data forwarding and accepts the management of the control plane entity. In the embodiment of the present application, the user plane entity does not send the user plane information in the packet data header event of the lawful interception to the control plane entity, but sends the information to the second distribution function entity, and the user plane entity may also be the second distribution function. The entity provides the communication content of the monitored target, such as the content of the data portion of the data packet.

The first distribution function entity, the first distribution function entity is DF2 in FIG. 2, and is mainly used for distributing legal interception related information. In the embodiment of the present application, the first distribution function entity receives the control plane information in the packet data header event sent by the control plane entity, and receives the user plane information in the packet data header event sent by the second distribution function entity. The first distribution function entity and the second distribution function entity are connected through an F23 interface.

The second distribution function entity, the second distribution function entity is the DF3 in FIG. 2, and is mainly used to distribute the communication content. In the embodiment of the present application, the second distribution function entity is further configured to receive and forward the packet data header sent by the user plane entity. User face information in the event. The first distribution function entity and the second distribution function entity are connected through an F23 interface.

The law enforcement interception device can receive the lawful interception related information of the first distribution function entity and the communication content delivered by the second distribution function entity, and associate the lawful interception related message with the communication content.

The management function entity is mainly used for receiving the control of the law enforcement interception device, and the monitoring function of the control plane entity, the first distribution function entity and the second distribution function entity.

Referring to FIG. 5, the embodiment shown in FIG. 5 uses FIG. 2 as a network architecture. Another possible data processing method in this embodiment of the present application includes:

501. The law enforcement interception device sends a fourth monitoring activation message to the management function entity.

Step 501 is similar to step 401 of FIG. 4 and will not be described again.

502. The management function entity sends a third interception activation message to the first distribution function entity.

Step 502 is similar to step 402 of FIG. 4 and will not be described again.

It should be noted that the third interception activation message is used to instruct the first distribution function entity to associate the user plane information in the packet data header event with the control in the packet data header event, in addition to the monitoring function for activating the first distribution function entity. Information.

503. The management function entity sends a second interception activation message to the second distribution function entity.

Correspondingly, the second distribution function entity receives the second monitoring activation message sent by the management function entity. The second interception activation message is used to instruct the second distribution function to forward the user plane information in the packet data header event sent by the user plane entity to the first distribution function, in addition to the monitoring function of the second distribution function entity.

504. The management function entity sends a first interception activation message to the control plane entity.

Step 504 is similar to step 404 of FIG. 4 and will not be described again.

505. The control plane entity sends the monitoring management information to the user plane entity.

Step 505 is similar to step 405 of FIG. 4 and will not be described again.

506. The control plane entity sends control plane information in the packet data header event to the first distribution function entity.

Step 506 is similar to step 406 of FIG. 4 and will not be described again.

507. The user plane entity sends the user plane information in the packet data header event to the second distribution function entity.

It should be noted that the information generated by the user plane entity other than the user plane information in the packet header event includes using the Usage Report information, the DPI Reporting information, and the downlink data detection reporting information. The application entity may report the report information and the application termination report information, and the user plane entity may report the report rule sent by the control plane entity to the control plane entity.

Optionally, there is no order of execution between the steps 506 and 507. In some possible implementations, the execution may also be performed in other orders.

508. The second distribution function entity sends the user plane information in the packet data header event to the first distribution function entity.

Correspondingly, the first distribution function entity receives the user plane information in the packet data header event sent by the second distribution function entity. The data transmission may be performed by adding an F23 interface between the first distribution function entity and the second distribution function entity.

509. The first distribution function entity associates control plane information in the data header event with user plane information in the packet header event.

Optionally, the first distribution function entity may associate the control plane information in the packet data header event with the user plane information in the packet header event packet header event according to the association information to form a complete packet header event.

Optionally, the first distribution function entity may also associate the control plane information in the packet data header event with the user plane information in the packet data header event according to other preset rules, which is not limited herein.

Optionally, if the first distribution function entity has acquired other events than the control plane information in the packet header event generated by the control plane entity, for example, the control plane entity may simultaneously send the first distribution function to the first distribution function in step 506. When the entity sends the other event, the first distribution function entity may associate the control plane information in the packet header event, the user plane information in the packet header event packet header event, and the other event according to the association information or other preset rules. Form a complete monitoring related information IRI.

