In the architecture of any lawful interception system, the mediation function occupies a critical position. It sits between the operator’s network infrastructure — where communications are generated, routed, and processed — and the 법 집행 감시 시설 (LEMF), where intercepted material is received and analysed. The mediation function is the component that translates the intercept records delivered by the network’s points of interception into the standardised formats required by the handover interfaces, ensuring that what law enforcement receives is complete, correctly formatted, and delivered securely.
Despite its importance, the mediation function is often one of the least understood components of the LI architecture. This article provides a comprehensive explanation of what the mediation function does, how it works, why it is essential, and what operators should consider when designing or selecting a 중재 플랫폼.
ETSI 아키텍처의 미디에이션 기능
In the classic ETSI model (TS 101 671), several functional components work together to execute an interception. An internal interception function (IIF) operates within network elements or in dedicated probes/taps — switches, session border controllers, packet gateways, and other infrastructure components — to identify and capture the target’s communications. A mediation function (MF) receives this captured data from the IIF and processes it for delivery to the LEMF over HI2 (IRI) and HI3 (CC). HI1, the administrative interface, terminates at the operator’s administration function. Current ETSI and 3GPP architectures (TS 104 007, TS 103 221, 3GPP TS 33.127) call these the point of interception (POI) and the mediation and delivery function (MDF), linked by the standardised X2/X3 interfaces.
The mediation function is the point at which the operator-internal intercept records — standardised xIRI and xCC received over X2 and X3 (ETSI TS 103 221-2, 3GPP TS 33.128) — are converted into the handover formats that law enforcement systems expect. The MF adds what the network elements do not know: the LIID, the delivery destinations and the national handover profile. Legacy network elements with proprietary LI interfaces still exist, but they are the exception; some network elements can even deliver handover formats directly. The mediation function provides the necessary translation, normalisation, and formatting to ensure interoperability.
실제로 미디에이션 기능은 일반적으로 미디에이션 디바이스 또는 미디에이션 플랫폼이라고 하는 전용 소프트웨어 플랫폼으로 구현됩니다. 이 플랫폼은 전용 하드웨어, 가상 머신 또는 컨테이너화된 환경에서 실행될 수 있습니다. 플랫폼은 여러 네트워크 요소로부터 입력을 수신하고, 각 활성 차단에 대해 구성된 규칙에 따라 처리한 후 하나 이상의 LEMF에 전달할 출력을 생성합니다.
미디에이션 플랫폼의 핵심 기능
The mediation function performs several core processing tasks that are essential to the interception workflow. The first is task and delivery management. When an interception is activated, the administration function (ADMF, i.e. the 영장 관리 system) provisions the target identifiers to the points of interception, and the task identifier (XID), the LIID(s) and the delivery destinations to the mediation function, both over X1 (ETSI TS 103 221-1). The mediation function does not need to know the target identifier: it maps every incoming X2/X3 record to its LIID(s) and LEMF(s) by the XID, and uses the correlation information carried in X2/X3 to associate events and content belonging to the same communication across network elements.
The second core function is IRI generation. From the event records (xIRI) produced by the points of interception, which may include copies of signalling such as SIP messages or RADIUS and DHCP packets, the mediation function builds the final intercept-related information records in the format required by the applicable handover standard (e.g. ETSI TS 102 232-x for IP-based handover, ETSI TS 101 671 / 3GPP TS 33.108 for legacy mobile and circuit-switched services, 3GPP TS 33.128 for 5G) and encodes them in ASN.1 (BER). The IRI events must be accurately timestamped and sequenced to provide a reliable record of the target’s communication activity.
