用于合法截获的深度数据包检测 通常与执法方面相关：该机构接收原始IP数据包，并在其监控中心对其进行分析。然而，越来越多的网络运营商和机构开始质疑，这部分工作是否可以由 在服务提供商处, ，靠近数据流。在此模型中，服务提供商在拦截点提取并丰富元数据，然后将其与通信的完整副本一并移交。.
Whether a provider may do any of this depends on national law: in Germany, analysis stays with the agency. Where it is allowed and done right, provider-side DPI speeds up investigations, can reduce data volumes where an order limits the scope, and gives agencies context they could not reconstruct themselves. Done wrong, it breaks evidence rules or exceeds the legal mandate. This article explains the architecture, what can be extracted, how enriched data is delivered, and where the boundaries are.
要点总结
- 提供商端 DPI 补充说明 该通信的全文。它绝不能替代该通信，除非该命令和国家法规明确允许缩小适用范围。.
- 该服务提供商拥有 network context the agency lacks: line identity, NAT mappings, cell and location data, device identifiers and precise session timing. Subscriber details such as name and address need a separate request.
- 典型的提取元数据包括 流量记录、DNS、SNI、TLS 指纹（JA4）、应用程序分类、VoIP 信令及活动类型.
- 增强数据必须以一种 已商定、有文件记录的格式, for example as additional IRI records where the national specification allows it. Whether a provider may deliver any of it is jurisdiction-dependent: in Germany the provider hands over only the copy and the § 7 TKÜV event data, and analysis belongs to the agency.
- Where national law allows it, everything must be target-specific, reproducible, documented and strictly separated from commercial DPI. An acceptance concept documents it but cannot make it lawful.
为什么要在服务提供商端进行深度数据包检测？
| 司机 | 对该机构的好处 | 对服务提供商的益处 |
|---|---|---|
| 带宽增长（多千兆FTTH、5G） | 即使完整副本的处理需要一些时间，元数据也能立即获取 | 在适用范围限制的情况下，交接环节的压力较小 |
| 加密流量 | 预分类会话和指纹 | 现有DPI专业知识的再利用 |
| 网络环境 | Line, NAT, cell and device data attached to each flow | Fewer follow-up requests for basic context, where national rules list the data for the copy (subscriber name and address always need a separate request) |
| 时间紧迫的病例 | 关于活动模式的近实时警报 | 定义明确、自动化的流程 |
| 复杂的访问模型 | CGNAT 以及批发网络环境中的正确归因 | 关于不完整的截获内容的争议减少了 |
法律划定的界限
在进行任何设计之前，服务提供商必须了解自身的法律地位：
- 先看全文。. In most European jurisdictions the provider must deliver a 完整且未经修改的副本 of the target’s telecommunications. Where national law allows enrichment, it is an addition; in Germany it is not allowed (see below). Filtering is allowed only where the order limits the scope.
- 除订单信息外，不再进行任何分析。. 提供商端的DPI仅可处理来自 有序目标 且仅限于拦截之目的。不允许进行批量或非定向分析。.
- 与商用DPI区分开来。. 《欧盟开放互联网条例》（EU）2015/2120 限制了为流量管理目的而进行的深度包检测（DPI），但允许采取为遵守欧盟或国家法律所必需的措施。因此，LI 处理必须在独立的、受访问控制的环境中进行，且绝不能将数据输入商业系统。.
- 保密。. 工作人员和系统均须遵守电信保密规定，且用户不得察觉该措施。.
- Germany is stricter. The obliged provider must enable the measure (§ 100a(4) StPO) and hand over a complete copy plus the event data listed in § 7 TKÜV, and nothing else at the handover point (§ 8(2) No. 2 TKÜV). Analysis of the content, including DPI classification, belongs to the agency. A BNetzA acceptance cannot create a legal basis for extra processing. Provider-side enrichment is only an option where national law expressly provides for it.
参考架构
- 交通通达性: BNG/BRAS for PPPoE and IPoE access, and PE or core routers for fixed-IP lines, copy the target’s traffic with their built-in LI function, using ETSI TS 103 221 (X1 tasking, X2/X3 delivery) where supported or the vendor’s LI interface. The ADMF handles the tasking, and the mediation layer converts the delivered streams into the ETSI handover format. Optical TAPs or virtual mirror ports are only a fallback where no native LI function is available.
- 目标触发：LIMS/ADMF 激活目标，而来自 RADIUS/Diameter、DHCP 或数据包网关的会话事件会告知 DPI 节点，哪些 IP 地址和前缀当前属于该目标。.
- 针对特定目标的深度数据包检测节点：该节点仅处理有序目标的 X3 数据流。通过以 10/40/100 Gbit/s 速率运行的高性能数据包处理技术（例如 DPDK 或基于 FPGA 的网卡），对数据流进行重组、识别协议并提取元数据。.
- 拓展: each flow is tagged with the LIID, the target identifier, the NAT mapping (public IP and port block), cell ID or location, and the IMEI where available. Enrichment is limited to data the national rules list for the copy; subscriber details such as name and address still require a separate information request.
- 调解与交付: the full copy is delivered as CC via HI3, according to ETSI TS 102 232-3 or -4 for fixed access, or 3GPP TS 33.108/33.128 over TS 102 232-7 for mobile, and any enriched metadata permitted by national law is delivered via HI2.