510. The first distribution function entity sends a packet data header event to the law enforcement interception device.

Accordingly, the law enforcement interception device receives the packet data header event sent by the first distribution function.

Optionally, if the first distribution function entity forms the interception related information IRI in step 509, step 510 may also send the interception related information IRI to the law enforcement interception device for the first distribution function entity.

It should be noted that, in some possible implementation manners, the first interception activation message is further used to instruct the control plane entity to listen to the packet data header event and the communication content. Accordingly, the monitoring management information is also used to activate the data backup function of the user plane entity. After receiving the monitoring management information of the control plane entity, the user plane entity further includes: the user plane entity sends the communication content to the second sub-function entity, the communication content carries the association information, and the second distribution function entity sends the communication content to the law enforcement interception device, After step 510, the law enforcement interception device is further included to associate the IRI and the communication content according to the associated information or other preset rules.

In this embodiment, the user plane entity no longer sends the user plane information in the packet data header event to the control plane entity, which reduces the interface burden between the user plane entity and the control plane entity, and in this embodiment, the law enforcement interception device Less changes.

FIG. 3 is a schematic diagram of a possible network architecture provided by the present application. The network architecture shown in FIG. 3 mainly includes the following network elements:

The user plane entity is mainly used for data forwarding and accepts the management of the control plane entity. In the embodiment of the present application, the user plane entity does not send the user plane information in the packet data header event of the lawful interception to the control plane entity, but sends the information to the first distribution function entity, and the user plane entity may also be the second distribution function. The entity provides the communication content of the monitored target, such as the content of the data portion of the data packet. The user plane entity and the first distribution function entity are connected through an X4 interface.

The first distribution function entity, the first distribution function entity is the DF2 in FIG. 3, and is mainly used to distribute the lawful interception related information. In the embodiment of the present application, the first distribution function entity receives the packet data header event sent by the control plane entity. Control plane information, and user plane information in the packet header event sent by the user plane entity. The first distribution function entity and the user plane entity are connected through an X4 interface.

The second distribution function entity, the second distribution function entity is DF3 in FIG. 3, and is mainly used for distributing communication content.

Referring to FIG. 6, the embodiment shown in FIG. 6 uses FIG. 3 as a network architecture. Another possible data processing method in this embodiment of the present application includes:

601. The law enforcement interception device sends a fourth monitoring activation message to the management function entity.

Step 601 is similar to step 501 of FIG. 5 and will not be described again.

602. The management function entity sends a third interception activation message to the first distribution function entity.

Step 602 is similar to step 502 of FIG. 5 and will not be described again.

603. The management function entity sends a second interception activation message to the second distribution function entity.

Correspondingly, the second distribution function entity receives the second monitoring activation message sent by the management function entity. The second snoop activation message is used to activate the snooping function of the second distribution function entity.

604. The management function entity sends a first interception activation message to the control plane entity.

Step 604 is similar to step 504 of FIG. 5 and will not be described again.

605. The control plane entity sends the monitoring management information to the user plane entity.

Step 605 is similar to step 505 of FIG. 5 and will not be described again.

606. The control plane entity sends control plane information in the packet data header event to the first distribution function entity.

Step 606 is similar to step 506 of FIG. 5 and will not be described again.

607. The user plane entity sends the user plane information in the packet data header event to the first distribution function entity.

Correspondingly, the first distribution function entity receives the user plane information in the packet data header event sent by the user plane entity. The data transmission may be performed by adding an X4 interface between the first distribution function entity and the user plane entity.

Optionally, there is no order of execution between the steps 606 and 607. In some possible implementations, the execution may also be performed in other orders.

608. The first distribution function associates control plane information in the data header event with user plane information in the packet header event.

Step 608 is similar to step 509 of FIG. 5 and will not be described again.

609. The first distribution function sends a packet data header event to the law enforcement interception device.

Step 609 is similar to step 510 of FIG. 5 and will not be described again.

It should be noted that, in some possible implementation manners, the first interception activation message is further used to indicate that the control plane entity also listens to the packet data header event and the communication content. Accordingly, the monitoring management information is also used to activate the data backup function of the user plane entity. After receiving the monitoring management information of the control plane entity, the user plane entity further includes: the user plane entity sends the communication content to the second sub-function entity, the communication content carries the association information, and the second distribution function entity sends the communication content to the law enforcement interception device, Then, after step 609, the law enforcement interception device further associates the IRI and the communication content according to the associated information.