The third core function is CC processing. The mediation function receives the intercepted content — voice and multimedia streams and IP packets — from the points of interception over X3 and prepares it for delivery over the HI3 interface. SMS content is normally delivered as IRI over HI2. With circuit-switched (ISDN) handover, media must be adapted to 64 kbit/s bearers. With IP-based handover (ETSI TS 102 232-5, 3GPP TS 33.108/33.128), the content is delivered as a transparent, decrypted copy together with its codec description. Where operator-applied media encryption cannot be removed, the decryption keys are delivered to the LEMF as IRI over HI2 instead. For data interception, it involves encapsulating IP packets in the ETSI-defined delivery format. The mediation function must handle the correlation of multiple media streams within a single session, ensuring that related voice and data streams are correctly associated and, where national rules require it (e.g. Germany, TR TKÜV section 3.1.2), that a call’s content reaches each recording connection only once, under a single correlation number.
The fourth core function is secure delivery. The mediation function establishes and maintains secure connections to the LEMF over the HI2 and HI3 interfaces. This runs over a protected path: a VPN (for example IPsec crypto boxes, as mandated in Germany) or TLS 1.2/1.3 with certificate-based authentication, depending on the national framework, and includes managing certificates and handling connection failures and reconnection. The delivery mechanism must ensure reliable, in-order delivery of IRI events and CC data, with short-term buffering (national rules set the minimum, e.g. 5 minutes in Germany) and flow control to handle temporary connectivity issues.
Warrant management is not a mediation task, but it is closely linked. Through HI1 (e.g. ETSI TS 103 120), the administration function (ADMF) receives orders, validates them, manages their lifecycle and audit trail — tracking activation, modification, and deactivation — and provisions the network elements and the MF over X1. In some implementations, the ADMF is a separate component that interfaces with the mediation function; in others, it is packaged together with the mediation platform. The standards keep the two functions distinct.
미디에이션 기능이 필수적인 이유
The mediation function is essential for several reasons. First, it adapts the operator-internal X2/X3 delivery to the handover interfaces each authority requires. Network functions from different vendors report in the same standardised X2/X3 formats; the mediation function adds the LIID, applies the national handover profile, correlates IRI with CC and delivers to each LEMF. Where older equipment still uses a proprietary LI interface, the mediation function also absorbs that format.
Second, together with the administration function, the LI platform gives the operator a single point of control and management for all interception activities. Rather than configuring interception at each individual network element, the operator manages all active intercepts in the ADMF, which provisions the network elements and the mediation platform over X1. This centralisation simplifies operations, reduces the risk of errors, and improves auditability.
셋째, 중개 기능은 운영자의 네트워크와 법 집행 도메인 사이에 보안 경계를 제공합니다. 모든 핸드오버 데이터를 미디에이션 기능을 통해 전달함으로써 운영자는 일관된 보안 제어, 로깅 및 모니터링을 구현할 수 있습니다. 이는 여러 네트워크 요소에서 LEMF로 직접 연결을 보호하는 것보다 훨씬 더 관리하기 쉽습니다.
Fourth, the mediation function enables the operator to support multiple LEMFs simultaneously. In jurisdictions where multiple 법 집행 기관 may issue interception orders — or where a centralised interception platform receives data from multiple operators — the mediation function can route intercepted data to the appropriate LEMF using the LIIDs and delivery destinations provisioned for each task, while keeping each agency’s interception strictly separate and invisible to the others, and, in the multi-operator case, with each operator’s traffic labelled with that operator’s own identifier.
아키텍처 및 배포 고려 사항
중개 기능의 아키텍처는 사업자의 네트워크 토폴로지, 가로채기의 양, 네트워크 기술의 다양성, 국가 LI 프레임워크의 특정 요구사항에 따라 달라집니다. 간단한 배포에서는 단일 미디에이션 플랫폼이 전체 네트워크에 서비스를 제공하여 모든 네트워크 요소에서 캡처 데이터를 수신하고 단일 LEMF로 핸드오버 데이터를 전달할 수 있습니다. 보다 복잡한 환경에서는 주요 네트워크 요소에 가까운 곳에 미디에이션 노드를 배치하고 중앙 관리 노드가 전체 운영을 조정하는 분산형 미디에이션 아키텍처가 필요할 수 있습니다.
