{"id":2154,"date":"2026-06-17T08:00:00","date_gmt":"2026-06-17T07:00:00","guid":{"rendered":"https:\/\/ic-services.io\/?p=2154"},"modified":"2026-10-21T14:11:47","modified_gmt":"2026-10-21T13:11:47","slug":"x1-x2-x3-interfaces-5g-li","status":"publish","type":"post","link":"https:\/\/ic-services.io\/fr\/resources\/blog\/x1-x2-x3-interfaces-5g-li\/","title":{"rendered":"Interfaces X1\/X2\/X3 dans la 5G : l'architecture 3GPP LI expliqu\u00e9e"},"content":{"rendered":"

The X1 X2 X3 5G interface architecture represents a fundamental evolution in lawful interception design. The arrival of 5G has brought fundamental changes to how telecommunications networks are designed, deployed, and operated. For lawful interception, these changes are equally profound. The 3GPP LI architecture for 5G builds on the X1, X2 and X3 interfaces already known from 3G and 4G, but now with standardised protocols (ETSI TS 103 221-1 and TS 103 221-2) instead of the vendor-specific implementations used in previous network generations. For operators deploying 5G networks, understanding the X1\/X2\/X3 architecture is essential to building LI capabilities that meet regulatory requirements and function effectively in the new network environment.<\/p>\n\n\n\n

Cet article pr\u00e9sente une explication d\u00e9taill\u00e9e de l'architecture LI du 3GPP pour la 5G, en mettant l'accent sur les interfaces X1, X2 et X3, leurs relations avec les interfaces HI de l'ETSI, ainsi que les implications pratiques pour les op\u00e9rateurs et Solution LI<\/a> prestataires.<\/p>\n\n\n\n

L'architecture X1, X2, X3 5G<\/h2>\n\n\n\n

Le r\u00e9seau central 5G, tel que d\u00e9fini par le 3GPP, utilise une architecture bas\u00e9e sur les services (SBA) qui diff\u00e8re fondamentalement des architectures bas\u00e9es sur les n\u0153uds des r\u00e9seaux 3G et 4G. Au lieu d\u2019\u00e9l\u00e9ments de r\u00e9seau d\u00e9di\u00e9s remplissant des fonctions sp\u00e9cifiques, le c\u0153ur de r\u00e9seau 5G se compose d\u2019un ensemble de fonctions r\u00e9seau (NF) qui communiquent entre elles via des interfaces bas\u00e9es sur les services. Parmi les principales fonctions r\u00e9seau, on trouve la fonction de gestion de l'acc\u00e8s et de la mobilit\u00e9 (AMF), la fonction de gestion de session (SMF), la fonction de plan utilisateur (UPF) et bien d'autres encore.<\/p>\n\n\n\n

Cette \u00e9volution architecturale a des implications importantes pour l\u2019interception l\u00e9gale (LI). Dans les g\u00e9n\u00e9rations pr\u00e9c\u00e9dentes, l\u2019interception \u00e9tait g\u00e9n\u00e9ralement mise en \u0153uvre au niveau de n\u0153uds r\u00e9seau sp\u00e9cifiques \u2014 le MSC pour la voix en 3G, le P-GW pour les donn\u00e9es en 4G \u2014 qui constituaient des points bien d\u00e9finis o\u00f9 convergeaient le trafic de signalisation et le trafic du plan utilisateur de la cible. En 5G, la nature distribu\u00e9e et virtualis\u00e9e des fonctions r\u00e9seau implique que l\u2019interception doit \u00eatre abord\u00e9e diff\u00e9remment. L\u2019architecture LI du 3GPP r\u00e9pond \u00e0 ce d\u00e9fi en d\u00e9finissant des interfaces normalis\u00e9es entre le syst\u00e8me LI et les fonctions r\u00e9seau, plut\u00f4t que de s\u2019appuyer sur des m\u00e9canismes d\u2019interception sp\u00e9cifiques \u00e0 chaque n\u0153ud.<\/p>\n\n\n\n

L'architecture LI dans les sp\u00e9cifications 3GPP TS 33.127 et TS 33.128<\/h2>\n\n\n\n

The 3GPP LI architecture for 5G is defined primarily in three specifications: TS 33.126 (Lawful Interception requirements), TS 33.127 (Lawful Interception architecture and functions) and TS 33.128 (Lawful Interception protocols and procedures, stage 3). These specifications define the functional components of the LI system within the 5G network, the interfaces between them, and the interfaces to the law enforcement domain.<\/p>\n\n\n\n

The key functional components defined in TS 33.127 are the Administration Function (ADMF), which receives warrants (in its LI Control Function, LICF) and provisions the LI system (through its LI Provisioning Function, LIPF); the Points of Interception (POIs) inside or alongside the network functions, split into IRI-POIs and CC-POIs; Triggering Functions (TFs), which activate interception at POIs such as the UPF on demand; and the Mediation and Delivery Function (MDF), split into MDF2 for IRI and MDF3 for content, which delivers the result to law enforcement.<\/p>\n\n\n\n

The interfaces between these components are designated X1, X2, and X3. These interfaces are internal to the operator’s domain \u2014 they connect the LI management and delivery functions to the network functions \u2014 and are distinct from the ETSI HI interfaces, which connect the operator to the LEMF. In practice, X2 and X3 feed the handover interfaces: the MDF2 turns xIRI received over X2 into IRI for HI2, and the MDF3 turns xCC received over X3 into CC for HI3. X1 has no HI counterpart: it is the operator’s internal provisioning channel, while HI1 carries the warrant from the authority to the operator.<\/p>\n\n\n\n

X1 : L'interface d'administration<\/h2>\n\n\n\n

X1 is the interface over which the ADMF provisions and manages the POIs, the triggering functions and the MDF. Through X1, the ADMF sends instructions to the POIs to activate, modify, or deactivate interceptions. The X1 interface carries the target identification parameters, the scope of the interception, and any technology-specific configuration information needed by the POI.<\/p>\n\n\n\n

X1 uses ETSI TS 103 221-1: XML messages sent as HTTP POST requests over HTTPS (HTTP\/1.1 or HTTP\/2), with mutual TLS authentication using X.509 certificates. X1, X2 and X3 are not new as concepts (3GPP TS 33.107 already used them for 3G and 4G), but in previous generations their protocols were left to vendors. For 5G, TS 33.128 mandates the standardised ETSI protocols TS 103 221-1 (X1) and TS 103 221-2 (X2\/X3), which can also be used for 4G and IMS.<\/p>\n\n\n\n

The X1 interface supports various target identification methods, including SUPI (Subscription Permanent Identifier), GPSI (Generic Public Subscription Identifier), PEI (Permanent Equipment Identifier), and IP addresses. Because 5G conceals the permanent identifier on the radio interface (SUCI, 5G-GUTI), TS 33.127 adds identifier-association functions (IEF, ICF and IQF) that let the operator and the LEA map temporary identifiers to the target’s SUPI.<\/p>\n\n\n\n

X2 : L'interface de livraison IRI<\/h2>\n\n\n\n

X2 is the interface for delivering intercept-related information from the Points of Interception to the LI Mediation and Delivery Function. When a target’s communications trigger events at the POI \u2014 such as registration, session establishment, mobility events, or session termination \u2014 the IRI-POI generates xIRI records and sends them to the MDF2 over X2.<\/p>\n\n\n\n

The X2 IRI records in the 5G architecture are significantly richer than those in previous generations, reflecting the more complex signalling and session management in 5G networks. X2 records may include information about PDU (Protocol Data Unit) session establishment, QoS (Quality of Service) flow creation and modification, handover events, network slice selection, and service-specific parameters. The X2 records (xIRI) are defined in TS 33.128 as BER-encoded ASN.1 and carried in the binary X2 PDU format of ETSI TS 103 221-2.<\/p>\n\n\n\n

The X2 interface operates in a push model \u2014 the POI generates and sends xIRI records to the MDF2 as events occur, without waiting for a request. The delivery must be timely and reliable, as the IRI forms a critical part of the intercepted material delivered to law enforcement. The MDF2 receives X2 records from potentially multiple POIs across the network, correlates them, and formats them for delivery to the LEMF over the HI2 interface.<\/p>\n\n\n\n

X3 : L'interface de diffusion CC<\/h2>\n\n\n\n

X3 carries content (xCC) from the CC-POIs to the MDF3. For 5G data sessions the CC-POI is in the UPF: when the target’s PDU session is set up, the triggering function in the SMF instructs the UPF over LI_T3 to duplicate the session’s user-plane packets \u2014 IP packets carrying voice, data, messaging, and other services \u2014 and send them over X3.<\/p>\n\n\n\n

The X3 interface handles potentially large volumes of data, particularly for data-heavy targets. The interface must be dimensioned to handle the throughput requirements without packet loss, and the delivery mechanism must maintain the integrity and ordering of the intercepted packets. The MDF3 receives the X3 traffic, processes it as needed, and delivers it to the LEMF over the HI3 interface.<\/p>\n\n\n\n

In the 5G architecture, the UPF is the primary POI for user-plane interception. However, the UPF may be deployed in different locations within the network \u2014 at the edge, in regional data centres, or in central facilities \u2014 depending on the network architecture and the services being provided. The LI system must be capable of interacting with UPFs wherever they are deployed, which may require distributed X3 collection points and centralised processing at the MDF3.<\/p>\n\n\n\n

Le \u00ab network slicing \u00bb ajoute une dimension suppl\u00e9mentaire \u00e0 l'interception X3. Une m\u00eame cible peut voir son trafic transiter par plusieurs tranches de r\u00e9seau, chacune disposant de sa propre instance UPF. Le syst\u00e8me LI doit identifier et intercepter le trafic de la cible sur l'ensemble des tranches concern\u00e9es, garantissant ainsi une couverture compl\u00e8te des communications de la cible.<\/p>\n\n\n\n

