{"id":2152,"date":"2026-06-10T08:00:00","date_gmt":"2026-06-10T07:00:00","guid":{"rendered":"https:\/\/ic-services.io\/?p=2152"},"modified":"2026-10-21T14:11:12","modified_gmt":"2026-10-21T13:11:12","slug":"funcao-de-mediacao-intercecao-legal","status":"publish","type":"post","link":"https:\/\/ic-services.io\/pt\/resources\/blog\/mediation-function-lawful-interception\/","title":{"rendered":"Como funciona uma fun\u00e7\u00e3o de media\u00e7\u00e3o: A ponte entre a sua rede e a aplica\u00e7\u00e3o da lei"},"content":{"rendered":"

In the architecture of any lawful interception system, the mediation function occupies a critical position. It sits between the operator’s network infrastructure \u2014 where communications are generated, routed, and processed \u2014 and the centro de monitoriza\u00e7\u00e3o das for\u00e7as de seguran\u00e7a<\/a> (LEMF), where intercepted material is received and analysed. The mediation function is the component that translates the intercept records delivered by the network’s points of interception into the standardised formats required by the handover interfaces, ensuring that what law enforcement receives is complete, correctly formatted, and delivered securely.<\/p>\n\n\n\n

Despite its importance, the mediation function is often one of the least understood components of the LI architecture. This article provides a comprehensive explanation of what the mediation function does, how it works, why it is essential, and what operators should consider when designing or selecting a plataforma de media\u00e7\u00e3o<\/a>.<\/p>\n\n\n\n

A fun\u00e7\u00e3o de media\u00e7\u00e3o na arquitetura ETSI<\/h2>\n\n\n\n

In the classic ETSI model (TS 101 671), several functional components work together to execute an interception. An internal interception function (IIF) operates within network elements or in dedicated probes\/taps \u2014 switches, session border controllers, packet gateways, and other infrastructure components \u2014 to identify and capture the target’s communications. A mediation function (MF) receives this captured data from the IIF and processes it for delivery to the LEMF over HI2 (IRI) and HI3 (CC). HI1, the administrative interface, terminates at the operator’s administration function. Current ETSI and 3GPP architectures (TS 104 007, TS 103 221, 3GPP TS 33.127) call these the point of interception (POI) and the mediation and delivery function (MDF), linked by the standardised X2\/X3 interfaces.<\/p>\n\n\n\n

The mediation function is the point at which the operator-internal intercept records \u2014 standardised xIRI and xCC received over X2 and X3 (ETSI TS 103 221-2, 3GPP TS 33.128) \u2014 are converted into the handover formats that law enforcement systems expect. The MF adds what the network elements do not know: the LIID, the delivery destinations and the national handover profile. Legacy network elements with proprietary LI interfaces still exist, but they are the exception; some network elements can even deliver handover formats directly. The mediation function provides the necessary translation, normalisation, and formatting to ensure interoperability.<\/p>\n\n\n\n

Na pr\u00e1tica, a fun\u00e7\u00e3o de media\u00e7\u00e3o \u00e9 normalmente implementada como uma plataforma de software dedicada, frequentemente designada por dispositivo de media\u00e7\u00e3o ou plataforma de media\u00e7\u00e3o. Pode ser executada em hardware dedicado, em m\u00e1quinas virtuais ou em ambientes de contentores. A plataforma recebe inputs de m\u00faltiplos elementos da rede, processa-os de acordo com as regras configuradas para cada interce\u00e7\u00e3o ativa e gera outputs para entrega a uma ou mais LEMFs.<\/p>\n\n\n\n

Fun\u00e7\u00f5es essenciais da plataforma de media\u00e7\u00e3o<\/h2>\n\n\n\n

The mediation function performs several core processing tasks that are essential to the interception workflow. The first is task and delivery management. When an interception is activated, the administration function (ADMF, i.e. the gest\u00e3o de mandados<\/a> system) provisions the target identifiers to the points of interception, and the task identifier (XID), the LIID(s) and the delivery destinations to the mediation function, both over X1 (ETSI TS 103 221-1). The mediation function does not need to know the target identifier: it maps every incoming X2\/X3 record to its LIID(s) and LEMF(s) by the XID, and uses the correlation information carried in X2\/X3 to associate events and content belonging to the same communication across network elements.<\/p>\n\n\n\n

The second core function is IRI generation. From the event records (xIRI) produced by the points of interception, which may include copies of signalling such as SIP messages or RADIUS and DHCP packets, the mediation function builds the final intercept-related information records in the format required by the applicable handover standard (e.g. ETSI TS 102 232-x for IP-based handover, ETSI TS 101 671 \/ 3GPP TS 33.108 for legacy mobile and circuit-switched services, 3GPP TS 33.128 for 5G) and encodes them in ASN.1 (BER). The IRI events must be accurately timestamped and sequenced to provide a reliable record of the target’s communication activity.<\/p>\n\n\n\n

