{"id":2167,"date":"2026-08-05T08:00:00","date_gmt":"2026-08-05T07:00:00","guid":{"rendered":"https:\/\/ic-services.io\/?p=2167"},"modified":"2026-10-21T14:10:56","modified_gmt":"2026-10-21T13:10:56","slug":"segmentation-du-reseau-5g-interception-legale","status":"publish","type":"post","link":"https:\/\/ic-services.io\/fr\/resources\/blog\/network-slicing-5g-lawful-interception\/","title":{"rendered":"Le \u00ab network slicing \u00bb dans la 5G en mode autonome : en quoi cela complique (et peut simplifier) le ciblage LI"},"content":{"rendered":"

La technologie de \u00ab network slicing \u00bb de la 5G pr\u00e9sente \u00e0 la fois des d\u00e9fis et des opportunit\u00e9s en mati\u00e8re de conformit\u00e9 aux obligations d\u2019interception l\u00e9gale. Le \u00ab network slicing \u00bb est l\u2019une des fonctionnalit\u00e9s phares de l\u2019architecture 5G autonome (SA). En cr\u00e9ant des partitions r\u00e9seau logiquement isol\u00e9es sur une infrastructure physique partag\u00e9e, les op\u00e9rateurs peuvent adapter les caract\u00e9ristiques de connectivit\u00e9 \u2014 latence, bande passante, fiabilit\u00e9 et s\u00e9curit\u00e9 \u2014 aux exigences sp\u00e9cifiques de diff\u00e9rents services, applications ou groupes de clients. En mati\u00e8re d\u2019interception l\u00e9gale, le \u00ab network slicing \u00bb introduit \u00e0 la fois des complications importantes et, paradoxalement, des simplifications potentielles. Il est essentiel pour tout op\u00e9rateur d\u00e9ployant ou planifiant un r\u00e9seau 5G SA de comprendre comment le \u00ab network slicing \u00bb affecte le ciblage, l\u2019ex\u00e9cution et la mise en \u0153uvre de l\u2019interception l\u00e9gale.<\/p>\n\n\n\n

Cet article examine les liens entre le \u00ab network slicing \u00bb et l'interception l\u00e9gale, en abordant l'architecture technique, les d\u00e9fis li\u00e9s \u00e0 l'identification des cibles et \u00e0 la mise en \u0153uvre de l'interception, ainsi que les avantages potentiels que le \u00ab network slicing \u00bb peut offrir pour Op\u00e9rations LI<\/a>, ainsi que les mesures concr\u00e8tes que les op\u00e9rateurs doivent prendre pour garantir la conformit\u00e9 dans un environnement de r\u00e9seau segment\u00e9.<\/p>\n\n\n\n

Comment le \u00ab network slicing \u00bb 5G influe sur LI<\/h2>\n\n\n\n

In a 5G SA network, a network slice is a logically isolated end-to-end network that includes specific configurations of radio access, transport, and core network resources. Each slice is identified by a Single Network Slice Selection Assistance Information (S-NSSAI) value and is designed to meet particular service requirements. For example, one slice might be optimised for ultra-reliable low-latency communication (URLLC) for industrial control, another for massive IoT (MIoT) sensor networks, and a third might provide enhanced mobile broadband (eMBB) for consumer smartphones.<\/p>\n\n\n\n

Du point de vue du r\u00e9seau central, chaque tranche peut disposer de ses propres instances d\u00e9di\u00e9es de certaines fonctions r\u00e9seau \u2014 telles que le SMF, l\u2019UPF et le PCF \u2014 ou partager des instances de fonctions r\u00e9seau avec d\u2019autres tranches. Le degr\u00e9 d\u2019isolation entre les tranches est configurable et d\u00e9pend de la strat\u00e9gie de d\u00e9ploiement de l\u2019op\u00e9rateur ainsi que des exigences de la tranche. Cette flexibilit\u00e9 constitue un avantage cl\u00e9 du \u00ab slicing \u00bb, mais elle introduit \u00e9galement une certaine complexit\u00e9 pour les fonctions qui doivent fonctionner au-del\u00e0 des fronti\u00e8res des tranches, notamment l\u2019interception l\u00e9gale.<\/p>\n\n\n\n