In this embodiment, the user plane entity does not send the user plane information in the packet header event to the control plane entity, which reduces the interface burden between the user plane entity and the control plane entity, and does not require the second distribution in this embodiment. The function entity forwards the user plane information in the packet data header event to the first distribution function entity, and directly sends the user plane information in the packet data header event to the first distribution function by the user plane entity, thereby reducing signaling interaction.

The foregoing describes the solution of the embodiment of the present application mainly from the perspective of interaction between the network elements. It can be understood that each network element, such as a user plane entity, a control plane entity, a law enforcement interception device, a first distribution function entity, a second distribution function entity, etc., in order to implement the above functions, includes a hardware structure corresponding to performing each function and / or software module. Those skilled in the art will readily appreciate that the present application can be implemented in a combination of hardware or hardware and computer software in combination with the elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present application.

The embodiment of the present application may perform a function module division on a user plane entity, a control plane entity, a law enforcement interception device, a first distribution function entity or a second distribution function entity according to the foregoing method example. For example, each function module may be divided according to each function. It is also possible to integrate two or more functions into one processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of the module in the embodiment of the present application is schematic, and is only a logical function division, and the actual implementation may have another division manner.

FIG. 7A shows a possible structural diagram of the user plane entity involved in the above embodiment. The user plane entity 700 includes a processing module 702 and a communication module 703. The processing module 702 is configured to perform control management on the actions of the user plane entity, for example, the processing module 702 is configured to support the user plane entity to perform the process performed by the user plane entity in FIG. 4 to FIG. 6, and/or used in the description herein. Other processes of technology. The communication module 703 is configured to support communication between the user plane entity and the control plane entity, the second distribution function entity, or the first distribution function entity. The user plane entity may further include a storage module 701 for storing program code and data of the user plane entity.

The processing module 702 can be a processor or a controller, for example, a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application-specific integrated circuit (Application-Specific). Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure. The processor may also be a combination of computing functions, for example including one or more microprocessors Combination, combination of DSP and microprocessor, etc. The communication module 703 can be a communication interface, a transceiver, a transceiver circuit, etc., wherein the communication interface is a collective name and can include one or more interfaces, such as an interface between a user plane entity and a control plane entity, a user plane entity, and a second distribution. Interfaces between functional entities, etc. The storage module 701 can be a memory.

When the processing module 702 is a processor, the communication module 703 is a communication interface, and the storage module 701 is a memory, the user plane entity involved in the embodiment of the present application may be the user plane entity shown in FIG. 7B.

Referring to FIG. 7B, the user plane entity 710 includes a processor 712, a communication interface 713, and a memory 711. Optionally, the user plane entity 710 may further include a bus 714. The communication interface 713, the processor 712, and the memory 711 may be connected to each other through a bus 714. The bus 714 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (abbreviated). EISA) bus and so on. The bus 714 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 7B, but it does not mean that there is only one bus or one type of bus.

FIG. 8A shows a possible structural diagram of the control plane entity involved in the above embodiment. The control plane entity 800 includes a processing module 802 and a communication module 803. The processing module 802 is configured to control and manage the actions of the control plane entity, for example, the processing module 802 is configured to support the control plane entity to perform the process performed by the control plane entity in FIGS. 4-6, and/or for the techniques described herein Other processes. The communication module 803 is configured to support communication between the control plane entity and the user plane entity, the first distribution function entity, or the management function entity. The control plane entity may also include a storage module 801 for storing program code and data of the control plane entity.

The processing module 802 can be a processor or a controller, such as a CPU, a general purpose processor, a DSP, an ASIC, an FPGA, or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure. The processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like. The communication module 803 can be a communication interface, a transceiver, a transceiver circuit, etc., wherein the communication interface is a collective name and can include one or more interfaces, such as an interface between a control plane entity and a user plane entity, a control plane entity and a first distribution. Interfaces between functional entities, etc. The storage module 801 can be a memory.

