WO2025201639A1

WO2025201639A1 - Lawful interception task handling

Info

Publication number: WO2025201639A1
Application number: PCT/EP2024/058314
Authority: WO
Inventors: Daniele GAITO; Gianluca GAMBARI; Daniela SCARANO; Gennaro Falanga; Michele Farina; Monica IMBO; Rossano RIGIONE PISONE; Amedeo Imbimbo
Original assignee: Telefonaktiebolaget LM Ericsson AB
Current assignee: Telefonaktiebolaget LM Ericsson AB
Priority date: 2024-03-27
Filing date: 2024-03-27
Publication date: 2025-10-02
Anticipated expiration: 2026-09-27

Abstract

A first Lawful Interception, LI, Administrative Function, ADMF, communication device (202), a first Network Element, NE, communication device (203), and methods are disclosed The first LI ADMF communication device is configured to: store a first status (410) of an LI task; send a task request message (420), to a first NE communication device, to perform an action associated with the LI task, the task request message comprising a first indication (510) to notify about a change of the status; receive a task response message (430), from the first NE communication device, the task response message comprising a result (610) associated with the task request message; receive, from the first NE communication device, if the status has changed, a report request message (440) comprising a second status (710) of the LI task; compare the received second status to the stored first status; perform an action (450) based on the comparison; and send, to the first NE communication device, a report response message (460).

Description

LAWFUL INTERCEPTION TASK HANDLING

TECHNICAL FIELD

The invention relates to a first lawful interception administrative function communication device for lawful interception task handling, a first network communication device for lawful interception task handling, corresponding methods, corresponding computer programs and a corresponding computer readable storage medium, a second lawful interception administrative function communication device for audit and synchronization of lawful interception tasks, a second network element communication device for audit and synchronization of lawful interception tasks, corresponding methods, corresponding computer programs and a computer readable storage medium.

BACKGROUND

Figure 1 shows an exemplary Lawful Interception, LI, network and system according to document ETSI TS 103 221-1 V1.16.1.

The exemplary LI system comprises a Lawful Enforcement Agency, LEA, network and a Communications Service Provider, CSP, network. LEA 101 is an organization authorized by a lawful authorization based on the applicable jurisdiction to request and receive the results of telecommunications interceptions of an interception target. The target is a person of interest and/or user equipment possessed or used by the person of interest being surveyed by the LEA 101. Said LEA 101 communications with the CSP network through a network interface, called Handover Interface, HI.

An LI Administrative Function, ADMF, communication device 102 generates, based on said received intercept request, a warrant comprising one or more interception target identities, and sends the warrant to an Element of LI, ELI, in the form of a Point Of Interception, POI, within a Network Element communication device 103 via an interface X1 . The NE communication device 103 is an entity that performs the interception. Said POI detects the interception target communication, derives the IRI or CC from the target communications, and delivers the POI Output to a mediation and delivery function device. The mediation and delivery function device receives the POI Outputs and transforms them from internal interface format to Handover Interface format, and then will handle dispatching of said transformed POI Outputs to the LEA 101 .

The LI ADMF communication device 102 and the NE communication device 103 exchange message between them on the X1 interface.

According to ETSI TS 103 221 -1 V1 .16.1 ., a target is handled with a request message sent from the LI ADMF communication 102 to the NE communication device 103 as a Task (e.g., ActivateTask, ModifyTask, DeactivateTask) on the X1 interface. The NE communication device 103 sends, in response, to the LI ADMF communication device 102 a corresponding response message.

A reporting issue message from the NE communication device 103 to the LI ADMF communication device 102 is sent on X1 Report Issue Interface at a particular destination manually provided at NE configuration.

Further, an Audit and Synchronisation Function is required to ensure integrity of warrant provisioning within the LI system. The Audit and Synchronization Function aims to guarantee that: all warrants activated by LI ADMF communication device 102 are active within the LI system on NE communication device 103 and no unauthorized warrant is active in the NE communication device 103.

Audit and Synchronization is performed at a specific time during the night, where the LI ADMF communication device 102 sends a request message to the NE communication device 103 to retrieve information related to Task and/or Destination. Destination is the address where the NE communication device 103 delivers the IRI or CC. Once the information received from the NE communication device 103, the LI ADMF communication device 102 compares the received information with the data at its disposal and verifies congruence of Tasks and/or Destination.

The request message may be GetAIIDetails, or GetAIITaskDetails as defined, for example, in ETSI TS 103 221 -1 V1 .16.1 . A disadvantage of the prior art is that Task handling message and reporting issue message are handled by different services on different IP address and Ports both on the NE communication device 103, and on the LI ADMF communication device 102.

A further disadvantage of the prior art is that the message requesting the Task requires computation power to be handled by both the NE communication device 103 and the LI ADMF communication device 102. Further, a large amount of data could be provided within the response. Indeed, the audit and synchronization procedure requires computational resource, time and memory, both on the NE communication device 103 for generating the response message, and on the LI ADMF communication device 102 to compare the received information.

A further disadvantage of the prior art is that the audit and synchronization procedure is usually performed at night, as it requires computational resources, time and memory. Thus, performing the audit and synchronization procedure at a predictable time (e.g., at night) increases the possibility of security attacks that can be carried out between consecutive audit and synchronization events.

SUMMARY

An object of the invention is to improve security of lawful interception.

In a first aspect of the invention, a first Lawful Interception (LI) Administrative Function (ADMF) communication device for LI task handling is provided. The first LI ADMF communication device is configured to store a first status of an LI task; send a task request message, to a first Network Element (NE) communication device, to perform an action associated with the LI task. The task request message comprises a first indication to notify about a change of the status of the LI task. The first LI ADMF communication device is configured to receive a task response message, from the first NE communication device, the task response comprises a result associated with the task request message; receive, from the first NE communication device, if the status of the LI task has changed, a report request message comprising a second status of the LI task; compare the received second status to the stored first status; perform an action based on the comparison; and send, to the first NE communication device, a report response message. Hereby is achieved that the task status, the last modification time value, and/or the task sequence number enable to provide information regarding the status of an LI task, the last modification time of the status of the LI task, and a task sequence number associated with the LI task. Thus, the LI ADMF communication device is able to request information on LI tasks based on their task status, on the last modification time of their status, and/or on their task sequence number. Thus, the present invention enables to use less computational resources, time, and/or memory at the NE communication device and/or at the LI ADMF communication device.

In an embodiment of the first aspect, the first LI ADMF communication device is configured to generate a task sequence number associated to the LI task; and store the task sequence number.

In an embodiment of the first aspect, the task request message comprises the task sequence number associated to the LI task.

In an embodiment of the first aspect, the report request message comprises the task sequence number.

In an embodiment of the first aspect, the task response message comprises information representative of any one of the following: an OK - Acknowledged and Completed, if the LI task is fully understood, compliant and has been successfully completed; an OK - Acknowledged, if the LI task cannot be completed within a time interval predetermined at the first NE communication device and at the first LI ADMF communication device; and a predetermined protocol error if the first NE communication device is unable to perform or understand the LI task.

In an embodiment of the first aspect, the task request message is an ActivateTaskRequest message, a ModifyTaskRequest message, or a DeactivateTaskRequest. In an embodiment of the first aspect, the task request message comprises the fields of ActivateTaskRequest and an InfoOnTaskChange field, the InfoOnTaskChange comprises the first indication to notify about the change of the status of the LI task.

In an embodiment of the first aspect, the task request message comprises a field TaskSequenceNumber, the TaskSequenceNumber comprises the task sequence number.

In an embodiment of the first aspect, the task response message is an ActivateTaskResponse message to the ActivateTaskRequest message.

In an embodiment of the first aspect, the task request message comprises the fields of ModifyTaskRequest message and an InfoOnTaskChange field, the InfoOnTaskChange comprises the first indication to notify about the change of the status of the LI task.

In an embodiment of the first aspect, the task response message is a ModifyTaskResponse message to the ModifyTaskRequest message.

In an embodiment of the first aspect, the task request message comprises the fields of DeactivateTaskRequest message and an InfoOnTaskChange filed, the InfoOnTaskChange comprises the first indication to notify about the change of the status of the LI task.

In an embodiment of the first aspect, the task response message is a DeactivateTaskResponse message to the DeactivateTaskRequest message. In an embodiment of the first aspect, the report request message is a report issue request sent from the first NE communication device to the first LI ADMF communication device after the first NE communication device has identified that the status of the LI task has changed.

In a second aspect of the invention, a first network element (NE) for lawful interception (LI) task handling is provided. The first NE communication device is configured to: receive a task request message, from a first LI ADMF communication device, to perform an action associated with an LI task. The task request message comprises a first indication to notify about a change of status of the LI task. The first NE communication device is configured to store a second status of the LI task based on the task request message; send a task response message, to the first LI ADMF communication device, the task response message comprises a result associated with the task request message; send, to the first LI ADMF communication device, if the status of the LI task has changed, a report request message comprising the second status of the LI task; and receive, from the first LI ADMF communication device, a report response message.

In an embodiment of the second aspect, the task request message comprises a task sequence number associated to the LI task.

In an embodiment of the second aspect, the task response message comprises information representative of any one of the following: an OK - Acknowledged and Completed, if the LI task is fully understood, compliant and has been successfully completed; an OK - Acknowledged, if the LI task cannot be completed within a time interval predetermined at the first NE communication device and at the first LI ADMF communication device; and a predetermined protocol error if the first NE communication device is unable to perform or understand the LI task.

In an embodiment of the second aspect, the task request message is an ActivateTaskRequest message, a ModifyTaskRequest message, or a DeactivateTaskRequest. In an embodiment of the second aspect, the task response message is an ActivateTaskResponse message to the ActivateTaskRequest message.

In an embodiment of the second aspect, the task request comprises the fields of ActivateTaskRequest message and an InfoOnTaskChange filed, the InfoOnTaskChange comprises the first indication to notify about the change of the status of the LI task.

In an embodiment of the second aspect, the task request message comprises a field TaskSequenceNumber, the TaskSequenceNumber comprises the task sequence number.

In an embodiment of the second aspect, the task response message is a ModifyTaskResponse message to the ModifyTaskRequest message.

In an embodiment of the second aspect, the task request comprises the fields of ModifyTaskRequest message and an InfoOnTaskChange filed, the InfoOnTaskChange comprises the first indication to notify about the change of the status of the LI task.

In an embodiment of the second aspect, the task response message is a DeactivateTaskResponse message to the DeactivateTaskRequest message.

In an embodiment of the second aspect, the task request comprises the fields of DeactivateTaskRequest message and an InfoOnTaskChange filed, the InfoOnTaskChange comprises the first indication to notify about the change of the status of the LI task. In an embodiment of the second aspect, the task request message comprises a field TaskSequenceNumber, the TaskSequenceNumber comprises the task sequence number.

In an embodiment of the second aspect, the report message is a report issue request sent from the first NE communication device to the first LI ADMF communication device after the first NE communication device has identified that the status of the LI task has changed.

In a third aspect of the invention, a method performed by a first Lawful Interception (LI) Administrative Function (ADMF) communication device for LI task handling, is provided. The method comprises storing a first status of an LI task; sending a task request message, to a first Network Element (NE) communication device, to perform an action associated with the LI task. The task request message comprises a first indication to notify about a change of the status of the LI task. The method further comprises receiving a task response message, from the first NE communication device, the task response comprises a result associated with the task request message; receiving, from the first NE communication device, if the status of the LI task has changed, a report request message comprising a second status of the LI task; comparing the received second status to the stored first status; performing an action based on the comparison; and sending, to the first NE communication device, a report response message.

In an embodiment of the third aspect, the method comprises generating a task sequence number associated to the LI task; and storing the task sequence number.

In an embodiment of the third aspect, the task request message comprises the task sequence number associated to the LI task.

In an embodiment of the third aspect, the report request message comprises the task sequence number.

In an embodiment of the third aspect, the task response message comprises information representative of any one of the following: an OK - Acknowledged and Completed, if the LI task is fully understood, compliant and has been successfully completed; an OK - Acknowledged, if the LI task cannot be completed within a time interval predetermined at the first NE communication device and at the first LI ADMF communication device; and a predetermined protocol error if the first NE communication device 203 is unable to perform or understand the LI task.

In an embodiment of the third aspect, the task request message is an ActivateTaskRequest message, a ModifyTaskRequest message, or a DeactivateTaskRequest.

In an embodiment of the third aspect, the task request message comprises the fields of ActivateTaskRequest and an InfoOnTaskChange field, the InfoOnTaskChange comprises the first indication to notify about the change of the status of the LI task.

In an embodiment of the third aspect, the task request message comprises a field TaskSequenceNumber, the TaskSequenceNumber comprises the task sequence number.

In an embodiment of the third aspect, the task response message is an ActivateTaskResponse message to the ActivateTaskRequest message.