A single subscriber may simultaneously use services across multiple slices. A smartphone user might have their voice traffic routed through one slice, their video streaming through another, and their IoT companion device connected through a third. Each slice may have its own UPF, its own PDU session, and its own IP addressing. Which slice carries which traffic is decided by the device’s route selection policy (URSP), within the slices the network allows, selected with the help of the NSSF and the subscription data in the UDM.<\/p>\n\n\n\n

Complications li\u00e9es au ciblage du LI<\/h2>\n\n\n\n

Network slicing complicates LI targeting in several ways. The most fundamental complication is that a target’s traffic may be spread across multiple slices, each potentially served by different UPF instances. A single interception order must result in the capture of all the target’s communications, regardless of which slice they traverse. This requires the operator to equip every network function that can serve the target, including dedicated per-slice SMFs and UPFs, with LI functions, and to provision the task to all of them.<\/p>\n\n\n\n

Target identification in a sliced environment is more complex than in a non-sliced network. The same subscriber may appear with different session contexts, different IP addresses, and different QoS characteristics depending on which slice is serving a particular communication flow. Every interception point tags its X2\/X3 records with the task\u2019s XID, so the mediation function delivers every session in every slice under the same LIID, and the IRI tells the LEA which slice (S-NSSAI) each session used.<\/p>\n\n\n\n

The dynamic nature of slice allocation adds further complexity. Slices can be created, modified, and terminated dynamically, and a target’s traffic may move between slices as service requirements change. If the task was provisioned only to the network functions of some slices, a change in the target\u2019s subscribed slices (which the UDM reports as IRI) can leave a gap, and the administration function must extend the task to the SMFs of the new slices. Provisioning every SMF that can serve the target avoids this, because UPF interception is then triggered per session.<\/p>\n\n\n\n

Another complication arises from the potential for different slices to be operated by different entities. In some business models, an enterprise or vertical industry partner may operate its own slice on the operator’s infrastructure, potentially with its own network functions and operational management. The question of who is responsible for lawful interception within such a slice \u2014 the infrastructure operator, the slice tenant, or both \u2014 is a regulatory and contractual question. In most frameworks the answer follows the service: whoever provides a publicly available communications service over the slice carries the LI obligation. A private enterprise slice that is not offered to the public is usually out of scope, and the infrastructure operator remains responsible for the parts of its network that serve public services. Contracts must reflect this, and the operator must keep its LI functions secure even in slices it does not manage.<\/p>\n\n\n\n

Comment le d\u00e9coupage peut simplifier le LI<\/h2>\n\n\n\n

Despite these complications, network slicing can also offer potential benefits for lawful interception. The logical isolation of slices means that traffic within a slice is already segregated from traffic in other slices. If the target can only use certain slices, the administration function can provision the task only to the network functions of those slices (3GPP TS 33.127, clause 5.3.5.5), which keeps the number of provisioned interception points small.<\/p>\n\n\n\n

Slicing can also enable more granular interception. Instead of intercepting all of a target’s traffic \u2014 which in a modern smartphone environment can include significant volumes of background data, software updates, and other non-relevant traffic \u2014 slicing could potentially allow the interception to be focused on specific service types or communication flows. In practice, however, limiting interception to particular slices is generally not an option: national rules such as \u00a7 5(2) TK\u00dcV in Germany require a complete copy of the target’s communications. Where an order covers only certain services, the standards provide service scoping by service type, not by slice.<\/p>\n\n\n\n

