{"id":2167,"date":"2026-08-05T08:00:00","date_gmt":"2026-08-05T07:00:00","guid":{"rendered":"https:\/\/ic-services.io\/?p=2167"},"modified":"2026-10-21T14:10:56","modified_gmt":"2026-10-21T13:10:56","slug":"segmentacion-de-red-5g-interceptacion-legal","status":"publish","type":"post","link":"https:\/\/ic-services.io\/es\/resources\/blog\/network-slicing-5g-lawful-interception\/","title":{"rendered":"El \u00abnetwork slicing\u00bb en 5G SA: c\u00f3mo complica (y puede simplificar) la selecci\u00f3n de objetivos de LI"},"content":{"rendered":"

La tecnolog\u00eda de segmentaci\u00f3n de red 5G plantea tanto retos como oportunidades para el cumplimiento de la interceptaci\u00f3n legal. La segmentaci\u00f3n de red es una de las capacidades definitorias de la arquitectura 5G aut\u00f3noma (SA). Al crear particiones de red aisladas l\u00f3gicamente sobre una infraestructura f\u00edsica compartida, los operadores pueden adaptar las caracter\u00edsticas de conectividad \u2014latencia, ancho de banda, fiabilidad y seguridad\u2014 a los requisitos espec\u00edficos de los distintos servicios, aplicaciones o grupos de clientes. En lo que respecta a la interceptaci\u00f3n legal, la segmentaci\u00f3n de red plantea complicaciones significativas y, parad\u00f3jicamente, posibles simplificaciones. Comprender c\u00f3mo afecta la segmentaci\u00f3n a la selecci\u00f3n de objetivos, la ejecuci\u00f3n y la entrega de la interceptaci\u00f3n legal es esencial para cualquier operador que implemente o planifique una red 5G SA.<\/p>\n\n\n\n

Este art\u00edculo analiza la relaci\u00f3n entre el \u00abnetwork slicing\u00bb y la interceptaci\u00f3n legal, abordando la arquitectura t\u00e9cnica, los retos que plantean la identificaci\u00f3n de objetivos y la ejecuci\u00f3n de la interceptaci\u00f3n, as\u00ed como los posibles beneficios que el \u00abnetwork slicing\u00bb puede ofrecer para Operaciones de LI<\/a>, y las medidas pr\u00e1cticas que deben adoptar los operadores para garantizar el cumplimiento normativo en un entorno de red segmentada.<\/p>\n\n\n\n

C\u00f3mo afecta el \u00abnetwork slicing\u00bb 5G a LI<\/h2>\n\n\n\n

In a 5G SA network, a network slice is a logically isolated end-to-end network that includes specific configurations of radio access, transport, and core network resources. Each slice is identified by a Single Network Slice Selection Assistance Information (S-NSSAI) value and is designed to meet particular service requirements. For example, one slice might be optimised for ultra-reliable low-latency communication (URLLC) for industrial control, another for massive IoT (MIoT) sensor networks, and a third might provide enhanced mobile broadband (eMBB) for consumer smartphones.<\/p>\n\n\n\n

Desde el punto de vista de la red central, cada \u00abslice\u00bb puede tener sus propias instancias dedicadas de determinadas funciones de red \u2014como el SMF, el UPF y el PCF\u2014 o puede compartir instancias de funciones de red con otros \u00abslices\u00bb. El grado de aislamiento entre las \u00abslices\u00bb es configurable y depende de la estrategia de despliegue del operador y de los requisitos de la \u00abslice\u00bb. Esta flexibilidad es una ventaja clave del \u00abslicing\u00bb, pero tambi\u00e9n introduce complejidad para las funciones que deben operar m\u00e1s all\u00e1 de los l\u00edmites de las \u00abslices\u00bb, incluida la interceptaci\u00f3n legal.<\/p>\n\n\n\n

A single subscriber may simultaneously use services across multiple slices. A smartphone user might have their voice traffic routed through one slice, their video streaming through another, and their IoT companion device connected through a third. Each slice may have its own UPF, its own PDU session, and its own IP addressing. Which slice carries which traffic is decided by the device’s route selection policy (URSP), within the slices the network allows, selected with the help of the NSSF and the subscription data in the UDM.<\/p>\n\n\n\n

Complicaciones relacionadas con la orientaci\u00f3n hacia LI<\/h2>\n\n\n\n

Network slicing complicates LI targeting in several ways. The most fundamental complication is that a target’s traffic may be spread across multiple slices, each potentially served by different UPF instances. A single interception order must result in the capture of all the target’s communications, regardless of which slice they traverse. This requires the operator to equip every network function that can serve the target, including dedicated per-slice SMFs and UPFs, with LI functions, and to provision the task to all of them.<\/p>\n\n\n\n

Target identification in a sliced environment is more complex than in a non-sliced network. The same subscriber may appear with different session contexts, different IP addresses, and different QoS characteristics depending on which slice is serving a particular communication flow. Every interception point tags its X2\/X3 records with the task\u2019s XID, so the mediation function delivers every session in every slice under the same LIID, and the IRI tells the LEA which slice (S-NSSAI) each session used.<\/p>\n\n\n\n

The dynamic nature of slice allocation adds further complexity. Slices can be created, modified, and terminated dynamically, and a target’s traffic may move between slices as service requirements change. If the task was provisioned only to the network functions of some slices, a change in the target\u2019s subscribed slices (which the UDM reports as IRI) can leave a gap, and the administration function must extend the task to the SMFs of the new slices. Provisioning every SMF that can serve the target avoids this, because UPF interception is then triggered per session.<\/p>\n\n\n\n

Another complication arises from the potential for different slices to be operated by different entities. In some business models, an enterprise or vertical industry partner may operate its own slice on the operator’s infrastructure, potentially with its own network functions and operational management. The question of who is responsible for lawful interception within such a slice \u2014 the infrastructure operator, the slice tenant, or both \u2014 is a regulatory and contractual question. In most frameworks the answer follows the service: whoever provides a publicly available communications service over the slice carries the LI obligation. A private enterprise slice that is not offered to the public is usually out of scope, and the infrastructure operator remains responsible for the parts of its network that serve public services. Contracts must reflect this, and the operator must keep its LI functions secure even in slices it does not manage.<\/p>\n\n\n\n

C\u00f3mo el \u00abslicing\u00bb puede simplificar el LI<\/h2>\n\n\n\n

Despite these complications, network slicing can also offer potential benefits for lawful interception. The logical isolation of slices means that traffic within a slice is already segregated from traffic in other slices. If the target can only use certain slices, the administration function can provision the task only to the network functions of those slices (3GPP TS 33.127, clause 5.3.5.5), which keeps the number of provisioned interception points small.<\/p>\n\n\n\n

Slicing can also enable more granular interception. Instead of intercepting all of a target’s traffic \u2014 which in a modern smartphone environment can include significant volumes of background data, software updates, and other non-relevant traffic \u2014 slicing could potentially allow the interception to be focused on specific service types or communication flows. In practice, however, limiting interception to particular slices is generally not an option: national rules such as \u00a7 5(2) TK\u00dcV in Germany require a complete copy of the target’s communications. Where an order covers only certain services, the standards provide service scoping by service type, not by slice.<\/p>\n\n\n\n

Desde el punto de vista de la seguridad, el aislamiento entre las \u00abslices\u00bb puede proporcionar una protecci\u00f3n adicional a la funci\u00f3n LI. Al implementar los componentes LI dentro de una \u00abslice\u00bb dedicada y segura \u2014o al garantizar que el tr\u00e1fico LI entre las funciones de red y el plataforma de mediaci\u00f3n<\/a> is carried on a separate, isolated transport path \u2014 operators can enhance the confidentiality and integrity of the interception process. Slice isolation can help, but LI functions still need their own protected trust domain. In virtualised networks 3GPP requires them to meet ETSI GS NFV-SEC 012 (TS 33.126, R6.6-160).<\/p>\n\n\n\n

Normas 3GPP para la LI en redes segmentadas<\/h2>\n\n\n\n

The 3GPP LI architecture for 5G, defined in TS 33.127 and TS 33.128, addresses network slicing explicitly. 3GPP’s LI requirements (TS 33.126) are technology-neutral: interception must be complete regardless of how the network is built, and that includes slicing. TS 33.127 and TS 33.128 add slice-aware provisioning and report slice information (S-NSSAI) in the IRI. On X1, a task names the target and, optionally, the service types to intercept. Slices are not an X1 parameter. Instead, the administration function decides which network functions, and therefore which slices, receive the task (3GPP TS 33.127, clause 5.3.5.5), and the X2 and X3 interfaces carry xIRI and xCC from interception points in any slice to the MDF, which turns them into IRI and CC for delivery.<\/p>\n\n\n\n

The standards define that the AMF, which handles the target’s registration and mobility management, is a key interception point for slice-related IRI. When a target registers with the network and is allocated to one or more slices, the AMF generates IRI events that include the slice information. CC interception in the UPF is triggered per PDU session: the SMF serving that session, which holds the LI task, instructs its UPF over the internal LI_T3 interface. The operator must therefore make sure every SMF that can serve the target, in every slice, carries the task and that every UPF supports LI_T3 and X3.<\/p>\n\n\n\n

The UDM is itself an interception point: it reports changes to the target’s subscribed slices as IRI. To keep coverage complete as slices change, the LI administration function learns about new SMFs and UPFs from the operator\u2019s management and orchestration systems when they are instantiated, and from the System Information Retrieval Function (SIRF) in the NRF when they register and are ready for traffic (3GPP TS 33.127, clauses 5.3.5.3 and 5.3.6).<\/p>\n\n\n\n

Implicaciones pr\u00e1cticas para los operadores<\/h2>\n\n\n\n

Operators deploying 5G SA networks with slicing capabilities should address LI requirements from the earliest stages of slice design and deployment. Several practical steps are recommended. First, ensure that your LI system is aware of the slice architecture and can dynamically discover and configure interception points within any slice. This requires integration between the LI administration function and the operator’s orchestration systems and the NRF-based System Information Retrieval Function (SIRF), so that new SMFs and UPFs are provisioned as they are created.<\/p>\n\n\n\n

Second, verify that the UPFs deployed within each slice support the LI_T3 trigger and the X3 interface for content delivery to the LI mediation function, and that the SMFs serving those slices support the IRI point of interception and the CC triggering function. If a slice uses a UPF that does not support X3, the operator will have a gap in its interception capability for traffic traversing that slice. This is a procurement requirement that should be included in all UPF vendor specifications.<\/p>\n\n\n\n

Third, develop procedures for handling interception orders that span multiple slices. The LI operations team must understand how to provision tasks that cover all of a target’s slice allocations and when the administration function has to extend a task to the network functions of additional slices. Automation of this process is highly recommended, as manual configuration across multiple slices is error-prone and slow.<\/p>\n\n\n\n

En cuarto lugar, hay que abordar los aspectos relacionados con la gobernanza y los aspectos contractuales de la interceptaci\u00f3n legal en los segmentos compartidos o gestionados por la empresa. Si hay terceros que gestionan segmentos en su infraestructura, las responsabilidades en materia de interceptaci\u00f3n legal deben definirse claramente en los acuerdos comerciales y deben ajustarse a los requisitos normativos de cada jurisdicci\u00f3n pertinente.<\/p>\n\n\n\n

Conclusi\u00f3n<\/h2>\n\n\n\n

La segmentaci\u00f3n de red en 5G SA plantea tanto retos como oportunidades para la interceptaci\u00f3n legal. La distribuci\u00f3n del tr\u00e1fico de un objetivo entre m\u00faltiples segmentos, la naturaleza din\u00e1mica de la asignaci\u00f3n de segmentos y la posibilidad de que terceros gestionen dichos segmentos complican el proceso de interceptaci\u00f3n. Al mismo tiempo, el aislamiento l\u00f3gico y la granularidad de la segmentaci\u00f3n pueden ofrecer nuevos enfoques para una interceptaci\u00f3n selectiva y eficiente. Para los operadores, la clave est\u00e1 en abordar de forma proactiva los requisitos de interceptaci\u00f3n legal (LI) en el dise\u00f1o de las rebanadas, garantizar que sus sistemas de LI tengan en cuenta las rebanadas y sean din\u00e1micamente adaptables, y establecer una gobernanza clara de las responsabilidades de interceptaci\u00f3n en entornos de rebanadas multitenant. De este modo, los operadores pueden cumplir con sus obligaciones de conformidad al tiempo que aprovechan todo el potencial del segmentado de red 5G.<\/p>\n\n\n

De cara al futuro, la evoluci\u00f3n del \u00abnetwork slicing\u00bb hacia modelos m\u00e1s din\u00e1micos y basados en la intenci\u00f3n aumentar\u00e1 a\u00fan m\u00e1s la complejidad de la interceptaci\u00f3n de tr\u00e1fico (LI) en entornos segmentados. Las redes del futuro podr\u00edan contar con segmentos que se crean y se eliminan bajo demanda, con recursos asignados y liberados en tiempo real en funci\u00f3n de las necesidades del servicio. El sistema de LI debe evolucionar al mismo ritmo que estas capacidades, manteniendo una cobertura de interceptaci\u00f3n exhaustiva incluso cuando la topolog\u00eda de la red subyacente cambie continuamente. Los operadores que inviertan en soluciones flexibles y conformes con los est\u00e1ndares Soluciones LI<\/a> hoy estar\u00e1n mejor preparadas para adaptarse a estos avances futuros y para mantener el cumplimiento normativo de forma ininterrumpida a medida que sus redes 5G vayan madurando.<\/p>\n\n\n\n

A medida que maduren los despliegues de 5G con segmentaci\u00f3n de red, los retos relacionados con la interceptaci\u00f3n ir\u00e1n evolucionando. Los operadores deber\u00edan dise\u00f1ar su arquitectura LI de 5G con segmentaci\u00f3n de red teniendo en cuenta la escalabilidad futura.<\/p>\n\n\n\n

Art\u00edculos relacionados<\/h2>\n\n\n\n

Si desea leer m\u00e1s sobre temas relacionados, consulte estos art\u00edculos:<\/p>\n\n\n\n