Relation entre X1\/X2\/X3 et HI1\/HI2\/HI3<\/h2>\n\n\n\n

The X interfaces and the HI interfaces serve different but complementary roles in the overall LI architecture. The X interfaces operate within the operator’s domain, connecting the LI management and delivery functions to the network infrastructure. The HI interfaces operate at the boundary between the operator and law enforcement: HI1 carries the warrant to the operator, and HI2 and HI3 deliver the intercepted IRI and content to the LEMF.<\/p>\n\n\n\n

The LI Mediation and Delivery Function serves as the bridge between these two interface sets. It receives X2 IRI records from the POIs, processes and formats them, and delivers the resulting ETSI-compliant IRI over the HI2 interface to the LEMF. Similarly, it receives X3 content (xCC) from the CC-POIs, such as the UPF, processes it, and delivers it over the HI3 interface. On the administration side, the ADMF receives the warrant over HI1 (typically ETSI TS 103 120), and its provisioning function sends X1 messages (ETSI TS 103 221-1) to the POIs, the triggering functions and the MDF itself.<\/p>\n\n\n\n

This layered architecture provides a clean separation between the internal network interception mechanisms and the external handover to law enforcement. It allows the network functions to implement interception using standardised X interfaces without needing to understand the specific requirements of the national HI interface implementation, and it allows the MDF to adapt between different internal and external interface versions as standards evolve.<\/p>\n\n\n\n

Implications pratiques pour les op\u00e9rateurs<\/h2>\n\n\n\n

For operators deploying 5G networks, the X1\/X2\/X3 architecture has several practical implications. First, LI must be considered from the earliest stages of 5G network design. The POI interfaces within the network functions must be planned and provisioned, the MDF must be dimensioned for the expected interception volumes, and the connectivity between the POIs and the MDF must be established.<\/p>\n\n\n\n

Second, operators must ensure that their 5G network function vendors support the X1, X2, and X3 interfaces as defined in TS 33.127 and TS 33.128 (ETSI TS 103 221-1\/-2 as profiled by TS 33.128). TS 33.128 also makes ETSI TS 103 120 the HI1 protocol and ETSI TS 102 232-1\/-7 the HI2\/HI3 transport for 5G. Vendor support for the LI interfaces has historically been uneven, and operators should include LI interface compliance as a requirement in their procurement specifications.<\/p>\n\n\n\n

Third, the virtualised and cloud-native nature of 5G networks introduces new challenges for LI deployment. The MDF and POIs may need to operate in containerised environments, scale dynamically, and maintain performance and reliability across distributed deployments. Operators must ensure that their LI solutions are designed for cloud-native operation and can keep pace with the dynamic nature of the 5G network.<\/p>\n\n\n\n

Conclusion<\/h2>\n\n\n\n

Les interfaces X1\/X2\/X3 constituent une \u00e9volution majeure de l\u2019architecture LI du 3GPP, refl\u00e9tant les changements fondamentaux que la 5G apporte \u00e0 la conception et \u00e0 l\u2019exploitation des r\u00e9seaux. L\u2019interface X1 fournit le canal d\u2019administration permettant de g\u00e9rer les interceptions, l\u2019interface X2 transmet les m\u00e9tadonn\u00e9es d\u00e9taill\u00e9es dont les forces de l\u2019ordre ont besoin pour mener leurs enqu\u00eates, et l\u2019interface X3 transmet le contenu des communications intercept\u00e9es. Associ\u00e9es aux interfaces HI de l\u2019ETSI, elles forment une architecture compl\u00e8te et stratifi\u00e9e qui permet l\u2019interception l\u00e9gale au sein des r\u00e9seaux de t\u00e9l\u00e9communications les plus avanc\u00e9s. Pour les op\u00e9rateurs, il est essentiel de comprendre et de mettre en \u0153uvre ces interfaces afin de respecter leurs obligations l\u00e9gales et de garantir que leurs r\u00e9seaux 5G prennent en charge des capacit\u00e9s d\u2019interception l\u00e9gale efficaces et conformes.<\/p>\n\n\n\n

\u00c0 mesure que les d\u00e9ploiements 5G en mode autonome s'acc\u00e9l\u00e8rent, les interfaces 5G X1, X2 et X3 rev\u00eatent une importance croissante. Les op\u00e9rateurs doivent s'assurer que leurs impl\u00e9mentations 5G X1, X2 et X3 sont conformes aux derni\u00e8res sp\u00e9cifications du 3GPP.<\/p>\n\n\n\n

Articles connexes<\/h2>\n\n\n\n

Pour en savoir plus sur des sujets connexes, consultez les articles suivants :<\/p>\n\n\n\n