Du point de vue de la s\u00e9curit\u00e9, l'isolation entre les tranches peut offrir une protection suppl\u00e9mentaire \u00e0 la fonction LI. En d\u00e9ployant les composants LI au sein d'une tranche d\u00e9di\u00e9e et s\u00e9curis\u00e9e \u2014 ou en veillant \u00e0 ce que le trafic LI entre les fonctions r\u00e9seau et le plateforme de m\u00e9diation<\/a> is carried on a separate, isolated transport path \u2014 operators can enhance the confidentiality and integrity of the interception process. Slice isolation can help, but LI functions still need their own protected trust domain. In virtualised networks 3GPP requires them to meet ETSI GS NFV-SEC 012 (TS 33.126, R6.6-160).<\/p>\n\n\n\n

Normes 3GPP relatives \u00e0 la LI dans les r\u00e9seaux segment\u00e9s<\/h2>\n\n\n\n

The 3GPP LI architecture for 5G, defined in TS 33.127 and TS 33.128, addresses network slicing explicitly. 3GPP’s LI requirements (TS 33.126) are technology-neutral: interception must be complete regardless of how the network is built, and that includes slicing. TS 33.127 and TS 33.128 add slice-aware provisioning and report slice information (S-NSSAI) in the IRI. On X1, a task names the target and, optionally, the service types to intercept. Slices are not an X1 parameter. Instead, the administration function decides which network functions, and therefore which slices, receive the task (3GPP TS 33.127, clause 5.3.5.5), and the X2 and X3 interfaces carry xIRI and xCC from interception points in any slice to the MDF, which turns them into IRI and CC for delivery.<\/p>\n\n\n\n

The standards define that the AMF, which handles the target’s registration and mobility management, is a key interception point for slice-related IRI. When a target registers with the network and is allocated to one or more slices, the AMF generates IRI events that include the slice information. CC interception in the UPF is triggered per PDU session: the SMF serving that session, which holds the LI task, instructs its UPF over the internal LI_T3 interface. The operator must therefore make sure every SMF that can serve the target, in every slice, carries the task and that every UPF supports LI_T3 and X3.<\/p>\n\n\n\n

The UDM is itself an interception point: it reports changes to the target’s subscribed slices as IRI. To keep coverage complete as slices change, the LI administration function learns about new SMFs and UPFs from the operator\u2019s management and orchestration systems when they are instantiated, and from the System Information Retrieval Function (SIRF) in the NRF when they register and are ready for traffic (3GPP TS 33.127, clauses 5.3.5.3 and 5.3.6).<\/p>\n\n\n\n

Implications pratiques pour les op\u00e9rateurs<\/h2>\n\n\n\n

Operators deploying 5G SA networks with slicing capabilities should address LI requirements from the earliest stages of slice design and deployment. Several practical steps are recommended. First, ensure that your LI system is aware of the slice architecture and can dynamically discover and configure interception points within any slice. This requires integration between the LI administration function and the operator’s orchestration systems and the NRF-based System Information Retrieval Function (SIRF), so that new SMFs and UPFs are provisioned as they are created.<\/p>\n\n\n\n

Second, verify that the UPFs deployed within each slice support the LI_T3 trigger and the X3 interface for content delivery to the LI mediation function, and that the SMFs serving those slices support the IRI point of interception and the CC triggering function. If a slice uses a UPF that does not support X3, the operator will have a gap in its interception capability for traffic traversing that slice. This is a procurement requirement that should be included in all UPF vendor specifications.<\/p>\n\n\n\n

Third, develop procedures for handling interception orders that span multiple slices. The LI operations team must understand how to provision tasks that cover all of a target’s slice allocations and when the administration function has to extend a task to the network functions of additional slices. Automation of this process is highly recommended, as manual configuration across multiple slices is error-prone and slow.<\/p>\n\n\n\n