In an embodiment of the third aspect, the task request message comprises the fields of ModifyTaskRequest message and an InfoOnTaskChange field, the InfoOnTaskChange comprises the first indication to notify about the change of the status of the LI task.

In an embodiment of the third aspect, the task response message is a ModifyTaskResponse message to the ModifyTaskRequest message. In an embodiment of the third aspect, the task request message comprises the fields of DeactivateTaskRequest message and an InfoOnTaskChange filed, the InfoOnTaskChange comprises the first indication to notify about the change of the status of the LI task.

In an embodiment of the third aspect, the task response message is a DeactivateTaskResponse message to the DeactivateTaskRequest message.

In an embodiment of the third aspect, the report request message is a report issue request sent from the first NE communication device to the first LI ADMF communication device after the first NE communication device has identified that the status of the LI task has changed.

In a fourth aspect of the invention, a method performed by a first network element (NE) for lawful interception (LI) task handling, is provided. The method comprises receiving a task request message, from a first LI Administrative Function (ADMF) communication device, to perform an action associated with an LI task. The task request message comprises a first indication to notify about a change of status of the LI task. The method further comprises storing a second status of the LI task based on the task request message; sending a task response message, to the first LI ADMF communication device, the task response message comprises a result associated with the task request message; sending, to the first LI ADMF communication device, if the status of the LI task has changed, a report request message comprising the second status of the LI task; and receiving, from the first LI ADMF communication device, a report response message.

In an embodiment of the fourth aspect, the task request message comprises a task sequence number associated to the LI task. In an embodiment of the fourth aspect, the task response message comprises information representative of any one of the following: an OK - Acknowledged and Completed, if the LI task is fully understood, compliant and has been successfully completed; an OK - Acknowledged, if the LI task cannot be completed within a time interval predetermined at the first NE communication device and at the first LI ADMF communication device; and a predetermined protocol error if the first NE communication device is unable to perform or understand the LI task.

In an embodiment of the fourth aspect, the task request message is an ActivateTaskRequest message, a ModifyTaskRequest message, or a DeactivateTaskRequest.

In an embodiment of the fourth aspect, the task response message is an ActivateTaskResponse message to the ActivateTaskRequest message.

In an embodiment of the fourth aspect, the task request comprises the fields of ActivateTaskRequest message and an InfoOnTaskChange filed, the InfoOnTaskChange comprises the first indication to notify about the change of the status of the LI task.

In an embodiment of the fourth aspect, the task request message comprises a field TaskSequenceNumber, the TaskSequenceNumber comprises the task sequence number.

In an embodiment of the fourth aspect, the task response message is a ModifyTaskResponse message to the ModifyTaskRequest message.

In an embodiment of the fourth aspect, the task request comprises the fields of ModifyTaskRequest message and an InfoOnTaskChange filed, the InfoOnTaskChange comprises the first indication to notify about the change of the status of the LI task. In an embodiment of the fourth aspect, the task request message comprises a field TaskSequenceNumber, the TaskSequenceNumber comprises the task sequence number.

In an embodiment of the fourth aspect, the the task response message is a DeactivateTaskResponse message to the DeactivateTaskRequest message.

In an embodiment of the fourth aspect, the task request comprises the fields of DeactivateTaskRequest message and an InfoOnTaskChange filed, the InfoOnTaskChange comprises the first indication to notify about the change of the status of the LI task.

In an embodiment of the fourth aspect, the report message is a report issue request sent from the first NE communication device to the first LI ADMF communication device after the first NE communication device has identified that the status of the LI task has changed.

In a fifth aspect of the invention, a computer program is provided. The computer program comprises instructions, which when executed on a first lawful interception (LI) administrative function (ADMF) communication device, causes the first LI ADMF communication device to perform the method according to one or more embodiments of the third aspect of the invention.

In a sixth aspect of the invention, a computer program comprising instructions, which when executed on a first network element (NE) communication device, causes the first NE communication device to perform the method according to one or more embodiments of the fourth aspect of the invention. In a seventh aspect of the invention, a computer readable storage medium is provided. The computer readable storage medium comprises a computer program according to the fifth aspect of the invention and/or the sixth aspect of the invention.

In an eighth aspect of the invention, a second lawful interception (LI) Administrative Function (ADMF) device for audit and synchronization of LI tasks is provided. The second LI ADMF communication device is configured to: send an information request message, to a second Network Element, NE, communication device, to determine details related to one or more LI tasks. The information request message comprises a task status that the one or more LI tasks are to be in; a last modification time value; and/or a last task sequence number value. The second LI ADMF communication device is configured to receive, from the second NE communication device, an information response message that comprises one or more LI tasks that are in the requested state, that are modified after or at a time equal to the last modification time value, and/or that have a task sequence number greater or equal to the last sequence number value.

In an embodiment of the eighth aspect, the information request message is a GetAIIDetailsRequest message, or a GetAIITaskDetailsRequest message.

In an embodiment of the eighth aspect, the information request message comprises the fields of GetAIIDetailsRequest message and comprises one or more of: a Status field comprising the task status; a LastModificationTime field comprising the last modification time value; and a LastTaskSequenceNumber field comprising the last task sequence number value.

In an embodiment of the eighth aspect, the information response message is a GetAIIDetailsResponse message to the GetAIIDetailsRequest message.

In an embodiment of the eighth aspect, the information request message comprises the fields of GetAIITaskDetailsRequest message and comprises one or more of: a Status field comprising the status; a LastModificationTime field comprising the last modification time value; and a LastTaskSequenceNumber field comprising the last task sequence number value. In an embodiment of the eighth aspect, the information response message is a GetAIITaskDetailsResponse message to the GetAIITaskDetailsRequest message.

In an embodiment of the eighth aspect, the second LI ADMF communication device is configured to: send a second information request message, to the second NE communication device, to retrieve a list of LI tasks. The second information request message comprises: a second indication on whether to indicate a last modification time value of the LI tasks; a third indication on whether to indicate a status of the LI tasks; a fourth indication on whether to indicate a task sequence number of the LI tasks; and/or a fifth indication on whether to report deactivated tasks. The second LI ADMF communication device is further configured to receive, from the second NE communication device, a second information response message, the second information response message comprises a list of one or more LI tasks, for each of the LI tasks in the list, the last modification time value is indicated based to the second information request message, the status is indicated based on the second information request message, and/or the task sequence number is indicated based on the second information request message.

In an embodiment of the eighth aspect, the second information request message is a ListAIIDetailsRequest message.

In an embodiment of the eighth aspect, the second information response message is a ListAIIDetailsResponse message.

In a ninth aspect of the invention, a second Network Element (NE) communication device for audit and synchronization of Lawful Interception (LI) tasks, is provided. The second NE communication device is configured to: receive an information request message, from a second LI Administrative Function, ADMF, communication device, to determine details related to one or more LI tasks. The information request message comprises: a task status that the LI tasks are to be in; a last modification time value; and/or a last task sequence number value. The second NE communication device is further configured to send, to the second LI ADMF communication device, an information response message that comprises one or more LI tasks that are in the requested state, that are modified after or at a time equal to the last modification time value, and/or that have a task sequence number greater or equal to the last sequence number value.

In an embodiment of the ninth aspect, the information request message is a GetAIIDetailsRequest message, or a GetAIITaskDetailsRequest message.

In an embodiment of the ninth aspect, the information request message comprises the fields of GetAIIDetailsRequest message and comprises one or more of: a Status field comprising the task status; a LastModificationTime field comprising the last modification time value; and a LastTaskSequenceNumber field comprising the last task sequence number value.

In an embodiment of the ninth aspect, the information response message is a GetAIIDetailsResponse message to the GetAIIDetailsRequest message.

In an embodiment of the ninth aspect, the information request message comprises the fields of GetAIITaskDetailsRequest message and comprises one or more of: a Status field comprising the task status; a LastModificationTime field comprising the last modification time value; and a LastTaskSequenceNumber field comprising the last task sequence number value.

In an embodiment of the ninth aspect, the information response message is a GetAIITaskDetailsResponse message to the GetAIITaskDetailsRequest message.

In an embodiment of the ninth aspect, the second NE communication device is further configured to: receive a second information request message, from the second LI ADMF communication device, to retrieve a list of LI tasks. The second information request message comprises: a second indication whether to indicate a last modification time value of the LI tasks; a third indication whether to indicate a status of the LI tasks; a fourth indication whether to indicate a task sequence number of the LI tasks; and/or a fifth indicate whether to report deactivated tasks. The second NE communication device is further configured to send, to the second LI ADMF communication device, a second information response message, the second information response message comprises a list of one or more LI tasks, for each of the LI tasks in the list, the last modification time value is indicated based to the second information request message, the status is indicated based on the second information request message, and/or the task sequence number is indicated based on the second information request message.

In an embodiment of the ninth aspect, the second information request message is a ListAIIDetailsRequest message.

In an embodiment of the ninth aspect, the second information response message is a ListAIIDetailsResponse message.

In a tenth aspect of the invention, a method performed by a second lawful interception (LI) Administrative Function (ADMF) device, for audit and synchronization of LI tasks, is provided. The method comprises sending an information request message, to a second Network Element, NE, communication device, to determine details related to one or more LI tasks. The information request message comprises: a task status that the one or more LI tasks are to be in; a last modification time value; and/or a last task sequence number value. The method comprises receiving, from the second NE communication device, an information response message that comprises one or more LI tasks that are in the requested state, that are modified after or at a time equal to the last modification time value, and/or that have a task sequence number greater or equal to the last sequence number value.

In an embodiment of the tenth aspect, the information request message is a GetAIIDetailsRequest message, or a GetAIITaskDetailsRequest message.

In an embodiment of the tenth aspect, the information request message comprises the fields of GetAIIDetailsRequest message and comprises one or more of: a Status field comprising the task status; a LastModificationTime field comprising the last modification time value; and a LastTaskSequenceNumber field comprising the last task sequence number value. In an embodiment of the tenth aspect, the information response message is a GetAIIDetailsResponse message to the GetAIIDetailsRequest message.

In an embodiment of the tenth aspect, the information request message comprises the fields of GetAIITaskDetailsRequest message and comprises one or more of: a Status field comprising the status; a LastModificationTime field comprising the last modification time value; and a LastTaskSequenceNumber field comprising the last task sequence number value.

In an embodiment of the tenth aspect, the information response message is a GetAIITaskDetailsResponse message to the GetAIITaskDetailsRequest message.

In an embodiment of the tenth aspect, the method further comprises sending a second information request message, to the second NE communication device, to retrieve a list of LI tasks. The second information request message comprises: a second indication on whether to indicate a last modification time value of the LI tasks; a third indication on whether to indicate a status of the LI tasks; a fourth indication on whether to indicate a task sequence number of the LI tasks; and/or a fifth indication on whether to report deactivated tasks. The method further comprises receiving, from the second NE communication device, a second information response message, the second information response message comprises a list of one or more LI tasks, for each of the LI tasks in the list, the last modification time value is indicated based to the second information request message, the status is indicated based on the second information request message, and/or the task sequence number is indicated based on the second information request message.

In an embodiment of the tenth aspect, the second information request message is a ListAIIDetailsRequest message.

In an embodiment of the tenth aspect, the second information response message is a ListAIIDetailsResponse message.

In an eleventh aspect of the invention, a method performed by a second Network Element (NE) communication device for audit and synchronization of Lawful Interception (LI) tasks, is provided. The method comprises receiving an information request message, from a second LI Administrative Function (ADMF) communication device, to determine details related to one or more LI tasks. The information request message comprises: a task status that the LI tasks are to be in; a last modification time value; and/or a last task sequence number value. The method further comprises sending, to the second LI ADMF communication device, an information response message that comprises one or more LI tasks that are in the requested state, that are modified after or at a time equal to the last modification time value, and/or that have a task sequence number greater or equal to the last sequence number value.

In an embodiment of the eleventh aspect, the information request message is a GetAIIDetailsRequest message, or a GetAIITaskDetailsRequest message.

In an embodiment of the eleventh aspect, the information request message comprises the fields of GetAIIDetailsRequest message and comprises one or more of: a Status field comprising the task status; a LastModificationTime field comprising the last modification time value; and a LastTaskSequenceNumber field comprising the last task sequence number value.

In an embodiment of the eleventh aspect, the information response message is a GetAIIDetailsResponse message to the GetAIIDetailsRequest message.

In an embodiment of the eleventh aspect, the information request message comprises the fields of GetAIITaskDetailsRequest message and comprises one or more of: a Status field comprising the task status; a LastModificationTime field comprising the last modification time value; and a LastTaskSequenceNumber field comprising the last task sequence number value.

In an embodiment of the eleventh aspect, the information response message is a GetAIITaskDetailsResponse message to the GetAIITaskDetailsRequest message.

In an embodiment of the eleventh aspect, the method further comprises: receiving a second information request message, from the second LI ADMF communication device, to retrieve a list of LI tasks. The second information request message comprises: a second indication whether to indicate a last modification time value of the LI tasks; a third indication whether to indicate a status of the LI tasks; a fourth indication whether to indicate a task sequence number of the LI tasks; and/or a fifth indication whether to report deactivated tasks. The method further comprises sending, to the second LI ADMF communication device, a second information response message, the second information response message comprises a list of one or more LI tasks, for each of the LI tasks in the list, the last modification time value is indicated based to the second information request message, the status is indicated based on the second information request message, and/or the task sequence number is indicated based on the second information request message.

In an embodiment of the eleventh aspect, the second information request message is a ListAIIDetailsRequest message.

In an embodiment of the eleventh aspect, the second information response message is a ListAIIDetailsResponse message.

In a twelfth aspect of the invention, a computer program is provided. The computer program comprises instructions, which when executed on a second lawful interception, LI, administrative function (ADMF) communication device, causes the second LI ADMF communication device to perform the method according to one or more embodiments of the tenth aspect of the invention.

In a thirteenth aspect of the invention, a computer program is provided. The computer program comprises instructions, which when executed on a second network element (NE) communication device, causes the second NE communication device to perform the method according to one or more embodiments of the eleventh aspect of the invention.

In a fourteenth aspect of the invention, a computer readable storage medium comprising a computer program according to the twelfth aspect of the invention and/or the thirteenth aspect of the invention. At least one or more embodiments advantageously enable to simplify the audit and synchronization procedure by decreasing the amount of information sent by the NE communication device to the LI ADMF communication device.

At least one or more embodiments advantageously enable to use less computational resources, time, and/or memory at the NE communication device and/or at the LI ADMF communication device.

At least one or more embodiments advantageously enable the LI ADMF communication device to filter the requested information from the NE communication device.

At least one or more embodiments advantageously enable to perform the audit and synchronization procedure at any time of the day.

At least one or more embodiments advantageously enable decrease the possibility of security attack among two audit and synchronization procedures.

At least one or more embodiments advantageously enable to discover unauthorized changes on LI tasks.

BRIEF DESCRIPTION OF THE DRAWINGS

The above, as well as additional object, features and advantages of the invention will be better understood through the following and non-limiting detailed description of embodiments of the invention, with reference to the appended drawings, in which:

Figure 1 shows an exemplary Lawful Interception, LI, network and system.

Figure 2 shows an LI network and system.

Figure 3 shows a flowchart illustrating an embodiment of a method for task handling. Figure 4 shows an embodiment of the method for task handling.

Figure 5 shows an embodiment of the task request message.

Figure 6 shows an embodiment of the task response message.

Figure 7 shows an embodiment of the report request message.

Figure 8 shows a flowchart illustrating an embodiment of a method for task handling.

Figure 9 shows a first LI ADMF communication device.

Figure 10 shows a first NE communication device.

Figure 11 shows an embodiment of the first LI ADMF communication device.

Figure 12 shows an embodiment of the first NE communication device.

Figure 13 shows an LI network and system.

Figure 14 shows a flowchart illustrating an embodiment of a method for audit and synchronization of LI tasks.

Figure 15 shows an embodiment of method for audit and synchronization of LI tasks.

Figure 16 shows an embodiment of the information response message.

Figure 17 shows an embodiment of the second information request message.

Figure 18 shows a flowchart illustrating an embodiment of a method for audit and synchronization of LI tasks.

Figure 19 shows a second LI ADMF communication device. Figure 20 shows a second NE communication device.

Figure 21 shows an embodiment of the second LI ADMF communication device.

Figure 22 shows an embodiment of the second NE communication device.

All figures are schematic, and generally show parts which are necessary in order to elucidate the invention, wherein other parts may be omitted or merely suggested.

DETAILED DESCRIPTION

The invention will now be described more fully herein with reference to the accompanying drawings, in which certain embodiments are shown. This invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided by way of example so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

State of the art LI system demands computational resource, time and memory for performing audit and synchronization procedure. Indeed, the message requesting the Task requires computation power to be handled by both the NE communication device and the LI ADMF communication device. Further, a large amount of data is provided within the response message. Indeed, the audit and synchronization procedure requires computational resource, time and memory, both on the NE communication device for generating the response message, and on the LI ADMF communication device to compare the received information.

To overcome this problem, the solution to be disclosed, in its embodiments, provides a task status, a last modification time value, and/or a task sequence number associated with each LI task.

The present invention in its embodiments allows to improve the security of lawful interception. Indeed, the task status, the last modification time value, and/or the task sequence number enable to provide information regarding the status of an LI task, the last modification time of the status of the LI task, and a task sequence number associated with the LI task. Thus, the LI ADMF communication device is able to request information on LI tasks based on their task status, on the last modification time of their status, and/or on their task sequence number. Thus, the present invention enables to use less computational resources, time, and/or memory at the NE communication device and/or at the LI ADMF communication device.

Figure 2 shows an LI, network and system 200 according to document ETSI TS 103 221 -1 V1.16.1.

The LI system 200 comprises a LEA network and a CSP network. LEA 201 is an organization authorized by a lawful authorization based on the applicable jurisdiction to request and receive the results of telecommunications interceptions of an interception target. The target is a person of interest and/or user equipment possessed or used by the person of interest being surveyed by the LEA 201 . Said LEA 201 communications with the CSP network through a network inface, called Handover Interface, HI.

An LI ADMF communication device 202 generates, based on said received intercept request, a warrant comprising one or more interception target identities, and sends the warrant to a POI within a NE communication device 203 via an interface X1 .

The NE communication device 203 is an entity that performs the interception. Said POI detects the interception target communication, derives the IRI or CC from the target communications, and delivers the POI Output to a mediation and delivery function device. The mediation and delivery function device receive the POI Outputs and transforms them from internal interface format to Handover Interface format, and then will handle dispatching of said transformed POI Outputs to the LEA 201 .

The LI ADMF communication device 202 and the NE communication device 203 exchange message between them on the X1 interface, as defined, for example, in ETSI TS 103 221 -1 V1.16.1. The LI ADMF communication device 202 and the NE communication device 203 also exchange reporting issue message between them on the X1 Report Issue Interface, as defined, for example, in ETSI TS 103 221 -1 V1 .16.1 .

In a 5G system, the NE communication device 203 can be a radio base station, e.g., a gNodeB, gNB, in an access network, or any network element/function of the core network, 5GC, which is configured to enable LI and other techniques described herein. Such a core network node may be an Access and Mobility Management Function, AMF, Security Anchor Function, SEAF, Unified Data Management, UDM, Session Management Function, SMF, SMS Function, SMSF, and a User Plane Function, UPF. For example, an IRI-POI can be hosted in a 5GC function such as AMF, SMF, UDM, SMSF and a CC-POI can be hosted in a 5GC function such as UPF.

Figure 3 shows a flowchart illustrating an embodiment of a method 300 for task handling. The method 300 is performed by the first LI ADMF communication 202.

The method 300 comprises storing 310 a first status 410 of an LI task. In Figure 4, the first status 410 is exemplified.

The LI task corresponds to a task as defined, for example, in ETSI TS 103 221 -1 V1 .16.1 , section 3.1 .

The LI task is uniquely identified by an identifier X1 Identifier, XID. The XID is an identifier to uniquely identify an LI task internally to the X1 interface as well as across related X2 and X3 interfaces. For example, the XID corresponds to the XID as defined, for example, in ETSI TS 103 221 -1 V1 .16.1 section 3.1 .

The first status 410 is the status of the XID. The first status 410 may enumerate that XID is “a new task”, “a task modified”, “a task deleted”, or “unknown”.

For example, the LI ADMF communication device 202 stores a lookup table comprising for each LI task, a corresponding task status, and an optional timestamp.

Table 1 : Example of storage of the LI tasks within the LI ADMF communication device 202. The XID corresponds to the identifier of the LI Task. The XIDStatus corresponds to the first status of the LI Task. The Timestamp corresponds to a time value the first status of the LI Task is stored in the LI ADMF communication device 202.

Alternatively, or additionally, the method 300 comprises generating 313 a task sequence number 415 associated with the LI task, and storing 316 the task sequence number 415. In Figure 4, task sequence number is exemplified.

The task sequence number 415 may be an integer numbering the task when the task is generated.

For example, the LI ADMF communication device 202 stores a lookup table comprising for each LI task, a corresponding task status, a corresponding task sequence number, and an optional timestamp.

Table 2: Example o ^: storage of the LI tasks within the LI ADMF communication device

202.

The XID corresponds to the identifier of the LI Task. The XIDStatus corresponds to the first status of the LI Task. The TaskSequenceNumber corresponds to the task sequence number 415 generated by the first LI ADMF communication device 202. The Timestamp corresponds to a time value the first status of the LI Task is stored in the LI ADMF communication device 202.

The method 300 comprises sending 320 a task request message 420. The task request message 420 is sent to the NE communication device 203 to perform an action associated with the LI task. In Figure 4 and Figure 5, an embodiment of the task request message 420 is provided.

The task request message 420 comprises a first indication 510 to notify the LI ADMF communication device 202 about a change of the status of the LI task.

The task request message 420 is sent over the X1 interface.

In an embodiment, the task request message 420 comprise the generated task sequence number 415. The method 300 comprises receiving 330 a task response message 430. The task response message 430 is received from the first NE communication device 203. The task response 430 comprises a result 610 associated with the task request message 420. In Figure 4 and Figure 6, an embodiment of the task response message 430 is provided.

The task response message 430 is received over the X1 interface.

In an embodiment, the task response message 430 comprises information representative of any one of the following: an OK - Acknowledged and Completed, if the LI task is fully understood, compliant and has been successfully completed; an OK - Acknowledged, if the LI task cannot be completed within a time interval predetermined at the first NE communication device 203 and at the first LI ADMF communication device 202; and a predetermined protocol error if the first NE communication device 203 is unable to perform or understand the LI task. See standard ETSI TS 103 221 -1 V1.16.1 for further details.

In the event, the first NE communication device 203 does not support the function of indicating the change of the status of the LI task, then the task response message 430 comprises an error code.

The method 300 comprises receiving 340, if the status of the LI task has changed, a report request message 440. The report request message 440 is received from the first NE communication device 203. The report request message 440 comprises a second status of the LI task. In Figure 4 and Figure 7, an embodiment of the report request message 440 is provided.

The second status 710 may enumerate that XID is a “new task”, a “task modified”, a “task deactivate”, or “unknown”.

The report request message 440 is received on a different Internet Protocol address/port with respect to the task response message 430. For example, the report request message 440 is received over the X1 Report Issue Interface. Thus, this increases the security.

In the event, the task request message 420 comprises the task sequence number 415, the report request message 440 may comprise the task sequence number 415.

In an embodiment, the report request message 440 is a report issue request sent from the first NE communication device 203 to the first LI ADMF communication device 202 1 after the first NE communication device 203 has identified that the status of the LI task has changed.

The method 300 comprises comparing 350 the received second status 710 to the stored first status 410.

For example, comparing 350 may comprise verifying that the first status 410 and the second status 710 are the same enumerated value.

Additionally, in the event the report request message 440 comprises the task sequence number 415, comparing 350 may comprise verifying that the task sequence number 415 sent in the task request message 420 is the same as the task sequence number 415 received in the report request message 440.

The method 300 comprises performing 360 an action 450 based on the comparison of the step 350 of the method 300.

In the event, the first status 410 and the second status 710 are not the same, the action 450 may be raising a warning alarm by logging a fault report for the engineer to be aware of discrepancies.

In the event, the task sequence number 415 of the task request message 420 is not the same as the task sequence number 415 of the report request message 440, the action 450 may be raising a warning alarm by logging a fault report for the engineer to be aware of discrepancies.

The method 300 comprises sending 370 a report response message 460. The report response message 460 is sent to the first NE communication device 203.

The task request message 420 and/or the task response message 430 is/are sent and/or received over the X1 interface and according to a protocol between the first NE communication device 203 and the first LI ADMF communication device 202. Communication protocols comprise, but are not limited, to Hypertext Transfer Protocol, HTTP, over Transport Layer Security, TLS, and HTTP/2. The first LI ADMF communication device 202 and the first NE communication device 203 here both run HTTP clients and servers: if the LI ADMF communication device 202 is the requester, the LI ADMF 301 may use its HTTP client and the NE 302 may use its HTTP server; if the NE 302 is the requester, the NE 302 may use its HTTP client and the LI ADMF 301 may use its HTTP server. A request is, according to one embodiment, a "POST" message. A response may be sent as a HTTP response. The HTTP response may indicate HTTP level errors within the range of HTTP error codes. If the HTTP level transaction is successful, then the response in this embodiment is a 200 OK message. HTTP error codes are in this embodiment only used to indicate HTTP-level errors and should here not be used to indicate errors with the X1 responses themselves. X1 -level errors may be indicated by use of the appropriate X1 ErrorResponse, encoded and returned as a HTTP 200 OK response. See ETSI TS 103 221-1 V1.16.1 for X1 -level error codes.

According to an embodiment, the task request message 420 is an ActivateTaskRequest message, according to ETSI TS 103 221-1 V1.16.1 , e.g., in the form of a HTTP Post. The ActivateTaskRequest message is sent from the first LI ADMF communication device 202 to the first NE communication device 203 to request to receive information related to a change of the status of the LI task.

The first LI ADMF communication device 202 sends the ActivateTaskRequest message to request to receive information related to a change of the status of the LI task. Thus, the ActivateTaskRequest message may comprise the fields of ActivateTaskRequest, according to ETSI TS 103 221 -1 V1.16.1 , and an InfoOnTaskChange field. The InfoOnTaskChange field comprises the first indication 510 to notify about the change of the status of the LI task.

The ActivateTaskRequest message may comprise a field TaskSequenceNumber. The TaskSequenceNumber comprises the task sequence number 415.

The task response message 430 may here be an ActivateTaskResponse message, according to ETSI TS 103 221 -1 V1.16.1 , e.g., in the form of a response to the ActivateTaskRequest message.

In the event, the first NE communication device 203 supports the InfoOnChange, the NE communication device 203 sets the XIDStatus to “New Task”, and send the report request message 440 comprising the second status 710 set to “New Task”. Alternatively, if the first NE communication device 203 does not support the InfoOnTaskChange, the ActivateTaskResponse message may comprise the error code 3050 - Unsupported ServiceType. According to another embodiment, the task request message 420 is a ModifyTaskRequest message, according to ETSI TS 103 221-1 V1.16.1 , e.g., in the form of a HTTP Post. The ModifyTaskRequest message is sent from the first LI ADMF communication device 202 to the first NE communication device 203 to request to receive information related to a change of the status of the LI task.

The first LI ADMF communication device 202 sends the ModifyTaskRequest message to request to receive information related to a change of the status of the LI task. Thus, the ModifyTaskRequest message may comprise the fields of ModifyTaskRequest, according to ETSI TS 103 221-1 V1.16.1 , and an InfoOnTaskChange field. The InfoOnTaskChange field comprises the first indication 510 to notify about the change of the status of the LI task.

The ModifyTaskRequest message may comprise a field TaskSequenceNumber. The TaskSequenceNumber comprises the task sequence number 415.

The task response message 430 may here be an ModifyTaskResponse message, according to ETSI TS 103 221 -1 V1.16.1 , e.g., in the form of a response to the ModifyTaskRequest message.

In the event, the first NE communication device 203 supports the InfoOnChange, the NE communication device 203 sets the XIDStatus to “Task Modifed”, and send the report request message 440 comprising the second status 710 set to “Task Modified”. Alternatively, if the first NE communication device 203 does not support the InfoOnTaskChange, the ModifyTaskResponse message may comprise the error code 3050 - Unsupported ServiceType.

According to another embodiment, the task request message 420 is a DeactivateTaskRequest message, according to ETSI TS 103 221 -1 V1 .16.1 , e.g., in the form of a HTTP Post. The DeactivateTaskRequest message is sent from the first LI ADMF communication device 202 to the first NE communication device 203 to request to receive information related to a change of the status of the LI task.

The first LI ADMF communication device 202 sends the DeactivateTaskRequest message to request to receive information related to a change of the status of the LI task. Thus, the DeactivateTaskRequest message may comprise the fields of DeactivateTaskRequest, according to ETSI TS 103 221-1 V1.16.1 , and an InfoOnTaskChange field. The InfoOnTaskChange field comprises the first indication 510 to notify about the change of the status of the LI task. The DeactivateTaskRequest message may comprise a field TaskSequenceNumber. The TaskSequenceNumber comprises the task sequence number 415.

The task response message 430 may here be an DeactivateTaskResponse message, according to ETSI TS 103 221 -1 V1.16.1 , e.g., in the form of a response to the DeactivateTaskRequest message.

In the event, the first NE communication device 203 supports the InfoOnChange, the NE communication device 203 sets the XIDStatus to “Task Deactivated”, and send the report request message 440 comprising the second status 710 set to “Task Deactivated”. Alternatively, if the first NE communication device 203 does not support the InfoOnTaskChange, the DeactivateTaskResponse message may comprise the error code 3050 - Unsupported ServiceType.

The InfoOnTaskChange is a task information to be provided by the ADMF when an LI task is modified or deactivated. The format for a InfoOnTaskChange may be a numerical value. For example:

- “0” indicates that no further notification is expected to be received by the NE;

- “1” indicates a report request message is expected for ModifyTask;

- “2” indicates a report request message is expected for DeactivateTask;

- “3” indicates a report request message is expected for ModifyTask and DeactivateTask.

The TaskSequenceNumber is a number order of the task request message 420. It is here applied on ActivateTask message, ModifyTask message, and DeactivateTask message. The format for a TaskSequenceNumber is an Integer.

Table 3 is a table listing examples of mandatory, optional or conditional fields that could be included in the task request message 420.

Table 3: Fields in the task request message and their description. M/C/0 column describes the type of filed: Mandatory, Conditional or Optional.

The report request message 440 and/or the report response message 460 is/are sent and/or received over the X1 Report Issue Interface and according to a protocol between the first NE communication device 203 and the first LI ADMF communication device 202. Communication protocols comprise, but are not limited, to Hypertext Transfer Protocol, HTTP, over Transport Layer Security, TLS, and HTTP/2. The first LI ADMF communication device 202 and the first NE communication device 203 here both run HTTP clients and servers: if the LI ADMF communication device 202 is the requester, the LI ADMF 301 may use its HTTP client and the NE 302 may use its HTTP server; if the NE 302 is the requester, the NE 302 may use its HTTP client and the LI ADMF 301 may use its HTTP server. A request is, according to one embodiment, a "POST" message. A response may be sent as a HTTP response. The HTTP response may indicate HTTP level errors within the range of HTTP error codes. If the HTTP level transaction is successful, then the response in this embodiment is a 200 OK message. HTTP error codes are in this embodiment only used to indicate HTTP-level errors and should here not be used to indicate errors with the X1 responses themselves. X1 -level errors may be indicated by use of the appropriate X1 ErrorResponse, encoded and returned as a HTTP 200 OK response. See ETSI TS 103 221-1 V1.16.1 for X1 -level error codes.

According to an embodiment, the report request message 440 is a ReportTasklssueRequest message, according to ETSI TS 103 221 -1 V1.16.1 , e.g., in the form of a HTTP Post. The ReportTasklssueRequest message is sent from the first LI ADMF communication device 202 to the first NE communication device 203 to request to provide information related to a change of the status of the LI task.

The first NE communication device 203 sends the ReportTasklssueRequest message to provide the information related to a change of the status of the LI task. Thus, the ReportTasklssueRequest message may comprise the fields of ReportTasklssueRequest, according to ETSI TS 103221-1 V1 .16.1 , and an XIDStatus field. The XIDStatus field comprises the second status 710 to notify about the change of the status of the LI task.

The ReportTasklssueRequest message may comprise a field TaskSequenceNumber. The TaskSequenceNumber comprises the task sequence number 415.

The task response message 430 may here be an ReportTasklssueResponse message, according to ETSI TS 103 221 -1 V1 .16.1 , e.g., in the form of a response to the ReportTasklssueResponse message.

The XIDStatus is a status of the LI task XID. The format for a XIDStatus may be an enumerated value. The enumerated value is a user-defined data type used to map a set of names to numeric values. The enumerated values comprise one of:

- “New Task”;

- “Task Modified”;

- “Task Deactivated”.

The TaskSequenceNumber is a number order of the task request message 420. It is here applied on ReportTasklssueRequest message. The format for a TaskSequenceNumber is an Integer.

Table 4 is a table listing examples of mandatory, optional or conditional fields that could be included in the report request message 440.

Table 4: Fields in the report request message and their description. M/C/0 column describes the type of filed: Mandatory, Conditional or Optional. Figure 8 shows a flowchart illustrating an embodiment of a method 800 for task handling. The method 800 is performed by the first NE communication 203.

The method 800 comprises receiving 810 a task request message 420 to perform an action associated with an LI task. The received task request message 420 of the step 810 of the method 800 corresponds to the task request message 420 of the step 320 of the method 300, as described herein.

The method 800 comprises storing 820 the second status 710 of the LI task based on the task request message 420.

For example, the NE communication device 203 stores a lookup table comprising for each LI task, a corresponding task status, and an optional timestamp.

Table 5: Example of storage of the LI tasks within the NE communication device 203.

The XID corresponds to the identifier of the LI Task, as described above. The XIDStatus corresponds to the second status of the LI Task. The Timestamp corresponds to a time value the second status of the LI Task is stored in the NE communication device 203.

In an embodiment, the task request message 420 comprises the task sequence number 415. The method 800 may comprise storing the task sequence number 415.

For example, the NE communication device 203 stores a lookup table comprising for each LI task, a corresponding task status, a corresponding task sequence number, and an optional timestamp.

Table 6: Example of storage of the LI tasks within the NE communication device 203.

The XID corresponds to the identifier of the LI Task, as described above. The XIDStatus corresponds to the second status of the LI Task. The TaskSequenceNumber corresponds to the task sequence number 415 comprised in the task request message 420 sent by the first LI ADMF communication device 202. The Timestamp corresponds to a time value the second status of the LI Task is stored in the NE communication device 203.

The method 800 comprises sending 830 the task response message 430, to the first LI ADMF communication device 202. The task response message 430 comprises a result 610 associated with the LI task. The task response comprises a result associated with the task request message 420. The task response message 430 of the step 830 of the method 800 corresponds to the task response message 430 of the step 330 of the method 300, as described above.

The method 800 comprises sending 840, to the first LI ADMF communication device 202, the report request message 440. The report request message 440 of the step 840 of the method 800 corresponds to the report request message 440 of the step 340 of the method 300, as described above.

The method 800 comprises receiving 850, from the first LI ADMF communication device 202, the report response message 460. The report response message 460 of the step 850 of the method 800 corresponds to the report response message 460 of the step 370 of the method 300, as described above.

Figure 9 shows the first LI ADMF communication device 202. The first LI ADMF communication device 202 comprises a first storing unit 910, a first sending unit 920, a first receiving unit 930, a second receiving unit 940, a comparing unit 950, a performing unit 960, and a second sending unit 970.

The first storing unit 910 is configured to cause the first LI ADMF communication device 202 to perform the step 310 of the method 300, as described above.

The first sending unit 920 is configured to cause the first LI ADMF communication device 202 to perform the step 320 of the method 300, as described above.

The first receiving unit 930 is configured to cause the LI first ADMF communication device 202 to perform the step 330 of the method 300, as described above. The second receiving unit 940 is configured to cause the LI first ADMF communication device 202 to perform the step 340 of the method 300, as described above.

The comparing unit 950 is configured to cause the first LI ADMF communication device 202 to perform the step 350 of the method 300, as described above.

The performing unit 960 is configured to cause the first LI ADMF communication device 202 to perform the step 360 of the method 300, as described above.

The second sending unit 970 is configured to cause the first LI ADMF communication device 202 to perform the step 370 of the method 300, as described above.

In an embodiment, the first LI ADMF communication device 202 comprises a generating unit 913. The generating unit 913 is configured to cause the first LI ADMF communication device 202 to perform the step 313 of the method 300, as described above.

In an embodiment, the first LI ADMF communication device 202 comprises a second storing unit 916. The second storing unit 916 is configured to cause the first LI ADMF communication device 202 to perform the step 316 of the method 300, as described above.

In an embodiment, the first storing unit 910 and the second storing unit 913 are a same storing unit.

In an embodiment, the first sending unit 920 and the second sending unit 970 are a same sending unit.

In an embodiment, the first receiving unit 930 and the second receiving unit 940 are a same receiving unit.

In an embodiment, the first sending unit 920, the second sending unit 970, the first receiving unit 930 and the second receiving unit 940 are a same transceiver unit. In an embodiment, the generating unit 913, the comparing unit 950, the performing unit 960 are a same unit.

The first storing unit 910, the generating unit 913, the second storing unit 916, the first sending unit 920, the first receiving unit 930, the second receiving unit 940, the comparing unit 950, the performing unit 960, the second sending unit 970, illustrated in Figure 9, may be implemented as hardware solution or as a combination of software and hardware, e.g., by one or more of: a processor or a micro-processor and adequate software and memory for storing of the software, a Programmable Logic Device (PLD) or other electronic component(s) or processing circuitry configured to perform the actions described above with regards to the method 300.

Figure 10 shows the first NE communication device 203. The first NE communication device 203 comprises a first receiving unit 1010, a storing unit 1020, a first sending unit 1030, a second sending unit 1040, and a second receiving unit 1050.

The first receiving unit 1010 is configured to cause the first NE communication device 203 to perform the step 810 of the method 800, as described above.