The third core function is CC processing. The mediation function receives the intercepted content \u2014 voice and multimedia streams and IP packets \u2014 from the points of interception over X3 and prepares it for delivery over the HI3 interface. SMS content is normally delivered as IRI over HI2. With circuit-switched (ISDN) handover, media must be adapted to 64 kbit\/s bearers. With IP-based handover (ETSI TS 102 232-5, 3GPP TS 33.108\/33.128), the content is delivered as a transparent, decrypted copy together with its codec description. Where operator-applied media encryption cannot be removed, the decryption keys are delivered to the LEMF as IRI over HI2 instead. For data interception, it involves encapsulating IP packets in the ETSI-defined delivery format. The mediation function must handle the correlation of multiple media streams within a single session, ensuring that related voice and data streams are correctly associated and, where national rules require it (e.g. Germany, TR TK\u00dcV section 3.1.2), that a call’s content reaches each recording connection only once, under a single correlation number.<\/p>\n\n\n\n

The fourth core function is secure delivery. The mediation function establishes and maintains secure connections to the LEMF over the HI2 and HI3 interfaces. This runs over a protected path: a VPN (for example IPsec crypto boxes, as mandated in Germany) or TLS 1.2\/1.3 with certificate-based authentication, depending on the national framework, and includes managing certificates and handling connection failures and reconnection. The delivery mechanism must ensure reliable, in-order delivery of IRI events and CC data, with short-term buffering (national rules set the minimum, e.g. 5 minutes in Germany) and flow control to handle temporary connectivity issues.<\/p>\n\n\n\n

Warrant management is not a mediation task, but it is closely linked. Through HI1 (e.g. ETSI TS 103 120), the administration function (ADMF) receives orders, validates them, manages their lifecycle and audit trail \u2014 tracking activation, modification, and deactivation \u2014 and provisions the network elements and the MF over X1. In some implementations, the ADMF is a separate component that interfaces with the mediation function; in others, it is packaged together with the mediation platform. The standards keep the two functions distinct.<\/p>\n\n\n\n

Porque \u00e9 que a fun\u00e7\u00e3o de media\u00e7\u00e3o \u00e9 essencial<\/h2>\n\n\n\n

The mediation function is essential for several reasons. First, it adapts the operator-internal X2\/X3 delivery to the handover interfaces each authority requires. Network functions from different vendors report in the same standardised X2\/X3 formats; the mediation function adds the LIID, applies the national handover profile, correlates IRI with CC and delivers to each LEMF. Where older equipment still uses a proprietary LI interface, the mediation function also absorbs that format.<\/p>\n\n\n\n

Second, together with the administration function, the LI platform gives the operator a single point of control and management for all interception activities. Rather than configuring interception at each individual network element, the operator manages all active intercepts in the ADMF, which provisions the network elements and the mediation platform over X1. This centralisation simplifies operations, reduces the risk of errors, and improves auditability.<\/p>\n\n\n\n

Em terceiro lugar, a fun\u00e7\u00e3o de media\u00e7\u00e3o estabelece a fronteira de seguran\u00e7a entre a rede do operador e o dom\u00ednio da aplica\u00e7\u00e3o da lei. Ao canalizar todos os dados de transfer\u00eancia atrav\u00e9s da fun\u00e7\u00e3o de media\u00e7\u00e3o, o operador pode implementar controlos de seguran\u00e7a, registo e monitoriza\u00e7\u00e3o coerentes. Isto \u00e9 muito mais f\u00e1cil de gerir do que tentar garantir liga\u00e7\u00f5es diretas de v\u00e1rios elementos da rede \u00e0 LEMF.<\/p>\n\n\n\n

Fourth, the mediation function enables the operator to support multiple LEMFs simultaneously. In jurisdictions where multiple organismos respons\u00e1veis pela aplica\u00e7\u00e3o da lei<\/a> may issue interception orders \u2014 or where a centralised interception platform receives data from multiple operators \u2014 the mediation function can route intercepted data to the appropriate LEMF using the LIIDs and delivery destinations provisioned for each task, while keeping each agency’s interception strictly separate and invisible to the others, and, in the multi-operator case, with each operator’s traffic labelled with that operator’s own identifier.<\/p>\n\n\n\n

Considera\u00e7\u00f5es sobre arquitetura e implementa\u00e7\u00e3o<\/h2>\n\n\n\n

A arquitetura da fun\u00e7\u00e3o de media\u00e7\u00e3o depende da topologia da rede do operador, do volume de intercep\u00e7\u00f5es, da diversidade das tecnologias de rede e dos requisitos espec\u00edficos do quadro nacional de LI. Numa implanta\u00e7\u00e3o simples, uma \u00fanica plataforma de media\u00e7\u00e3o pode servir toda a rede, recebendo dados de captura de todos os elementos da rede e entregando dados de transfer\u00eancia a uma \u00fanica LEMF. Em ambientes mais complexos, podem ser necess\u00e1rias arquitecturas de media\u00e7\u00e3o distribu\u00eddas, com n\u00f3s de media\u00e7\u00e3o localizados perto dos principais elementos da rede e um n\u00f3 de gest\u00e3o central que coordena a opera\u00e7\u00e3o global.<\/p>\n\n\n\n

A escalabilidade \u00e9 um fator cr\u00edtico de conce\u00e7\u00e3o. A fun\u00e7\u00e3o de media\u00e7\u00e3o deve ser capaz de lidar com o n\u00famero esperado de intercepta\u00e7\u00f5es simult\u00e2neas sem degrada\u00e7\u00e3o do desempenho. Para os operadores com grandes bases de subscritores ou elevados volumes de interce\u00e7\u00e3o, isto pode exigir implementa\u00e7\u00f5es de v\u00e1rias inst\u00e2ncias com capacidades de equil\u00edbrio de carga e de recupera\u00e7\u00e3o de falhas. A plataforma de media\u00e7\u00e3o deve ser dimensionada para lidar com picos de carga com margem, uma vez que n\u00e3o s\u00e3o aceit\u00e1veis falhas de interce\u00e7\u00e3o devido a limita\u00e7\u00f5es de capacidade.<\/p>\n\n\n\n

A fiabilidade \u00e9 igualmente importante. A fun\u00e7\u00e3o de media\u00e7\u00e3o \u00e9 uma componente cr\u00edtica da cadeia de LI, e qualquer falha na fun\u00e7\u00e3o de media\u00e7\u00e3o resulta numa falha na entrega dos dados interceptados. Os operadores devem implementar plataformas de media\u00e7\u00e3o redundantes com failover autom\u00e1tico e devem monitorizar continuamente a sa\u00fade e o desempenho da fun\u00e7\u00e3o de media\u00e7\u00e3o. As janelas de manuten\u00e7\u00e3o e as actualiza\u00e7\u00f5es de software devem ser cuidadosamente planeadas para evitar interrup\u00e7\u00f5es nas intercep\u00e7\u00f5es activas.<\/p>\n\n\n\n

Integration with the operator’s existing network management and security operations infrastructure is also important. The mediation function should be integrated with the operator’s monitoring systems, alarm management systems, and security information and event management (SIEM) platforms. This integration ensures that issues with the mediation function are detected and resolved promptly, and that security events related to the LI infrastructure are captured and analysed \u2014 without exposing target identities, LIIDs or warrant data to staff who are not cleared for LI; alarms and logs leaving the LI domain must be sanitised.<\/p>\n\n\n\n

Sele\u00e7\u00e3o de uma plataforma de media\u00e7\u00e3o<\/h2>\n\n\n\n

When selecting a mediation platform, operators should evaluate several key criteria. Standards compliance is the first consideration \u2014 the platform must support the handover standards required by the national framework (usually ETSI-based, often with a national profile). Network technology support is the second \u2014 the platform must be able to interface with all network elements and protocols in the operator’s infrastructure, including legacy circuit-switched elements, IMS\/VoLTE components, and 5G core network functions, which deliver over the standardised X2\/X3 interfaces (ETSI TS 103 221-2), while the platform itself is provisioned by the ADMF over X1 (ETSI TS 103 221-1).<\/p>\n\n\n\n

A escalabilidade e o desempenho devem ser avaliados em fun\u00e7\u00e3o dos volumes de interce\u00e7\u00e3o actuais e previstos pelo operador. As carater\u00edsticas de seguran\u00e7a - incluindo a cifragem, os controlos de acesso, o registo de auditorias e a gest\u00e3o de certificados - devem satisfazer os requisitos da pol\u00edtica de seguran\u00e7a do operador e do quadro nacional de liga\u00e7\u00e3o. A capacidade de gest\u00e3o e a facilidade de opera\u00e7\u00e3o s\u00e3o considera\u00e7\u00f5es pr\u00e1ticas que afectam o custo total de propriedade e a carga operacional da equipa de LI.<\/p>\n\n\n\n

O historial do fornecedor e as capacidades de apoio tamb\u00e9m s\u00e3o importantes. A fun\u00e7\u00e3o de media\u00e7\u00e3o exige manuten\u00e7\u00e3o, actualiza\u00e7\u00f5es e apoio cont\u00ednuos \u00e0 medida que as tecnologias de rede evoluem e que as normas LI s\u00e3o revistas. Os operadores devem selecionar um fornecedor com um compromisso demonstrado com o mercado de LI e um historial de apoio e actualiza\u00e7\u00f5es atempadas.<\/p>\n\n\n\n

Conclus\u00e3o<\/h2>\n\n\n\n

The mediation function is the essential bridge between the operator’s network and law enforcement. It turns the standardised records delivered by the points of interception into the handover formats each authority requires, provides the security boundary between the operator and law enforcement domains, and enables the reliable, scalable delivery of intercepted material, while the administration function centralises the management of interception operations. For operators, investing in a robust, well-designed mediation function is one of the most important decisions in building a compliant and effective lawful interception capability<\/a>.<\/p>\n\n\n\n

Artigos relacionados<\/h2>\n\n\n\n

Para mais informa\u00e7\u00f5es sobre temas relacionados, consulte estes artigos:<\/p>\n\n\n\n