Quatri\u00e8mement, il convient d\u2019aborder les aspects li\u00e9s \u00e0 la gouvernance et aux aspects contractuels de l\u2019interception l\u00e9gale (LI) dans les tranches partag\u00e9es ou g\u00e9r\u00e9es par l\u2019entreprise. Si des tiers exploitent des tranches sur votre infrastructure, les responsabilit\u00e9s en mati\u00e8re d\u2019interception l\u00e9gale doivent \u00eatre clairement d\u00e9finies dans les accords commerciaux et doivent \u00eatre conformes aux exigences r\u00e9glementaires de chaque juridiction concern\u00e9e.<\/p>\n\n\n\n

Conclusion<\/h2>\n\n\n\n

Le \u00ab network slicing \u00bb dans la 5G en mode autonome (SA) pr\u00e9sente \u00e0 la fois des d\u00e9fis et des opportunit\u00e9s pour l\u2019interception l\u00e9gale. La r\u00e9partition du trafic d\u2019une cible sur plusieurs tranches, la nature dynamique de l\u2019attribution des tranches et la possibilit\u00e9 d\u2019une exploitation des tranches par des tiers compliquent toutes le processus d\u2019interception. Dans le m\u00eame temps, l\u2019isolation logique et la granularit\u00e9 du d\u00e9coupage peuvent offrir de nouvelles approches pour une interception cibl\u00e9e et efficace. Pour les op\u00e9rateurs, l\u2019essentiel est de prendre en compte de mani\u00e8re proactive les exigences en mati\u00e8re d\u2019interception l\u00e9gale d\u00e8s la conception des tranches, de s\u2019assurer que leurs syst\u00e8mes d\u2019interception l\u00e9gale prennent en charge les tranches et s\u2019adaptent de mani\u00e8re dynamique, et d\u2019\u00e9tablir une gouvernance claire des responsabilit\u00e9s en mati\u00e8re d\u2019interception dans les environnements de tranches multi-locataires. Ce faisant, les op\u00e9rateurs peuvent respecter leurs obligations de conformit\u00e9 tout en tirant pleinement parti du potentiel du d\u00e9coupage du r\u00e9seau 5G.<\/p>\n\n\n

\u00c0 l\u2019avenir, l\u2019\u00e9volution du \u00ab network slicing \u00bb vers des mod\u00e8les plus dynamiques et bas\u00e9s sur l\u2019intention ne fera qu\u2019accro\u00eetre la complexit\u00e9 de l\u2019interception l\u00e9gale (LI) dans les environnements segment\u00e9s. Les r\u00e9seaux futurs pourraient comporter des tranches cr\u00e9\u00e9es et supprim\u00e9es \u00e0 la demande, avec des ressources allou\u00e9es et lib\u00e9r\u00e9es en temps r\u00e9el en fonction des besoins des services. Le syst\u00e8me d\u2019interception l\u00e9gale doit \u00e9voluer parall\u00e8lement \u00e0 ces capacit\u00e9s, en maintenant une couverture d\u2019interception compl\u00e8te m\u00eame lorsque la topologie sous-jacente du r\u00e9seau change en permanence. Les op\u00e9rateurs qui investissent dans des solutions flexibles et conformes aux normes Solutions LI<\/a> seront ainsi mieux pr\u00e9par\u00e9es \u00e0 s'adapter \u00e0 ces \u00e9volutions futures et \u00e0 garantir une conformit\u00e9 sans faille \u00e0 mesure que leurs r\u00e9seaux 5G gagneront en maturit\u00e9.<\/p>\n\n\n\n

\u00c0 mesure que les d\u00e9ploiements de la 5G avec d\u00e9coupage de r\u00e9seau (network slicing) gagneront en maturit\u00e9, les d\u00e9fis li\u00e9s \u00e0 l'interception \u00e9volueront. Les op\u00e9rateurs doivent concevoir l'architecture LI de leur r\u00e9seau 5G \u00e0 d\u00e9coupage en tenant compte de l'\u00e9volutivit\u00e9 future.<\/p>\n\n\n\n

Articles connexes<\/h2>\n\n\n\n

Pour en savoir plus sur des sujets connexes, consultez les articles suivants :<\/p>\n\n\n\n