The storing unit 1020 is configured to cause the first NE communication device 203 to perform the step 820 of the method 800, as described above.

The first sending unit 1030 is configured to cause the first NE communication device 203 to perform the step 830 of the method 800, as described above.

The second sending unit 1040 is configured to cause the first NE communication device 203 to perform the step 840 of the method 800, as described above.

The second receiving unit 1050 is configured to cause the first NE communication device 203 to perform the step 850 of the method 800, as described above.

In an embodiment, the first sending unit 1030 and the second sending unit 1040 are a same sending unit. In an embodiment, the first receiving unit 1010 and the second receiving unit 1050 are a same receiving unit.

In an embodiment, the first sending unit 1030, the second sending unit 1050, the first receiving unit 1010 and the second receiving unit 1050 are a same transceiver unit.

The first receiving unit 1010, the storing unit 1020, the first sending unit 1030, the second sending unit 1040, and the second receiving unit 1050, illustrated in Figure 10, may be implemented as hardware solution or as a combination of software and hardware, e.g., by one or more of: a processor or a micro-processor and adequate software and memory for storing of the software, a Programmable Logic Device (PLD) or other electronic component(s) or processing circuitry configured to perform the actions described above with regards to the method 800.

Figure 11 shows an embodiment of the first LI ADMF communication device 202. The first LI ADMF communication device 202 comprises a processor 1110, and a computer storage medium 1120 in the form of a memory 1125. The memory 1125 comprises a computer program 1130 comprising instructions executable by the processor 1110 whereby the first LI ADMF communication device 202 is operative to perform the steps of the method 300, as described above.

Figure 12 shows an embodiment of the first NE communication device 203. The first NE communication device 203 comprises a processor 1210, and a computer storage medium 1220 in the form of a memory 1225. The memory 1225 comprises a computer program 1230 comprising instructions executable by the processor 1210 whereby the first NE communication device 203 is operative to perform the steps of the method 800, as described above.

The (non-transitory) computer readable storage media mentioned above may be an Electrically Erasable Programmable Read-Only Memory (EEPROM), a flash memory, Field Programmable Gate Array, and a hard drive. The processor 1110 of Figure 11 , and the processor 1210 of Figure 12 may be a single Central Processing Unit (CPU), but could also comprise two or more processing units. For example, the processor 1110 of Figure 11 , and the processor 1210 of Figure 12 may include general purpose microprocessors; instructions set processors and/or related chips sets and/or special purpose microprocessors such as Application Specific 30 Circuits (ASICs). The processor 1110 of Figure 11 , and the processor 1210 of Figure 12 may also comprise board memory for caching purposes.

The computer program 1130 of Figure 11 , and the computer program 1230 of Figure 12, may be carried by a computer program product connected to the processor 1110 of Figure 11 , and the processor 1210 of the Figure 12. The computer program products may be or comprise a non-transitory computer readable storage medium on which the computer program 1130 of Figure 11 , and the computer program 1230 of Figure 12 are stored. For example, the computer program products may be a flash memory, a Random-Access memory (RAM), a Read-Only Memory (ROM), or an EEPROM, and the computer programs described above could in alternative embodiments be distributed on different computer program products in the form of memories.

Figure 13 shows an LI network and system 1300 according to document ETSI TS 103 221 -1 V1.16.1.

The LI system 1300 comprises a LEA network and a CSP network. LEA 1301 is an organization authorized by a lawful authorization based on the applicable jurisdiction to request and receive the results of telecommunications interceptions of an interception target. The target is a person of interest and/or user equipment possessed or used by the person of interest being surveyed by the LEA 1301. Said LEA 1301 communications with the CSP network through a network inface, called Handover Interface, HI.

An LI ADMF communication device 1302 generates, based on said received intercept request, a warrant comprising one or more interception target identities, and sends the warrant to a POI within a NE communication device 1303 via an interface X1 . The NE communication device 1303 is an entity that performs the interception. Said POI detects the interception target communication, derives the IRI or CC from the target communications, and delivers the POI Output to a mediation and delivery function device. The mediation and delivery function device receive the POI Outputs and transforms them from internal interface format to Handover Interface format, and then will handle dispatching of said transformed POI Outputs to the LEA 1301 .

The LI ADMF communication device 1302 and the NE communication device 1303 exchange message between them on the X1 interface, as defined, for example, in ETSI TS 103 221 -1 V1.16.1.

The LI ADMF communication device 1302 and the NE communication device 1303 also exchange reporting issue message between them on the X1 Report Issue Interface, as defined, for example, in ETSI TS 103 221-1 V1.16.1.

In a 5G system, the NE communication device 1303 can be a radio base station, e.g., a gNodeB, gNB, in an access network, or any network element/function of the core network, 5GC, which is configured to enable LI and other techniques described herein. Such a core network node may be an Access and Mobility Management Function, AMF, Security Anchor Function, SEAF, Unified Data Management, UDM, Session Management Function, SMF, SMS Function, SMSF, and a User Plane Function, UPF. For example, an IRI-POI can be hosted in a 5GC function such as AMF, SMF, UDM, SMSF and a CC-POI can be hosted in a 5GC function such as UPF.

The skilled person would understand that the LI system 200 and the LI system 1300 may be the same LI system. In particular, the first LI ADMF communication device 202 may be the second LI ADMF communication device 1302, and thus be able to perform the same functionalities, and the first NE communication device 203 may be the second NE communication device, and thus be able to perform the same functionalities.

Figure 14 shows a flowchart illustrating an embodiment of a method 1400 for audit and synchronization of LI tasks. The method 300 is performed by the second LI ADMF communication 1302. The method 1400 is for audit and synchronization of LI tasks. The method 1400 comprises sending 1410 an information request message 1510, to a second NE communication device 1303, to determine details related to one or more LI tasks. In Figure 15 and Figure 16, an embodiment of the information request message 1510 is provided. The information request message 1510 comprises one or more of: a task status 1610 that the one or more LI tasks are to be in, a last modification time value 1620, and a last task sequence number value 1630.

The method 1400 comprises receiving 1420, from the second NE communication device 1303, an information response message 1520. In Figure 15, an embodiment of the information response message 1520 is provided. The information response message 1520 comprises one or more LI tasks that are in the requested state 1610, that are modified after or at a time equal to the last modification time value 1620, and/or that have a task sequence number greater or equal to the last sequence number value 1630.

The information request message 1510 and/or the information response message 1520 is/are sent and/or received over the X1 interface and according to a protocol between the second NE communication device 1303 and the second LI ADMF communication device 1302. Communication protocols comprise, but are not limited, to Hypertext Transfer Protocol, HTTP, over Transport Layer Security, TLS, and HTTP/2. The second LI ADMF communication device 1302 and the second NE communication device 1303 here both run HTTP clients and servers: if the LI ADMF communication device 1302 is the requester, the LI ADMF 1302 may use its HTTP client and the NE 1303 may use its HTTP server; if the NE 1303 is the requester, the NE 1303 may use its HTTP client and the LI ADMF 1302 may use its HTTP server. A request is, according to one embodiment, a "POST" message. A response may be sent as a HTTP response. The HTTP response may indicate HTTP level errors within the range of HTTP error codes. If the HTTP level transaction is successful, then the response in this embodiment is a 200 OK message. HTTP error codes are in this embodiment only used to indicate HTTP-level errors and should here not be used to indicate errors with the X1 responses themselves. X1 -level errors may be indicated by use of the appropriate X1 ErrorResponse, encoded and returned as a HTTP 200 OK response. See ETSI TS 103 221-1 V1.16.1 for X1 level error codes. According to an embodiment, the information request message 1510 is an GetAIIDetailsRequest message, according to ETSI TS 103 221 -1 V1.16.1 , e.g., in the form of a HTTP Post. The GetAIIDetailsRequest message is sent from the second LI ADMF communication device 1302 to the second NE communication device 1303 to request to receive details only on LI Tasks that have a specific Task status, that have been modified from a specific time, and/or that have a task sequence number that is greater than a particular task sequence number.

The second LI ADMF communication device 1302 sends the GetAIIDetailsRequest message to request to receive details only on LI Tasks that have a specific Task status, that have been modified from a specific time, and/or that have a task sequence number that is greater than a particular task sequence number. Thus, the GetAIIDetailsRequest message may comprise the fields of GetAIIDetailsRequest, according to ETSI TS 103 221-1 V1.16.1 , and one or more of: a Status field, a LastModificationTime field, and a LastTaskSequenceNumber field. The Status field comprises the task status 1610. The LastModificationTime field comprises the last modification time value 1620. The LastTaskSequenceNumber field comprises the last task sequence number 1630.

The information response message 1520 may here be an GetAIIDetailsResponse message, according to ETSI TS 103 221 -1 V1 .16.1 , e.g., in the form of a response to the GetAIIDetailsRequest message.

According to another embodiment, the information request message 1510 is an GetAIITaskDetailsRequest message, according to ETSI TS 103 221 -1 V1.16.1 , e.g., in the form of a HTTP Post. The GetAIITaskDetailsRequest message is sent from the second LI ADMF communication device 1302 to the second NE communication device 1303 to request to receive details only on LI Tasks that have a specific Task status, that have been modified from a specific time, and/or that have a task sequence number that is greater than a particular task sequence number.

The second LI ADMF communication device 1302 sends the GetAIITaskDetailsRequest message to request to receive details only on LI Tasks that have a specific Task status, that have been modified from a specific time, and/or that have a task sequence number that is greater than a particular task sequence number. Thus, the GetAIITaskDetailsRequest message may comprise the fields of GetAIITaskDetailsRequest, according to ETSI TS 103 221 -1 V1 .16.1 , and one or more of: a Status field, a LastModificationTime field, and a LastTaskSequenceNumber field. The Status field comprises the task status 1610. The LastModificationTime field comprises the last modification time value 1620. The LastTaskSequenceNumber field comprises the las task sequence number 1630.

The information response message 1520 may here be an GetAIITaskDetailsResponse message, according to ETSI TS 103 221 -1 V1 .16.1 , e.g., in the form of a response to the GetAIITaskDetailsRequest message.

The Status field indicates the status of the LI tasks that are to be reported in the response message. The format for a Status may be an enumerated value. The enumerated value is a user-defined data type used to map a set of names to numeric values. The enumerated values comprise one of:

- “New Task”;

- “Task Modified”;

- “Task Deactivated”;

- “All Status”;

- “New, modified, deactivated tasks”.

The LastModificationTime indicates the time from which the LI Task is to be reported in the response message. Only LI tasks with a TimeOfLastModification greater or equal to LastModificationTime are to be reported. The format for a LastModificationTime may be Qualified, such as Microsecond Date Time, as designed in ETSI TS 103 280 V2.11.1.

The LastTaskSequenceNumber indicates the minimum TaskSequenceNumber for LI tasks to be reported. Only LI tasks with a TimeSequenceNumber greater or equal to LastTaskSequenceNumber are to be reported. The format for a LastTaskSequenceNumber may be Integer.

Table 7 is a table listing examples of mandatory, optional or conditional fields that could be included in the information request message 1510. column describes the type of filed: Mandatory, Conditional or Optional.

In the event, the second NE communication device 1303 does not support one or more of: the Status field, the LastModificationTime field, and the LastTaskSequenceNumber field; then, the second NE communication device 1303 sends an Error Code 1080 - “Unsupported request”. See ETSI TS 103 221-1 V1.16.1 for details.

Alternatively, the second NE communication device 1303 sends the GetAIIDetailsResponse message comprising the fields of GetAIIDetailsResponse, according to ETSI TS 103 221 -1 V1 .16.1 , and one or more of: a XIDStatus field, and a TaskSequenceNumber field. Alternatively, the second NE communication device 1303 send the GetAIITaskDetailsResponse message comprising the fields of GetAIITaskDetailsResponse, according to ETSI TS 103 221-1 V1.16.1 , and one or more of: a XIDStatus field, and a TaskSequenceNumber field. The XIDStatus is a status of the LI task XID. The format for a XIDStatus may be an enumerated value. The enumerated value is a user-defined data type used to map a set of names to numeric values. The enumerated values comprise one of:

- “New Task”;

- “Task Modified”;

- “Task Deactivated”.

The TaskSequenceNumber is a number order of an LI task. The format for a TaskSequenceNumber is an Integer.

Table 8 is a table listing examples of mandatory, optional or conditional fields that could be included in the information response message 1520.

Table 8: Fields in the information response message and their description. M/C/0 column describes the type of filed: Mandatory, Conditional or Optional.

In an embodiment, the method 1400 comprises sending 1430 a second information request message 1530 to the second NE communication device 1303 to retrieve a list of LI tasks. In Figure 15 and Figure 17, an embodiment of the second information request message 1530 is provided. The second information request message 1530 comprises one or more of: a second indication 1710 on whether to indicate a last modification time value of the LI tasks; a third indication 1720 on whether to indicate a status of the LI tasks; a fourth indication 1730 on whether to indicate a task sequence number of the LI tasks; and a fifth indication 1740 on whether to report deactivated tasks. In an embodiment, the method 1400 comprises receiving 1440, from the second NE communication device 1303, a second information response message 1540. In Figure 15, an embodiment of the second information response message 1540 is provided. The second information response message 1540 comprises a list of one or more LI tasks, wherein for each of the LI tasks in the list, the last modification time value is indicated based to the second information request message 1530, the status is indicated based on the second information request message 1530, and/or the task sequence number is indicated based on the second information request message 1530.

The second information request message 1530 and/or the second information response message 1530 is/are sent and/or received over the X1 interface and according to a protocol between the second NE communication device 1303 and the second LI ADMF communication device 1302. Communication protocols comprise, but are not limited, to Hypertext Transfer Protocol, HTTP, over Transport Layer Security, TLS, and HTTP/2. The second LI ADMF communication device 1302 and the second NE communication device 1303 here both run HTTP clients and servers: if the LI ADMF communication device 1302 is the requester, the LI ADMF 1302 may use its HTTP client and the NE 1303 may use its HTTP server; if the NE 1303 is the requester, the NE 1303 may use its HTTP client and the LI ADMF 1302 may use its HTTP server. A request is, according to one embodiment, a "POST" message. A response may be sent as a HTTP response. The HTTP response may indicate HTTP level errors within the range of HTTP error codes. If the HTTP level transaction is successful, then the response in this embodiment is a 200 OK message. HTTP error codes are in this embodiment only used to indicate HTTP-level errors and should here not be used to indicate errors with the X1 responses themselves. X1 -level errors may be indicated by use of the appropriate X1 ErrorResponse, encoded and returned as a HTTP 200 OK response. See ETSI TS 103 221 -1 V1.16.1 for X1 -level error codes.

According to an embodiment, the second information request message 1540 is a ListAIIDetailsRequest message, according to ETSI TS 103 221-1 V1.16.1 , e.g., in the form of a HTTP Post. The ListAIIDetailsRequest message is sent from the second LI ADMF communication device 1302 to the second NE communication device 1303 to request to receive details on Task Status and last time modification of LI tasks.

The second LI ADMF communication device 1302 sends the ListAIIDetailsRequest message to request to receive details on Task Status and last time modification of LI tasks. Thus, the ListAIIDetailsRequest message may comprise the fields of ListAIIDetailsRequest, according to ETSI TS 103 221-1 V1.16.1 , and one or more of: an IndicateLastModificationTime field, an IndicateStatus field, an IndicateTaskSequenceNumber field and a ReportDeactivatedTasks field. The IndicateLastModificationTime field comprises the second indication 1710. The IndicateStatus field comprises the third indication 1720. The IndicateTaskSequenceNumber field comprises the las fourth indication 1730. The ReportDeactivatedTasks field comprises the fifth indication 1740.

The second information response message 1540 may here be an ListAIIDetailsResponse message, according to ETSI TS 103 221-1 V1.16.1 , e.g., in the form of a response to the ListAIIDetailsRequest message.

The IndicateLastModificationTime field indicates whether to include in the response message the time of last modification of each LI task. The format for a IndicateLastModificationTime may be a numerical value. The numerical may comprise on of:

- “0” to indicate that last modification time is not to be reported;

- “1” to indicate that last modification time is to be reported.

The IndicateStatus field indicates whether to include the task status for each LI tasks in the response message. The format for an IndicateStatus may be a numerical value. The numerical value may be one of:

- “0” to indicate that the task status is not to be reported;

- “1” to indicate that the task status is to be reported.

The IndicateTaskSequenceNumber field indicates whether to include in the response message the task sequence number associated with each LI task. The format of an IndicateTaskSequenceNumber may be a numerical value. The numerical value may be one of:

“0” to indicate that the task sequence number is not to be reported;

“1” to indicate that the task sequence number is to be reported. The ReportDeactivatedTasks fields indicates whether to indicate in the response message the LI tasks which status is “Task Deactivated”. The format for a ReportDeactivatedTasks may be a numerical value. The numerical value may be one of: - “0” to indicate that the deactivated tasks are not to be reported;

- “1” to indicate that the deactivated tasks are to be reported.

Table 9 is a table listing examples of mandatory, optional or conditional fields that could be included in the second information request message 1530.

Table 9: Fields in the second information request message and their description.

M/C/0 column describes the type of filed: Mandatory, Conditional or Optional.

In the event, the second NE communication device 1303 does not support one or more of the IndicateLastModificationTime field, the IndicateStatus field, the IndicateTaskSequenceNumber field, and the ReportDeactivatedTasks field, then the second NE communication device 1303 sends an Error Code 1080 - “Unsupported request”. See ETSI TS 103 221 -1 V1.16.1 for details.

Alternatively, the second NE communication device 1303 sends the ListAIIDetailsResponse message comprising the fields of ListAIIDetailsResponse, according to ETSI TS 103 221 -1 V1 .16.1 , one or more of: the ListOfXIDsDetails field, a ListOfDeactivatedXIDsDetails field, a TimeOfLastListAIIDetails, and a LastTaskSequenceNumberRequested field. Alternatively, the second NE communication device 1303 sends the ListAIIDetailsResponse message comprising the fields of ListAIIDetailsResponse, according to ETSI TS 103 221-1 V1.16.1 , a ListOfXIDsDetails field and one or more of: a ListOfDeactivatedXIDsDetails field, a TimeOfLastListAIIDetails, and a LastTaskSequenceNumberRequested field.

The ListOfXIDsDetails is a list of all LI tasks that are not deactivated and related to the request message. The format for a ListOfXIDsDetails may be List of LI tasks, each comprising: XID, TimeOfLastModification, XIDStatus, TaskSequenceNumber.

The ListOfDeactivatedXIDsDetails field is a list of all XIDs that have been deactivated and related to the request message. The format for a ListOfDeactivatedXIDsDetails may be List of deactivated LI tasks, each comprising: XID, TimeOfLastModification, XIDStatus, TaskSequenceNumber. The TimeOfLastListAIIDetails field is a time corresponding to the handling of the last previous ListAIIDetails message. The format of a timeOfLastListAIIDetails may be a Qualified Microsecond Date Time. See ETSI TS 103 280 for details.

The LastTaskSequenceNumberRequested field is the task sequence number of the LI tasks since the last previous ListAIIDetails message. The format of a LastTaskSequenceNumberRequested may be an Integer.

Table 10 is a table listing examples of mandatory, optional or conditional fields that could be included in the second information response message 1540.

Table 10: Fields in the second information response message and their description.

M/C/O column describes the type of filed: Mandatory, Conditional or Optional.

Figure 18 shows a flowchart illustrating an embodiment of a method 1800 for audit and synchronization of LI tasks. The method 1800 is performed by the second NE communication 1303.

The method 1800 comprises receiving 1810 an information request message 1510 from the second LI ADMF communication device 1302 to determine details related to one or more LI tasks. The information request message 1510 of the step 1810 of the method 1800 corresponds to the information request message 1510 of the step 1410 of the method 1400, as described herein.

The method 1800 comprises sending 1820 to the second LI ADMF communication device 1302 the information response message 1520. The information response message 1520 of the step 1820 of the method 1800 corresponds to the information response message 1520 of the step 1420 of the method 1400, as described herein.

In an embodiment, the method 1800 comprises receiving 1830 the second information request message 1530 from the second LI ADMF communication device 1302 to retrieve a list of LI tasks. The second information request message 1530 of the step 1830 of the method 1800 corresponds to the second information request message 1530 of the step 1430 of the method 1400, as described herein. In an embodiment, the method 1800 comprises sending 1840 the second information response message 1540 to the second LI ADMF communication device 1302. The second information response message 1540 of the step 1840 of the method 1800 corresponds to the second information response message 1540 of the step 1440 of the method 1400, as described herein.

Figure 19 shows the second LI ADMF communication device 1302. The second LI ADMF communication device 1302 comprises a first sending unit 1910, and a first receiving unit 1920.

The first sending unit 1910 is configured to cause the second LI ADMF communication device 1302 to perform the step 1410 of the method 1400, as described above.

The first receiving unit 1920 is configured to cause the second LI ADMF communication device 1302 to perform the step 1420 of the method 1400, as described above.

In an embodiment, the second LI ADMF communication device 1302 comprises a second sending unit 1930. The second sending unit 1930 is configured to cause the second LI ADMF communication device 1302 to perform the step 1430 of the method 1400, as described above.

In an embodiment, the second LI ADMF communication device 1302 comprises a second receiving unit 1940. The second receiving unit 1940 is configured to cause the second LI ADMF communication device 1302 to perform the step 1440 of the method 1400, as described above.

In an embodiment, the first sending unit 1910 and the second sending unit 1930 are a same sending unit.

In an embodiment, the first receiving unit 1920 and the second receiving unit are a same receiving unit. In an embodiment, the first sending unit 1910, the first receiving unit 1920, the second sending unit 1930, and the second receiving unit 1940 are a same transceiver unit.

The first sending unit 1910, the first receiving unit 1920, the second sending unit 1930, and the second receiving unit 1940 illustrated in Figure 19, may be implemented as hardware solution or as a combination of software and hardware, e.g., by one or more of: a processor or a micro-processor and adequate software and memory for storing of the software, a Programmable Logic Device (PLD) or other electronic component(s) or processing circuitry configured to perform the actions described above with regards to the method 1400.

Figure 20 shows the second NE communication device 1303. The second NE communication device 1303 comprises a first receiving unit 2010, and a first sending unit 2020.

The first receiving unit 2010 is configured to cause the second NE communication device 1303 to perform the step 1810 of the method 1800, as described above.

The first sending unit 2020 is configured to cause the second NE communication device 1303 to perform the step 1820 of the method 1800, as described above.

In an embodiment, the second NE communication device 1303 comprises a second receiving unit 2030. The second receiving unit 2030 is configured to cause the second NE communication device 1303 to perform the step 1830 of the method 1800, as described above.

In an embodiment, the second NE communication device 1303 comprises a second sending unit 2040. The second sensing unit 2040 is configured to cause the second NE communication device 1303 to perform the step 1840 of the method 1800, as described above.

In an embodiment, the first receiving unit 2010, and the second receiving unit 2030 are a same receiving unit. In an embodiment, the first sending unit 2020, and the second sending unit 2040 are a same sending unit.

In an embodiment, the first receiving unit 2010, the first sending unit 2020, the second receiving unit 2030, and the second sending unit 2040 are a same transceiver unit.

The first receiving unit 2010, the first sending unit 2020, the second receiving unit 2030, illustrated in Figure 20, may be implemented as hardware solution or as a combination of software and hardware, e.g., by one or more of: a processor or a microprocessor and adequate software and memory for storing of the software, a Programmable Logic Device (PLD) or other electronic component(s) or processing circuitry configured to perform the actions described above with regards to the method 1800.

Figure 21 shows an embodiment of the second LI ADMF communication device 1302. The second LI ADMF communication device 1302 comprises a processor 2110, and a computer storage medium 2120 in the form of a memory 2125. The memory 2125 comprises a computer program 2130 comprising instructions executable by the processor 2110 whereby the second LI ADMF communication device 1302 is operative to perform the steps of the method 1400, as described above.

Figure 22 shows an embodiment of the second NE communication device 1303. The second NE communication device 1303 comprises a processor 2210, and a computer storage medium 2220 in the form of a memory 2225. The memory 2225 comprises a computer program 2230 comprising instructions executable by the processor 2210 whereby the second NE communication device 1303 is operative to perform the steps of the method 1800, as described above.

The (non-transitory) computer readable storage media mentioned above may be an Electrically Erasable Programmable Read-Only Memory (EEPROM), a flash memory, Field Programmable Gate Array, and a hard drive.

The processor 2110 of Figure 21 , and the processor 2210 of Figure 22 may be a single Central Processing Unit (CPU), but could also comprise two or more processing units. For example, the processor 2110 of Figure 21 , and the processor 2210 of Figure 22 may include general purpose microprocessors; instructions set processors and/or related chips sets and/or special purpose microprocessors such as Application Specific 30 Circuits (ASICs). The processor 2110 of Figure 21 , and the processor 2210 of Figure 22 may also comprise board memory for caching purposes.

The computer program 2130 of Figure 21 , and the computer program 2230 of Figure 22, may be carried by a computer program product connected to the processor 2110 of Figure 21 , and the processor 2210 of Figure 22. The computer program products may be or comprise a non-transitory computer readable storage medium on which the computer program 2130 of Figure 21 , and the computer program 2230 of Figure 22 are stored. For example, the computer program products may be a flash memory, a Random-Access memory (RAM), a Read-Only Memory (ROM), or an EEPROM, and the computer programs described above could in alternative embodiments be distributed on different computer program products in the form of memories.