확장성은 중요한 설계 고려 사항입니다. 미디에이션 기능은 성능 저하 없이 예상되는 동시 차단 수를 처리할 수 있어야 합니다. 가입자 기반이 크거나 차단량이 많은 사업자의 경우 로드 밸런싱 및 장애 조치 기능을 갖춘 다중 인스턴스 배포가 필요할 수 있습니다. 용량 제약으로 인한 차단 실패는 허용되지 않으므로 미디에이션 플랫폼은 피크 부하를 여유 있게 처리할 수 있도록 크기를 조정해야 합니다.
신뢰성도 마찬가지로 중요합니다. 중개 기능은 LI 체인의 핵심 구성 요소이며, 중개 기능에 장애가 발생하면 가로챈 데이터를 전달하지 못하게 됩니다. 운영자는 자동 장애 조치 기능을 갖춘 이중화된 중개 플랫폼을 구현해야 하며, 중개 기능의 상태와 성능을 지속적으로 모니터링해야 합니다. 유지보수 기간과 소프트웨어 업데이트는 활성 차단이 중단되지 않도록 신중하게 계획해야 합니다.
Integration with the operator’s existing network management and security operations infrastructure is also important. The mediation function should be integrated with the operator’s monitoring systems, alarm management systems, and security information and event management (SIEM) platforms. This integration ensures that issues with the mediation function are detected and resolved promptly, and that security events related to the LI infrastructure are captured and analysed — without exposing target identities, LIIDs or warrant data to staff who are not cleared for LI; alarms and logs leaving the LI domain must be sanitised.
미디에이션 플랫폼 선택
When selecting a mediation platform, operators should evaluate several key criteria. Standards compliance is the first consideration — the platform must support the handover standards required by the national framework (usually ETSI-based, often with a national profile). Network technology support is the second — the platform must be able to interface with all network elements and protocols in the operator’s infrastructure, including legacy circuit-switched elements, IMS/VoLTE components, and 5G core network functions, which deliver over the standardised X2/X3 interfaces (ETSI TS 103 221-2), while the platform itself is provisioned by the ADMF over X1 (ETSI TS 103 221-1).
확장성과 성능은 사업자의 현재 및 예상 차단량과 비교하여 평가해야 합니다. 암호화, 액세스 제어, 감사 로깅, 인증서 관리 등의 보안 기능은 사업자의 보안 정책과 국가 LI 프레임워크의 요구 사항을 모두 충족해야 합니다. 관리 용이성과 운영 편의성은 총소유비용과 LI 팀의 운영 부담에 영향을 미치는 실질적인 고려 사항입니다.
공급업체의 실적과 지원 역량도 중요합니다. 중개 기능은 네트워크 기술이 발전하고 LI 표준이 개정됨에 따라 지속적인 유지 관리, 업데이트 및 지원이 필요합니다. 운영자는 LI 시장에 대한 노력이 입증되고 적시에 지원 및 업데이트 실적을 보유한 공급업체를 선택해야 합니다.
결론
The mediation function is the essential bridge between the operator’s network and law enforcement. It turns the standardised records delivered by the points of interception into the handover formats each authority requires, provides the security boundary between the operator and law enforcement domains, and enables the reliable, scalable delivery of intercepted material, while the administration function centralises the management of interception operations. For operators, investing in a robust, well-designed mediation function is one of the most important decisions in building a compliant and effective 합법적 감청 능력.
관련 기사
관련 주제에 대한 자세한 내용은 다음 문서를 참조하세요:
- ETSI TS 103 120 Explained: The Electronic HI1 Warrant Interface
- HI1 대 HI2 대 HI3: 세 가지 합법적 감청 인터페이스에 대한 이해
- 합법적 감청 관리 시스템(LIMS)에서 살펴봐야 할 사항
외부 리소스
다음 외부 리소스에서 추가 컨텍스트와 공식 문서를 확인할 수 있습니다:
