{"id":2152,"date":"2026-06-10T08:00:00","date_gmt":"2026-06-10T07:00:00","guid":{"rendered":"https:\/\/ic-services.io\/?p=2152"},"modified":"2026-10-21T14:11:12","modified_gmt":"2026-10-21T13:11:12","slug":"fonction-de-mediation-interception-legale","status":"publish","type":"post","link":"https:\/\/ic-services.io\/fr\/resources\/blog\/mediation-function-lawful-interception\/","title":{"rendered":"Comment fonctionne une fonction de m\u00e9diation : Le pont entre votre r\u00e9seau et les forces de l'ordre"},"content":{"rendered":"

Dans l\u2019architecture de tout syst\u00e8me d\u2019interception l\u00e9gal, la fonction de m\u00e9diation occupe une place essentielle. Elle se situe entre l\u2019infrastructure r\u00e9seau de l\u2019op\u00e9rateur \u2014 o\u00f9 les communications sont g\u00e9n\u00e9r\u00e9es, achemin\u00e9es et trait\u00e9es \u2014 et le centre de surveillance des forces de l'ordre<\/a> (LEMF), where intercepted material is received and analysed. The mediation function is the component that translates the intercept records delivered by the network’s points of interception into the standardised formats required by the handover interfaces, ensuring that what law enforcement receives is complete, correctly formatted, and delivered securely.<\/p>\n\n\n\n

Malgr\u00e9 son importance, la fonction de m\u00e9diation est souvent l\u2019un des \u00e9l\u00e9ments les moins bien compris de l\u2019architecture LI. Cet article explique de mani\u00e8re exhaustive le r\u00f4le de la fonction de m\u00e9diation, son fonctionnement, son caract\u00e8re essentiel, ainsi que les \u00e9l\u00e9ments que les op\u00e9rateurs doivent prendre en compte lors de la conception ou du choix d\u2019un plateforme de m\u00e9diation<\/a>.<\/p>\n\n\n\n

La fonction de m\u00e9diation dans l'architecture ETSI<\/h2>\n\n\n\n

In the classic ETSI model (TS 101 671), several functional components work together to execute an interception. An internal interception function (IIF) operates within network elements or in dedicated probes\/taps \u2014 switches, session border controllers, packet gateways, and other infrastructure components \u2014 to identify and capture the target’s communications. A mediation function (MF) receives this captured data from the IIF and processes it for delivery to the LEMF over HI2 (IRI) and HI3 (CC). HI1, the administrative interface, terminates at the operator’s administration function. Current ETSI and 3GPP architectures (TS 104 007, TS 103 221, 3GPP TS 33.127) call these the point of interception (POI) and the mediation and delivery function (MDF), linked by the standardised X2\/X3 interfaces.<\/p>\n\n\n\n

The mediation function is the point at which the operator-internal intercept records \u2014 standardised xIRI and xCC received over X2 and X3 (ETSI TS 103 221-2, 3GPP TS 33.128) \u2014 are converted into the handover formats that law enforcement systems expect. The MF adds what the network elements do not know: the LIID, the delivery destinations and the national handover profile. Legacy network elements with proprietary LI interfaces still exist, but they are the exception; some network elements can even deliver handover formats directly. The mediation function provides the necessary translation, normalisation, and formatting to ensure interoperability.<\/p>\n\n\n\n

Dans la pratique, la fonction de m\u00e9diation est g\u00e9n\u00e9ralement mise en \u0153uvre sous la forme d'une plateforme logicielle d\u00e9di\u00e9e, souvent appel\u00e9e dispositif de m\u00e9diation ou plateforme de m\u00e9diation. Elle peut fonctionner sur du mat\u00e9riel d\u00e9di\u00e9, sur des machines virtuelles ou dans des environnements conteneuris\u00e9s. La plateforme re\u00e7oit des entr\u00e9es de plusieurs \u00e9l\u00e9ments du r\u00e9seau, les traite selon les r\u00e8gles configur\u00e9es pour chaque interception active et g\u00e9n\u00e8re des sorties \u00e0 destination d'un ou plusieurs LEMF.<\/p>\n\n\n\n

Fonctions essentielles de la plate-forme de m\u00e9diation<\/h2>\n\n\n\n

The mediation function performs several core processing tasks that are essential to the interception workflow. The first is task and delivery management. When an interception is activated, the administration function (ADMF, i.e. the gestion des mandats<\/a> system) provisions the target identifiers to the points of interception, and the task identifier (XID), the LIID(s) and the delivery destinations to the mediation function, both over X1 (ETSI TS 103 221-1). The mediation function does not need to know the target identifier: it maps every incoming X2\/X3 record to its LIID(s) and LEMF(s) by the XID, and uses the correlation information carried in X2\/X3 to associate events and content belonging to the same communication across network elements.<\/p>\n\n\n\n

The second core function is IRI generation. From the event records (xIRI) produced by the points of interception, which may include copies of signalling such as SIP messages or RADIUS and DHCP packets, the mediation function builds the final intercept-related information records in the format required by the applicable handover standard (e.g. ETSI TS 102 232-x for IP-based handover, ETSI TS 101 671 \/ 3GPP TS 33.108 for legacy mobile and circuit-switched services, 3GPP TS 33.128 for 5G) and encodes them in ASN.1 (BER). The IRI events must be accurately timestamped and sequenced to provide a reliable record of the target’s communication activity.<\/p>\n\n\n\n

The third core function is CC processing. The mediation function receives the intercepted content \u2014 voice and multimedia streams and IP packets \u2014 from the points of interception over X3 and prepares it for delivery over the HI3 interface. SMS content is normally delivered as IRI over HI2. With circuit-switched (ISDN) handover, media must be adapted to 64 kbit\/s bearers. With IP-based handover (ETSI TS 102 232-5, 3GPP TS 33.108\/33.128), the content is delivered as a transparent, decrypted copy together with its codec description. Where operator-applied media encryption cannot be removed, the decryption keys are delivered to the LEMF as IRI over HI2 instead. For data interception, it involves encapsulating IP packets in the ETSI-defined delivery format. The mediation function must handle the correlation of multiple media streams within a single session, ensuring that related voice and data streams are correctly associated and, where national rules require it (e.g. Germany, TR TK\u00dcV section 3.1.2), that a call’s content reaches each recording connection only once, under a single correlation number.<\/p>\n\n\n\n

The fourth core function is secure delivery. The mediation function establishes and maintains secure connections to the LEMF over the HI2 and HI3 interfaces. This runs over a protected path: a VPN (for example IPsec crypto boxes, as mandated in Germany) or TLS 1.2\/1.3 with certificate-based authentication, depending on the national framework, and includes managing certificates and handling connection failures and reconnection. The delivery mechanism must ensure reliable, in-order delivery of IRI events and CC data, with short-term buffering (national rules set the minimum, e.g. 5 minutes in Germany) and flow control to handle temporary connectivity issues.<\/p>\n\n\n\n

Warrant management is not a mediation task, but it is closely linked. Through HI1 (e.g. ETSI TS 103 120), the administration function (ADMF) receives orders, validates them, manages their lifecycle and audit trail \u2014 tracking activation, modification, and deactivation \u2014 and provisions the network elements and the MF over X1. In some implementations, the ADMF is a separate component that interfaces with the mediation function; in others, it is packaged together with the mediation platform. The standards keep the two functions distinct.<\/p>\n\n\n\n

Pourquoi la fonction de m\u00e9diation est-elle essentielle ?<\/h2>\n\n\n\n

The mediation function is essential for several reasons. First, it adapts the operator-internal X2\/X3 delivery to the handover interfaces each authority requires. Network functions from different vendors report in the same standardised X2\/X3 formats; the mediation function adds the LIID, applies the national handover profile, correlates IRI with CC and delivers to each LEMF. Where older equipment still uses a proprietary LI interface, the mediation function also absorbs that format.<\/p>\n\n\n\n

Second, together with the administration function, the LI platform gives the operator a single point of control and management for all interception activities. Rather than configuring interception at each individual network element, the operator manages all active intercepts in the ADMF, which provisions the network elements and the mediation platform over X1. This centralisation simplifies operations, reduces the risk of errors, and improves auditability.<\/p>\n\n\n\n

Troisi\u00e8mement, la fonction de m\u00e9diation constitue la fronti\u00e8re de s\u00e9curit\u00e9 entre le r\u00e9seau de l'op\u00e9rateur et le domaine des forces de l'ordre. En faisant transiter toutes les donn\u00e9es de transfert par la fonction de m\u00e9diation, l'op\u00e9rateur peut mettre en \u0153uvre des contr\u00f4les de s\u00e9curit\u00e9, une journalisation et une surveillance coh\u00e9rents. C'est beaucoup plus facile \u00e0 g\u00e9rer que d'essayer de s\u00e9curiser les connexions directes de plusieurs \u00e9l\u00e9ments de r\u00e9seau vers le LEMF.<\/p>\n\n\n\n

Quatri\u00e8mement, la fonction de m\u00e9diation permet \u00e0 l'op\u00e9rateur de prendre en charge simultan\u00e9ment plusieurs LEMF. Dans les juridictions o\u00f9 plusieurs services charg\u00e9s de l'application de la loi<\/a> may issue interception orders \u2014 or where a centralised interception platform receives data from multiple operators \u2014 the mediation function can route intercepted data to the appropriate LEMF using the LIIDs and delivery destinations provisioned for each task, while keeping each agency’s interception strictly separate and invisible to the others, and, in the multi-operator case, with each operator’s traffic labelled with that operator’s own identifier.<\/p>\n\n\n\n

Consid\u00e9rations relatives \u00e0 l'architecture et au d\u00e9ploiement<\/h2>\n\n\n\n

L'architecture de la fonction de m\u00e9diation d\u00e9pend de la topologie du r\u00e9seau de l'op\u00e9rateur, du volume des interceptions, de la diversit\u00e9 des technologies de r\u00e9seau et des exigences sp\u00e9cifiques du cadre national de la LI. Dans un d\u00e9ploiement simple, une seule plateforme de m\u00e9diation peut desservir l'ensemble du r\u00e9seau, recevoir les donn\u00e9es de capture de tous les \u00e9l\u00e9ments du r\u00e9seau et transmettre les donn\u00e9es de transfert \u00e0 un seul LEMF. Dans des environnements plus complexes, des architectures de m\u00e9diation distribu\u00e9es peuvent \u00eatre n\u00e9cessaires, avec des n\u0153uds de m\u00e9diation situ\u00e9s \u00e0 proximit\u00e9 des principaux \u00e9l\u00e9ments du r\u00e9seau et un n\u0153ud de gestion central coordonnant l'ensemble des op\u00e9rations.<\/p>\n\n\n\n

L'\u00e9volutivit\u00e9 est un \u00e9l\u00e9ment essentiel de la conception. La fonction de m\u00e9diation doit pouvoir g\u00e9rer le nombre pr\u00e9vu d'interceptions simultan\u00e9es sans d\u00e9gradation des performances. Pour les op\u00e9rateurs disposant d'un grand nombre d'abonn\u00e9s ou de volumes d'interception importants, cela peut n\u00e9cessiter des d\u00e9ploiements multi-instances avec des capacit\u00e9s d'\u00e9quilibrage de la charge et de basculement. La plateforme de m\u00e9diation doit \u00eatre dimensionn\u00e9e pour g\u00e9rer les pics de charge avec une certaine marge, car les \u00e9checs d'interception dus \u00e0 des contraintes de capacit\u00e9 ne sont pas acceptables.<\/p>\n\n\n\n

La fiabilit\u00e9 est tout aussi importante. La fonction de m\u00e9diation est un \u00e9l\u00e9ment essentiel de la cha\u00eene LI, et toute d\u00e9faillance de la fonction de m\u00e9diation entra\u00eene l'impossibilit\u00e9 de fournir les donn\u00e9es intercept\u00e9es. Les op\u00e9rateurs doivent mettre en place des plateformes de m\u00e9diation redondantes avec basculement automatique et surveiller en permanence l'\u00e9tat et les performances de la fonction de m\u00e9diation. Les fen\u00eatres de maintenance et les mises \u00e0 jour logicielles doivent \u00eatre soigneusement planifi\u00e9es afin d'\u00e9viter toute interruption des interceptions actives.<\/p>\n\n\n\n

Integration with the operator’s existing network management and security operations infrastructure is also important. The mediation function should be integrated with the operator’s monitoring systems, alarm management systems, and security information and event management (SIEM) platforms. This integration ensures that issues with the mediation function are detected and resolved promptly, and that security events related to the LI infrastructure are captured and analysed \u2014 without exposing target identities, LIIDs or warrant data to staff who are not cleared for LI; alarms and logs leaving the LI domain must be sanitised.<\/p>\n\n\n\n

Choisir une plateforme de m\u00e9diation<\/h2>\n\n\n\n

When selecting a mediation platform, operators should evaluate several key criteria. Standards compliance is the first consideration \u2014 the platform must support the handover standards required by the national framework (usually ETSI-based, often with a national profile). Network technology support is the second \u2014 the platform must be able to interface with all network elements and protocols in the operator’s infrastructure, including legacy circuit-switched elements, IMS\/VoLTE components, and 5G core network functions, which deliver over the standardised X2\/X3 interfaces (ETSI TS 103 221-2), while the platform itself is provisioned by the ADMF over X1 (ETSI TS 103 221-1).<\/p>\n\n\n\n

L'\u00e9volutivit\u00e9 et les performances doivent \u00eatre \u00e9valu\u00e9es en fonction des volumes d'interception actuels et pr\u00e9vus de l'op\u00e9rateur. Les fonctions de s\u00e9curit\u00e9 - notamment le cryptage, les contr\u00f4les d'acc\u00e8s, l'enregistrement des audits et la gestion des certificats - doivent r\u00e9pondre aux exigences de la politique de s\u00e9curit\u00e9 de l'op\u00e9rateur et du cadre national en mati\u00e8re d'interception. La facilit\u00e9 de gestion et d'utilisation sont des consid\u00e9rations pratiques qui influent sur le co\u00fbt total de possession et sur la charge op\u00e9rationnelle de l'\u00e9quipe charg\u00e9e de la s\u00e9curit\u00e9 int\u00e9rieure.<\/p>\n\n\n\n

Les ant\u00e9c\u00e9dents du fournisseur et ses capacit\u00e9s d'assistance sont \u00e9galement importants. La fonction de m\u00e9diation n\u00e9cessite une maintenance, des mises \u00e0 jour et une assistance permanentes au fur et \u00e0 mesure de l'\u00e9volution des technologies de r\u00e9seau et de la r\u00e9vision des normes LI. Les op\u00e9rateurs doivent choisir un fournisseur qui a d\u00e9montr\u00e9 son engagement sur le march\u00e9 de la t\u00e9l\u00e9phonie mobile et qui a fait ses preuves en mati\u00e8re d'assistance et de mises \u00e0 jour en temps utile.<\/p>\n\n\n\n

Conclusion<\/h2>\n\n\n\n

The mediation function is the essential bridge between the operator’s network and law enforcement. It turns the standardised records delivered by the points of interception into the handover formats each authority requires, provides the security boundary between the operator and law enforcement domains, and enables the reliable, scalable delivery of intercepted material, while the administration function centralises the management of interception operations. For operators, investing in a robust, well-designed mediation function is one of the most important decisions in building a compliant and effective capacit\u00e9 d'interception l\u00e9gale<\/a>.<\/p>\n\n\n\n

Articles connexes<\/h2>\n\n\n\n

Pour en savoir plus sur des sujets connexes, consultez les articles suivants :<\/p>\n\n\n\n