As used herein, the term “and/or” includes any and all combinations of one or more of the associated listed terms. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limited by exemplary embodiments. As used herein, the single forms “a”, “an”, and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises”, “comprising”, “has”, “having”, “includes”, and/or “including”, when used herein, specify the presence of stated features, elements, and/or components etc. but not preclude the presence or addition of one or more other features, elements, components, and/or combinations thereof.

The disclosure has been described above in reference to embodiments thereof. It should be understood that various modifications, alternatives, and additions can be made by those skilled in the art without departing from the scope of the disclosure. Therefore, the scope of the disclosure is not limited to the above particular embodiments but only defined by the claims as attached.

Claims

1. A first Lawful Interception, LI, Administrative Function, ADMF, communication device (202) for LI task handling, the first LI ADMF communication device (202) is configured to:

- store a first status (410) of an LI task;

- send a task request message (420), to a first Network Element, NE, communication device (203), to perform an action associated with the LI task, wherein the task request message (420) comprises a first indication (510) to notify about a change of the status of the LI task;

- receive a task response message (430), from the first NE communication device (203), wherein the task response message (430) comprises a result (610) associated with the task request message (420);

- receive, from the first NE communication device (203), if the status of the LI task has changed, a report request message (440) comprising a second status (710) of the LI task;

- compare the received second status (710) to the stored first status (410);

- perform an action (450) based on the comparison; and

- send, to the first NE communication device (203), a report response message (460).

2. The first LI ADMF communication device (202) according to claim 1 , is configured to:

- generate a task sequence number (415) associated to the LI task; and

- store the task sequence number (415).

3. The first LI ADMF communication device (202) according to claim 2, wherein the task request message (420) comprises the task sequence number (415) associated to the LI task.

4. The first LI ADMF communication device (202) according to any of claims 2-3, wherein the report request message (440) comprises the task sequence number (415).

5. The first LI ADMF communication device (202) according to any of claims 1 -5, wherein the task response message (430) comprises information representative of any one of the following:

- an OK - Acknowledged and Completed, if the LI task is fully understood, compliant and has been successfully completed;

- an OK - Acknowledged, if the LI task cannot be completed within a time interval predetermined at the first NE communication device 203 and at the first LI ADMF communication device 202; and

- a predetermined protocol error if the first NE communication device 203 is unable to perform or understand the LI task.

6. The first LI ADMF communication device (202) according to any of claims 1-5 wherein the task request message (420) is an ActivateTaskRequest message, a ModifyTaskRequest message, or a DeactivateTaskRequest.

7. The first LI ADMF communication device (202) according to claim 6, wherein the task request message (420) comprises the fields of ActivateTaskRequest and an InfoOnTaskChange field, wherein the InfoOnTaskChange comprises the first indication to notify about the change of the status of the LI task.

8. The first LI ADMF communication device (202) according to any of claims 6-7, when dependent to claim 4, wherein the task request message (420) comprises a field TaskSequenceNumber, wherein the TaskSequenceNumber comprises the task sequence number.

9. The first LI ADMF communication device (202) according to any of claims 6-8, wherein the task response message (430) is an ActivateTaskResponse message to the ActivateTaskRequest message.

10. The first LI ADMF communication device (202) according to claim 6, wherein the task request message (420) comprises the fields of ModifyTaskRequest message and an InfoOnTaskChange field, wherein the InfoOnTaskChange comprises the first indication to notify about the change of the status of the LI task.

11. The first LI ADMF communication device (202) according to claim 10 when depending on claim 4, wherein the task request message (420) comprises a field TaskSequenceNumber, wherein the TaskSequenceNumber comprises the task sequence number (415).

12. The first LI ADMF communication device (202) according to any of claims I Q- 11 , wherein the task response message (430) is a ModifyTaskResponse message to the ModifyTaskRequest message.

13. The first LI ADMF communication device (202) according to claim 6, wherein the task request message (420) comprises the fields of DeactivateTaskRequest message and an InfoOnTaskChange filed, wherein the InfoOnTaskChange comprises the first indication to notify about the change of the status of the LI task.

14. The first LI ADMF communication device (202) according to claim 13 when dependent to claim 4, wherein the task request message (420) comprises a field TaskSequenceNumber, wherein the TaskSequenceNumber comprises the task sequence number (415).

15. The first LI ADMF communication device (202) according to any of claims 13- 14, wherein the task response message (430) is a DeactivateTaskResponse message to the DeactivateTaskRequest message.

16. The first LI ADMF communication device (202) according to any of claims 1 -15, wherein the report request message (440) is a report issue request sent from the first NE communication device (203) to the first LI ADMF communication device (202) after the first NE communication device (203) has identified that the status of the LI task has changed.

17. A first network element, NE, (203) for lawful interception, LI, task handling, the first NE communication device (203) is configured to: - receive a task request message (420), from a first LI Administrative Function, ADMF, communication device (202), to perform an action associated with an LI task, wherein the task request message (420) comprises a first indication (510) to notify about a change of status of the LI task;

- store a second status of the LI task based on the task request message (420);

- send a task response message (430), to the first LI ADMF communication device (202), wherein the task response message (430) comprises a result (610) associated with the task request message (420);

- send, to the first LI ADMF communication device (202), if the status of the LI task has changed, a report request message (440) comprising the second status (710) of the LI task; and

- receive, from the first LI ADMF communication device (202), a report response message (460).

18. The first NE communication device (203) according to claim 17, wherein the task request message (420) comprises a task sequence number (415) associated to the LI task.

19. The first NE communication device (203) according to any of claims 17-18, wherein the task response message (430) comprises information representative of any one of the following:

20. The first NE communication device (203) according to any of claims 17-19, wherein the task request message (420) is an ActivateTaskRequest message, a ModifyTaskRequest message, or a DeactivateTaskRequest.

21. The first NE communication device (203) according to claim 20, wherein the task response message (430) is an ActivateTaskResponse message to the ActivateTaskRequest message.

22. The first NE communication device (203) according to claim 21 , wherein the task request message (420) comprises the fields of ActivateTaskRequest message and an InfoOnTaskChange filed, wherein the InfoOnTaskChange comprises the first indication (510) to notify about the change of the status of the LI task.

23. The first NE communication device (203) according to any of claims 18-22, wherein the task request message (420) comprises a field TaskSequenceNumber, wherein the TaskSequenceNumber comprises the task sequence number (415).

24. The first NE communication device (203) according to claim 20, wherein the task response message (430) is a ModifyTaskResponse message to the ModifyTaskRequest message.

25. The first NE communication device (203) according to claim 24, wherein the task request message (420) comprises the fields of ModifyTaskRequest message and an InfoOnTaskChange filed, wherein the InfoOnTaskChange comprises the first indication (510) to notify about the change of the status of the LI task.

26. The first NE communication device (203) according to any of claims 24-25 when depending on 18, wherein the task request message (420) comprises a field TaskSequenceNumber, wherein the TaskSequenceNumber comprises the task sequence number (415).

27. The first NE communication device (203) according to claim 20, wherein the task response message (430) is a DeactivateTaskResponse message to the DeactivateTaskRequest message.

28. The first NE communication device (203) according to claim 28, wherein the task request message (420) comprises the fields of DeactivateTaskRequest message and an InfoOnTaskChange filed, wherein the InfoOnTaskChange comprises the first indication (510) to notify about the change of the status of the LI task.

29. The first NE communication device (203) according to any of claims 27-28 when depending on 18, wherein the task request message (420) comprises a field TaskSequenceNumber, wherein the TaskSequenceNumber comprises the task sequence number (415).

30. The first NE communication device (203) according to any of claims 17-29, wherein the report message (440) is a report issue request sent from the first NE communication device (203) to the first LI ADMF communication device (202) after the first NE communication device (203) has identified that the status of the LI task has changed.

31. A method (300) performed, by a first Lawful Interception, LI, Administrative Function, ADMF, communication device (202) for LI task handling, the method comprising:

- storing (310) a first status (410) of an LI task;

- sending (320) a task request message (420), to a first Network Element, NE, communication device (203), to perform an action associated with the LI task, wherein the task request message (420) comprises a first indication (510) to notify about a change of the status of the LI task;

- receiving (330) a task response message (430), from the first NE communication device (203), wherein the task response message (430) comprises a result (610) associated with the task request message (420); - receiving (340), from the first NE communication device (203), if the status of the LI task has changed, a report request message (440) comprising a second status (710) of the LI task;

- comparing (350) the received second status (710) to the stored first status (410);

- performing (360) an action based on the comparison; and

- sending (370), to the first NE communication device (203), a report response message (460).

32. The method (300) according to claim 31 , the method comprising:

- generating (313) a task sequence number (415) associated to the LI task; and

- storing (316) the task sequence number (415).

33. The method (300) according to claim 32, wherein the task request message (420) comprises the task sequence number (415) associated to the LI task.

34. The method (300) according to any of claims 32-33, wherein the report request message (440) comprises the task sequence number (415).

35. The method (300) according to any of claims 31 -34, wherein the task response message (440) comprises information representative of any one of the following:

36. The method (300) according to any of claims 31 -35 wherein the task request message (420) is an ActivateTaskRequest message, a ModifyTaskRequest message, or a DeactivateTaskRequest.

37. The method (300) according to claim 36, wherein the task request message (420) comprises the fields of ActivateTaskRequest and an InfoOnTaskChange field, wherein the InfoOnTaskChange comprises the first indication (510) to notify about the change of the status of the LI task.

38. The method (300) according to any of claims 36-37, when dependent to claim 34, wherein the task request message (420) comprises a field TaskSequenceNumber, wherein the TaskSequenceNumber comprises the task sequence number (415).

39. The method (300) according to any of claims 36-38, wherein the task response message (430) is an ActivateTaskResponse message to the ActivateTaskRequest message.

40. The method (300) according to claim 36, wherein the task request message (420) comprises the fields of ModifyTaskRequest message and an InfoOnTaskChange field, wherein the InfoOnTaskChange comprises the first indication (510) to notify about the change of the status of the LI task.

41. The method (300) according to claim 40 when depending on claim 34, wherein the task request message (420) comprises a field TaskSequenceNumber, wherein the TaskSequenceNumber comprises the task sequence number (415).

42. The method (300) according to any of claims 40-41 , wherein the task response message (430) is a ModifyTaskResponse message to the ModifyTaskRequest message.

43. The method (300) according to claim 36, wherein the task request message (420) comprises the fields of DeactivateTaskRequest message and an InfoOnTaskChange filed, wherein the InfoOnTaskChange comprises the first indication (510) to notify about the change of the status of the LI task.

44. The method (300) according to claim 43 when dependent to claim 34, wherein the task request message (420) comprises a field TaskSequenceNumber, wherein the TaskSequenceNumber comprises the task sequence number (415).

45. The method (300) according to any of claims 43-44, wherein the task response message (430) is a DeactivateTaskResponse message to the DeactivateTaskRequest message.

46. The method (300) according to any of claims 31 -45, wherein the report request message (440) is a report issue request sent from the first NE communication device (203) to the first LI ADMF communication device (202) after the first NE communication device (203) has identified that the status of the LI task has changed.

47. A method (800) performed by a first network element, NE, communication device (203) for lawful interception, LI, task handling, the method comprising:

- receiving (810) a task request message (420), from a first LI Administrative Function, ADMF, communication device (202), to perform an action associated with an LI task, wherein the task request message (420) comprises a first indication (510) to notify about a change of status of the LI task;

- storing (820) a second status of the LI task based on the task request message (420);

- sending (830) a task response message (430), to the first LI ADMF communication device (202), wherein the task response message (430) comprises a result (610) associated with the task request message (420);

- sending (840), to the first LI ADMF communication device (202), if the status of the LI task has changed, a report request message (440) comprising the second status (710) of the LI task; and

- receiving (850), from the first LI ADMF communication device (202), a report response message (460).

48. The method (800) according to claim 47, wherein the task request message (420) comprises a task sequence number (415) associated to the LI task.

49. The method (800) according to any of claims 47-48, wherein the task response message (420) comprises information representative of any one of the following:

50. The method (800) according to any of claims 47-49, wherein the task request message (420) is an ActivateTaskRequest message, a ModifyTaskRequest message, or a DeactivateTaskRequest.

51. The method (800) according to claim 50, wherein the task response message (430) is an ActivateTaskResponse message to the ActivateTaskRequest message.

52. The method (800) according to claim 51 , wherein the task request message (420) comprises the fields of ActivateTaskRequest message and an InfoOnTaskChange filed, wherein the InfoOnTaskChange comprises the first indication (510) to notify about the change of the status of the LI task.

53. The method (800) according to any of claims 48-52, wherein the task request message (420) comprises a field TaskSequenceNumber, wherein the TaskSequenceNumber comprises the task sequence number (415).

54. The method (800) according to claim 50, wherein the task response message

(430) is a ModifyTaskResponse message to the ModifyTaskRequest message.

55. The method (800) according to claim 54, wherein the task request message (420) comprises the fields of ModifyTaskRequest message and an InfoOnTaskChange filed, wherein the InfoOnTaskChange comprises the first indication (510) to notify about the change of the status of the LI task.

56. The method (800) according to any of claims 54-55 when depending on 48, wherein the task request message (420) comprises a field TaskSequenceNumber, wherein the TaskSequenceNumber comprises the task sequence number (415).

57. The method (800) according to claim 50, wherein the task response message (430) is a DeactivateTaskResponse message to the DeactivateTaskRequest message.

58. The method (800) according to claim 48, wherein the task request message (420) comprises the fields of DeactivateTaskRequest message and an InfoOnTaskChange filed, wherein the InfoOnTaskChange comprises the first indication (510) to notify about the change of the status of the LI task.

59. The method (800) according to any of claims 57-58 when depending on 48, wherein the task request message (420) comprises a field TaskSequenceNumber, wherein the TaskSequenceNumber comprises the task sequence number (415).

60. The method (800) according to any of claims 47-59, wherein the report message (440) is a report issue request sent from the first NE communication device (203) to the first LI ADMF communication device (202) after the first NE communication device (202) has identified that the status of the LI task has changed.

61. A computer program (1130) comprising instructions, which when executed on a first lawful interception, LI, administrative function, ADMF, communication device (202), causes the first LI ADMF communication device (202) to perform the method (300) according to one or more of claims 31 -46.

62. A computer program (1230) comprising instructions, which when executed on a first network element, NE, communication device (203), causes the first NE communication device (203) to perform the method (800) according to one or more of claims 47-60.

63. A computer readable storage medium (1125, 1225) comprising a computer program (1130, 1230) according to claim 61 and/or claim 62.

64. A second lawful interception, LI, Administrative Function, ADMF communication device (1302), for audit and synchronization of LI tasks, the second LI ADMF communication device (1302) is configured to:

- send an information request message (1510), to a second Network Element, NE, communication device (1303), to determine details related to one or more LI tasks, wherein the information request message (1510) comprises a task status (1610) that the one or more LI tasks are to be in, a last modification time value (1620); and/or a last task sequence number value (1630); and

- receive, from the second NE communication device (1303), an information response message (1520) that comprises one or more LI tasks that are in the requested status (1610), that are modified after or at a time equal to the last modification time value (1620), and/or that have a task sequence number (1630) greater or equal to the last sequence number value.

65. The second LI ADMF communication device (1302) according to claim 64, wherein the information request message (1510) is a GetAIIDetailsRequest message, or a GetAIITaskDetailsRequest message.

66. The second LI ADMF communication device (1302) according to claim 66, wherein the information request message (1510) comprises the fields of GetAIIDetailsRequest message and comprises one or more of: - a Status field comprising the task status (1610);

- a LastModificationTime field comprising the last modification time value (1620); and

- a LastTaskSequenceNumber field comprising the last task sequence number value (1630).

67. The second LI ADMF communication device (1302) according to any of claims 64-66, wherein the information response message (1520) is a GetAIIDetailsResponse message to the GetAIIDetailsRequest message.

68. The second LI ADMF communication device (1302) according to claim 67, wherein the information request message (1510) comprises the fields of GetAIITaskDetailsRequest message and comprises one or more of:

- a Status field comprising the status (1610);

69. The second LI ADMF communication device (1302) according to any of claims 64-66, wherein the information response message (1520) is a GetAIITaskDetailsResponse message to the GetAIITaskDetailsRequest message.

70. The second LI ADMF communication device (1302) according to any of claims 64-69, is configured to:

- send a second information request message (1530), to the second NE communication device (1303), to retrieve a list of LI tasks, wherein the second information request message (1530) comprises a second indication (1710) on whether to indicate a last modification time value of the LI tasks, a third indication (1720) on whether to indicate a status of the LI tasks, a fourth indication (1730) on whether to indicate a task sequence number of the LI tasks, and/or a fifth indication (1740) on whether to report deactivated tasks; and - receive, from the second NE communication device (1303), a second information response message (1540), wherein the second information response message (1540) comprises a list of one or more LI tasks, wherein for each of the LI tasks in the list, the last modification time value is indicated based to the second information request message (1530), the status is indicated based on the second information request message (1530), and/or the task sequence number is indicated based on the second information request message (1530).

71. The second LI ADMF communication device (1302) according to any of claims 70, wherein the second information request message (1530) is a ListAIIDetailsRequest message.

72. The second LI ADMF communication device (1302) according to any of claims 70-71 , wherein the second information response message (1540) is a ListAIIDetailsResponse message.

73. A second Network Element, NE, communication device (1303) for audit and synchronization of Lawful Interception, LI, tasks, the second NE communication device (1303) being configured to:

- receive an information request message (1510), from a second LI Administrative Function, ADMF, communication device (1302), to determine details related to one or more LI tasks, wherein the information request message (1510) comprises a task status (1610) that the LI tasks are to be in, a last modification time value (1620), and/or a last task sequence number value (1630); and

- send, to the second LI ADMF communication device (1302), an information response message (1520) that comprises one or more LI tasks that are in the requested state (1610), that are modified after or at a time equal to the last modification time value (1620), and/or that have a task sequence number greater or equal to the last sequence number value (1630).

74. The second NE communication device (1303) according to claim 73, wherein the information request message (1510) is a GetAIIDetailsRequest message, or a GetAIITaskDetailsRequest message.

75. The second NE communication device (1303) according to claim 74, wherein the information request message (1510) comprises the fields of GetAIIDetailsRequest message and comprises one or more of:

- a Status field comprising the task status (1610);

76. The second NE communication device (1303) according to any of claims 74- 75, wherein the information response message (1520) is a GetAIIDetailsResponse message to the GetAIIDetailsRequest message.

77. The second NE communication device (1303) according to claim 73, wherein the information request message (1510) comprises the fields of GetAIITaskDetailsRequest message and comprises one or more of:

- a Status field comprising the task status (1610);

78. The second NE communication device (1303) according to claim 73 or claims

77, wherein the information response message (1520) is a GetAIITaskDetailsResponse message to the GetAIITaskDetailsRequest message.

79. The second NE communication device (1303) according to any of claims 73-

78, is configured to: - receive a second information request message (1530), from the second LI ADMF communication device (1302), to retrieve a list of LI tasks, wherein the second information request message (1530) comprises a second indication (1710) whether to indicate a last modification time value of the LI tasks, a third indication (1720) whether to indicate a status of the LI tasks, a fourth indication (1730) whether to indicate a task sequence number of the LI tasks, and/or a fifth indicate (1740) whether to report deactivated tasks; and

- send, to the second LI ADMF communication device (1302), a second information response message (1540), wherein the second information response message (1540) comprises a list of one or more LI tasks, wherein for each of the LI tasks in the list, the last modification time value is indicated based to the second information request message (1530), the status is indicated based on the second information request message (1530), and/or the task sequence number is indicated based on the second information request message (1530).

80. The second NE communication device (1303) according to claim 79, wherein the second information request message (1530) is a ListAIIDetailsRequest message.

81. The second NE communication device (1303) according to any of claims 79- 80, wherein the second information response message (1540) is a ListAIIDetailsResponse message.

82. A method (1400) performed by a second lawful interception, LI, Administrative Function, ADMF communication device (1302), for audit and synchronization of LI tasks, the method comprising:

- sending (1410) an information request message (1510), to a second Network Element, NE, communication device (1303), to determine details related to one or more LI tasks, wherein the information request message (1510) comprises a task status (1610) that the one or more LI tasks are to be in, a last modification time value (1620), and/or a last task sequence number value (1630); and

- receiving (1420), from the second NE communication device (1303), an information response message (1520) that comprises one or more LI tasks that are in the requested state (1610), that are modified after or at a time equal to the last modification time value (1620), and/or that have a task sequence number greater or equal to the last sequence number value (1630).

83. The method (1400) according to claim 82, wherein the information request message (1510) is a GetAIIDetailsRequest message, or a GetAIITaskDetailsRequest message.

84. The method (1400) according to claim 83, wherein the information request message (1510) comprises the fields of GetAIIDetailsRequest message and comprises one or more of:

- a Status field comprising the task status (1610);

85. The method (1400) according to any of claims 82-84, wherein the information response message (1520) is a GetAIIDetailsResponse message to the GetAIIDetailsRequest message.

86. The method (1400) according to claim 85, wherein the information request message (1510) comprises the fields of GetAIITaskDetailsRequest message and comprises one or more of:

- a Status field comprising the status (1610);

87. The method (1400) according to any of claims 83-86, wherein the information response message (1520) is a GetAIITaskDetailsResponse message to the GetAIITaskDetailsRequest message.

88. The method (1400) according to any of claims 82-87, the method comprising:

- sending (1430) a second information request message (1530), to the second NE communication device (1303), to retrieve a list of LI tasks, wherein the second information request message (1530) comprises a second indication (1710) on whether to indicate a last modification time value of the LI tasks, a third indication (1720) on whether to indicate a status of the LI tasks, a fourth indication (1730) on whether to indicate a task sequence number of the LI tasks, and/or a fifth indication (1740) on whether to report deactivated tasks; and

- receiving (1440), from the second NE communication device (1303), a second information response message (1540), wherein the second information response message (1540) comprises a list of one or more LI tasks, wherein for each of the LI tasks in the list, the last modification time value is indicated based to the second information request message (1530), the status is indicated based on the second information request message (1530), and/or the task sequence number is indicated based on the second information request message (1530).

89. The method (1400) according to any of claims 88, wherein the second information request message (1530) is a ListAIIDetailsRequest message.

90. The method (1400) according to any of claims 88-89, wherein the second information response message (1540) is a ListAIIDetailsResponse message.

91 .A method (1800) performed by a second Network Element, NE, communication device (1303) for audit and synchronization of Lawful Interception, LI, tasks, the method comprising:

- receiving (1810) an information request message (1510), from a second LI Administrative Function, ADMF, communication device (1302), to determine details related to one or more LI tasks, wherein the information request message (1510) comprises a task status (1610) that the LI tasks are to be in, a last modification time value (1620), and/or a last task sequence number value (1630); and

- sending (1820), to the second LI ADMF communication device (1302), an information response message (1520) that comprises one or more LI tasks that are in the requested state (1610), that are modified after or at a time equal to the last modification time value (1620), and/or that have a task sequence number greater or equal to the last sequence number value (1630).

92. The method (1800) according to claim 91 , wherein the information request message (1510) is a GetAIIDetailsRequest message, or a GetAIITaskDetailsRequest message.

93. The method (1800) according to claim 92, wherein the information request message (1510) comprises the fields of GetAIIDetailsRequest message and comprises one or more of:

- a Status field comprising the task status (1610);

94. The method (1800) according to any of claims 92-93, wherein the information response message (1520) is a GetAIIDetailsResponse message to the GetAIIDetailsRequest message.

95. The method (1800) according to claim 94, wherein the information request message (1520) comprises the fields of GetAIITaskDetailsRequest message and comprises one or more of:

- a Status field comprising the task status (1610);

- a LastModificationTime field comprising the last modification time value (1620); and a LastTaskSequenceNumber field comprising the last task sequence number value (1630).

96. The method (1800) according to claim 92 or claim 95, wherein the information response message (1520) is a GetAIITaskDetailsResponse message to the GetAIITaskDetailsRequest message.

97. The method (1800) according to any of claims 91 -96, the method comprising:

- receiving (1830) a second information request message (1530), from the second LI ADMF communication device (1302), to retrieve a list of LI tasks, wherein the second information request message (1530) comprises a second indication (1710) whether to indicate a last modification time value of the LI tasks, a third indication (1720) whether to indicate a status of the LI tasks, a fourth indication (1730) whether to indicate a task sequence number of the LI tasks, and/or a fifth indication (1740) whether to report deactivated tasks; and

- sending (1840), to the second LI ADMF communication device (1302), a second information response message (1540), wherein the second information response message (1540) comprises a list of one or more LI tasks, wherein for each of the LI tasks in the list, the last modification time value is indicated based to the second information request message (1530), the status is indicated based on the second information request message (1530), and/or the task sequence number is indicated based on the second information request message (1530).

98. The method (1800) according to claim 97, wherein the second information request message (1530) is a ListAIIDetailsRequest message.

99. The method (1800) according to any of claims 97-98, wherein the second information response message (1540) is a ListAIIDetailsResponse message.

100. A computer program (2130) comprising instructions, which when executed on a second lawful interception, LI, administrative function, ADMF, communication device (1302), causes the second LI ADMF communication device (1302) to perform the method (1400) according to one or more of claims 82-90. 101. A computer program (2230) comprising instructions, which when executed on a second network element, NE, communication device (1303), causes the second NE communication device (1303) to perform the method (1800) according to one or more of claims 91-99. 102. A computer readable storage medium (21 ,25, 2225) comprising a computer program (2130, 2230) according to claim 100 and/or claim 101.