When the processing module 802 is a processor, the communication module 803 is a communication interface, and the storage module 801 is a memory, the control plane entity involved in the embodiment of the present application may be the control plane entity shown in FIG. 8B.

Referring to FIG. 8B, the control plane entity 810 includes a processor 812, a communication interface 813, and a memory 811. Optionally, the control plane entity 810 can also include a bus 814. The communication interface 813, the processor 812, and the memory 811 may be connected to each other through a bus 814; the bus 814 may be a PCI bus or an EISA bus or the like. The bus 814 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 8B, but it does not mean that there is only one bus or one type of bus.

FIG. 9A is a schematic diagram showing a possible structure of the law enforcement listening device involved in the above embodiment. The law enforcement interception device 900 includes a processing module 902 and a communication module 903. The processing module 902 is configured to control and manage the actions of the law enforcement interception device, for example, the processing module 902 is configured to support the law enforcement interception device to perform the processes performed by the law enforcement listening device of FIGS. 4-6, and/or for the techniques described herein. Other processes. The communication module 903 is configured to support communication between the law enforcement interception device and the second distribution function entity, the first distribution function entity, or the management function entity. Law enforcement monitoring equipment A storage module 901 can also be included for storing program code and data of the law enforcement listening device.

The processing module 902 can be a processor or a controller, such as a CPU, a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure. The processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like. The communication module 903 can be a communication interface, a transceiver, a transceiver circuit, etc., wherein the communication interface is a collective name, and can include one or more interfaces, such as an interface between the law enforcement interception device and the user plane entity, the law enforcement interception device and the first distribution. Interfaces between functional entities, etc. The storage module 901 can be a memory.

When the processing module 902 is a processor, the communication module 903 is a communication interface, and the storage module 901 is a memory, the law enforcement monitoring device involved in the embodiment of the present application may be the law enforcement listening device shown in FIG. 9B.

Referring to FIG. 9B, the law enforcement interception device 910 includes a processor 912, a communication interface 913, and a memory 911. Alternatively, the law enforcement interception device 910 can also include a bus 914. The communication interface 913, the processor 912, and the memory 911 may be connected to each other through a bus 914; the bus 914 may be a PCI bus or an EISA bus or the like. The bus 914 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 9B, but it does not mean that there is only one bus or one type of bus.

FIG. 10A is a schematic diagram showing a possible structure of the first distribution function entity involved in the above embodiment. The first distribution function entity 1000 includes a processing module 1002 and a communication module 1003. The processing module 1002 is configured to control and manage the actions of the first distribution function entity. For example, the processing module 1002 is configured to support the first distribution function entity to perform the process performed by the first distribution function entity in FIG. 4 to FIG. 6, and/or Other processes of the techniques described herein. The communication module 1003 is configured to support communication between the first distribution function entity and the second distribution function entity, the control plane entity, the user plane entity, the law enforcement interception device, or the management function entity. The first distribution function entity may further include a storage module 1001 for storing program codes and data of the first distribution function entity.

The processing module 1002 may be a processor or a controller, such as a CPU, a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure. The processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like. The communication module 1003 may be a communication interface, a transceiver, a transceiver circuit, etc., wherein the communication interface is a collective name, and may include one or more interfaces, such as an interface between the first distribution function entity and the control plane entity, and the first distribution function entity Interfaces with user plane entities, etc. The storage module 1001 may be a memory.

When the processing module 1002 is a processor, the communication module 1003 is a communication interface, and the storage module 1001 is a memory, the first distribution function entity involved in the embodiment of the present application may be the first distribution function entity shown in FIG. 10B.

Referring to FIG. 10B, the first distribution function entity 1010 includes a processor 1012, a communication interface 1013, and a memory 1011. Optionally, the first distribution function entity 1010 may further include a bus 1014. The communication interface 1013, the processor 1012, and the memory 1011 may be connected to each other through a bus 1014; the bus 1014 may be a PCI bus or an EISA bus or the like. The bus 1014 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 10B, but it does not mean that there is only one bus or one type of bus.

FIG. 11A is a schematic diagram showing a possible structure of a second distribution function entity involved in the above embodiment. First The second distribution function entity 1100 includes a processing module 1102 and a communication module 1103. The processing module 1102 is configured to control and manage the actions of the second distribution function entity. For example, the processing module 1102 is configured to support the second distribution function entity to perform the process performed by the second distribution function entity in FIG. 4 to FIG. 6, and/or Other processes of the techniques described herein. The communication module 1103 is configured to support communication between the second distribution function entity and the first distribution function entity, the user plane entity, the law enforcement interception device, or the management function entity. The second distribution function entity may further include a storage module 1101 for storing program codes and data of the second distribution function entity.

The processing module 1102 can be a processor or a controller, such as a CPU, a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure. The processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like. The communication module 1103 can be a communication interface, a transceiver, a transceiver circuit, etc., wherein the communication interface is a collective name, and can include one or more interfaces, such as an interface between the second distribution function entity and the control plane entity, and the second distribution function entity Interfaces with user plane entities, etc. The storage module 1101 can be a memory.

When the processing module 1102 is a processor, the communication module 1103 is a communication interface, and the storage module 1101 is a memory, the second distribution function entity involved in the embodiment of the present application may be the second distribution function entity shown in FIG. 11B.

Referring to FIG. 11B, the second distribution function entity 1110 includes a processor 1112, a communication interface 1113, and a memory 1111. Optionally, the second distribution function entity 1110 may further include a bus 1114. The communication interface 1113, the processor 1112, and the memory 1111 may be connected to each other through a bus 1114; the bus 1114 may be a PCI bus or an EISA bus or the like. The bus 1114 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 11B, but it does not mean that there is only one bus or one type of bus.

Similarly, the management function entity involved in the embodiment of the present application may also have a structure similar to that of FIG. 7A or FIG. 7B, and may perform the behavior of the management function entity involved in the foregoing method example. For details, refer to FIG. 7A or FIG. 7B. The detailed introduction is not repeated here.

The steps of the method or algorithm described in connection with the disclosure of the embodiments of the present application may be implemented in a hardware manner, or may be implemented by a processor executing software instructions. The software instructions may be composed of corresponding software modules, which may be stored in a random access memory (RAM), a flash memory, a read only memory (ROM), an erasable programmable read only memory ( Erasable Programmable ROM (EPROM), electrically erasable programmable read only memory (EEPROM), registers, hard disk, removable hard disk, compact disk read only (CD-ROM) or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor to enable the processor to read information from, and write information to, the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and the storage medium can be located in an ASIC. Additionally, the ASIC can be located in a user plane entity, a control plane entity, a first distribution function entity, a second distribution function entity, or a law enforcement listening device. Of course, the processor and the storage medium may also exist as discrete components in the user plane entity, the control plane entity, the first distribution function entity, the second distribution function entity, or the law enforcement interception device.

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented in software, it may be implemented in whole or in part in the form of a computer program product.

The computer program product includes one or more computer instructions. Loading and executing the computer on a computer The program or function described in the embodiment of the present application is generated in whole or in part when the program is instructed. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.). The computer readable storage medium can be any available media that can be stored by a computer or a data storage device such as a server, data center, or the like that includes one or more available media. The usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a solid state disk (SSD)).

Claims

A data processing method for lawful interception, comprising:

The user plane entity receives the interception management information sent by the control plane entity, where the interception management information includes destination address information of the user plane information in the packet data header event for legal interception;

The control plane entity generates control plane information in the packet data header event according to a context;

Transmitting, by the control plane entity, control plane information in the packet data header event to the first distribution function entity;

The user plane entity sends the user plane information in the packet data header event to the second distribution function entity according to the destination address information.
The data processing method according to claim 1, wherein the monitoring management information further comprises associated information.
The data processing method according to claim 2, wherein the association information comprises a correlation identifier or a correlation coefficient or a sequence.
The data processing method according to claim 2 or 3, wherein the user plane information in the packet header event and the control plane information in the packet header event carry the association information, and the association information is used for association User plane information in the packet data header event and control plane information in the packet header event.
The data processing method according to claim 4, further comprising: after the second distribution function entity receives the user plane information in the packet header event sent by the user plane entity, further comprising:

Transmitting, by the second distribution function entity, user plane information in the packet data header event to the law enforcement interception device;

After the first distribution function entity receives the control plane information in the packet data header event sent by the control plane entity, the method further includes:

Transmitting, by the first distribution function entity, control plane information in the packet data header event to the law enforcement interception device;

The law enforcement intercepting device associates user plane information in the packet data header event with control plane information in the packet data header event according to the association information.
The data processing method according to claim 4, further comprising: after the second distribution function entity receives the user plane information in the packet data header event, further comprising:

Transmitting, by the second distribution function entity, user plane information in the packet data header event to the first distribution function entity;

The first distribution function entity associates user plane information in the packet data header event with control plane information in the packet header event according to the association information.
The data processing method according to claim 5 or 6, wherein before the control plane entity sends the interception management information to the user plane entity,

The control plane entity receives a first interception activation message sent by the management function entity, where the first interception activation message is used to instruct the control plane entity to listen to the packet data header event.
The data processing method according to claim 5 or 6, wherein before the control plane entity sends the interception management information to the user plane entity,

Receiving, by the second distribution function entity, a second monitoring activation message sent by the management function entity, where the second monitoring The listening activation message is used to instruct the second distribution function entity to forward user plane information in the packet data header event sent by the user plane entity.
The data processing method according to claim 5 or 6, wherein before the control plane entity sends the interception management information to the user plane entity,

Receiving, by the first distribution function entity, a third interception activation message sent by the management function entity, where the third interception activation message is used to instruct the first distribution function entity to associate user plane information in the packet data header event And control plane information in the packet header event.
The data processing method according to any one of claims 1 to 9, wherein the first interception activation message is specifically configured to instruct the control plane entity to listen to the packet data header event and communication content. After receiving the monitoring management information sent by the control plane entity, the user plane entity further includes:

The user plane entity sends the communication content to the second distribution function entity.
A communication system, characterized in that the system comprises a user plane entity and a control plane entity, the user plane entity being used for:

Receiving, by the control plane entity, the interception management information, where the interception management information includes destination address information of the user plane information in the packet data header event for legal interception;

Transmitting user plane information in the packet data header event to the second distribution function entity according to the destination address information;

The control plane entity is used to:

Generating control plane information in the packet data header event according to a context;

The control plane information in the packet header event is sent to the first distribution function entity.
The communication system according to claim 11, wherein said monitoring management information further comprises associated information.
The communication system of claim 12, the associated information comprising a correlation identification or correlation coefficient or sequence.
The communication system according to claim 12 or 13, wherein the user plane information in the packet header event and the control plane information in the packet header event carry the association information, the association information Used to associate user plane information in the packet header event and control plane information in the packet header event.
The communication system according to claim 14, wherein said communication system further comprises said second distribution function entity and said first distribution function entity and law enforcement interception device, said second distribution function entity being:

Transmitting user plane information in the packet data header event to the law enforcement interception device;

The first distribution function entity is used to:

Sending control plane information in the packet data header event to the law enforcement interception device;

The law enforcement interception device is used to:

User plane information in the packet header event and control plane information in the packet header event are associated according to the association information.
The communication system according to claim 14, wherein said communication system further comprises said second distribution function entity and said first distribution function entity, said second distribution function being:

Transmitting user plane information in the packet data header event to the first distribution function entity;

The first distribution function entity is used to:

User plane information in the packet header event and control plane information in the packet header event are associated according to the association information.
The communication system according to claim 15 or 16, wherein the control plane entity is further configured to:

And receiving, by the management function entity, a first interception activation message, where the first interception activation message is used to instruct the control plane entity to listen to the packet data header event.
The communication system according to claim 15 or 16, wherein the second distribution function entity is further configured to:

Receiving a second interception activation message sent by the management function entity, where the second interception activation message is used to instruct the second distribution function entity to forward user plane information in the packet data header event sent by the user plane entity .
The communication system according to claim 15 or 16, wherein the first distribution function entity is further configured to:

Receiving a third interception activation message sent by the management function entity, where the third interception activation message is used to instruct the first distribution function entity to associate user plane information and the packet data header event in the packet data header event Control surface information in .
The communication system according to any one of claims 10 to 19, wherein the first interception activation message is specifically configured to instruct the control plane entity to listen to the packet data header event and communication content, the user Face entities are also used to:

Transmitting the communication content to the second distribution function entity.
A computer readable storage medium comprising instructions which, when executed on a computer, cause the computer to perform the method of claims 1-10.