- 审计与留存: DPI 输出仅在交付所需的时间内保留，并且会记录每个配置和签名版本。.
参见 X1/X2/X3 接口 和 调解函数的工作原理 用于底层接口。.
可以提取和富集哪些物质？
| 元数据 | 来源 | 调查的价值 |
|---|---|---|
| 流量记录（5元组，起始/结束，字节，数据包） | 数据包头 | 活动概览 |
| DNS 查询与响应 | 未加密的DNS | 使用的服务和域名 |
| TLS SNI、ALPN、JA4/JA4S 指纹（请注意 FoxIO 针对 JA4S 的许可条款） | TLS/QUIC 握手过程 | 应用程序和设备识别 |
| 应用程序分类 | DPI 特征与行为 | 即时通讯、VoIP、流媒体、VPN、Tor |
| 活动类型 | 数据包大小和时序模式 | 消息、通话与文件传输 |
| VoIP信令（SIP、RTP参数） | 未加密的VoIP | 与参与者进行的第三方VoIP通话及其时长 |
| HTTP 主机和用户代理 | 未加密的HTTP | 服务和客户端软件 |
| NAT映射 | CGNAT 日志 | 公共IP和端口与目标之间的关联 |
| 位置和设备 | 手机ID、IMEI、接入线路 | 某项活动发生在何处以及使用了哪种设备 |
Which of these an access provider may deliver depends on national law. In Germany, classification and service-level reconstruction of third-party services are done by the agency, not the access provider. The encryption rule applies here as well: the provider removes only the encryption it applied itself. End-to-end encrypted content remains encrypted, and the metadata above is extracted without decrypting it.
移交增强数据
There is no single, universal ETSI record type for “DPI results”. Flow summaries are standardised in ETSI TS 102 232-3 (Packet Data Summary Reporting); application classification is not. In practice, three models are used:
- 其他 IRI 记录: extracted events (for example a detected VoIP call or an application session) are sent via HI2, using standard fields where possible, and national extensions only where the national specification provides for them.
- Flow-level IRI: where flow-level IRI is required by the warrant, ETSI TS 102 232-3 already defines it (Packet Data Summary Reporting, IPIRIOnly). Proprietary analytics streams outside the national handover specification are not permitted in Germany and need an explicit legal basis elsewhere.
- 服务级别记录：在某些司法管辖区，且仅在明确要求的情况下，服务提供商会在服务层级提供事件，这类似于ETSI TS 102 232中针对特定服务的部分，消息传递和多媒体服务提供商将其用于自身服务。.
无论采用何种模式，格式都必须是 已记录、已版本化并已达成一致 与接收机构和监管机构保持沟通，且该机构必须始终能够根据完整副本对增强数据进行核对。.
证据质量：确保数据增强的可重复性
- 记录 DPI 引擎和签名版本 用于每个结果。.
- 使用 同步、高精度的时间戳 以便元数据与CC和HI2记录保持一致。.
- 提供 信心指标 用于行为分类。.
- 保持一个 完整的审计轨迹 目标激活、配置变更和交付。.
- 定期使用以下方法进行测试： 参考流量 用于检测签名更新后的性能退化。.
服务提供商实施检查清单
- 法律评估：国家框架允许的内容，以及相关命令通常涵盖的范围
- Where national law provides for enrichment: scope and delivery format agreed with the agencies and documented in the acceptance concept
- 仅针对特定靶点的激活，由LIMS/ADMF驱动
- 针对峰值用户速率优化的硬件加速 DPI
- 与 AAA、DHCP、CGNAT 日志、数据包核心及位置数据的集成
- 与商业数据包检测（DPI）和流量管理严格分离
- 版本控制、参考测试和审计日志记录
- 具备缓冲和监控功能的弹性交付
ICS 如何助力提供商端深度数据包检测
ICS International Carrier Services builds on more than 20 years of team experience in telecommunications, lawful interception and compliance and on BNetzA-accepted LI implementations. We integrate network elements via their vendor LI interfaces or ETSI TS 103 221 X1/X2/X3 and operate mediation for providers today, so we know both the network and the receiving side.
- 建筑与法律技术设计 提供商端DPI（参见 面向网络运营商的DPI) 该方案应符合贵国的框架和贵方的接受理念。.
- 目标触发式DPI和数据增强管道 与 RADIUS/Diameter、CGNAT 日志记录以及分组核心事件集成。.
- Network element integration with BNG/BRAS and core routers via their vendor LI interfaces or ETSI TS 103 221 X1/X3, plus passive probes or cloud mirroring where no native LI function is available.
- 调解与ETSI移交 通过我们的 LI 调解平台 和 LIMS.
- 托管运营 全天候。参见 管理的 LI 业务.
- 定制开发 提取器、分类器和交付格式。参见 集成与定制开发.
联系 ICS 以探讨服务提供商端的增强功能是否适合您的网络。.
常见问题
在合法截获过程中，是否允许进行深度数据包检测？
Only where national law expressly provides for it. In Germany the provider must hand over a complete copy plus the event data listed in § 7 TKÜV and nothing else at the handover point (§ 8(2) No. 2 TKÜV); analysis of the content, including DPI classification, belongs to the agency, and a BNetzA acceptance cannot create a legal basis for extra processing. Untargeted or commercial use of LI data is never allowed.
提供商端的DPI是否取代了通信内容的完整拷贝？
不。在大多数司法管辖区，服务提供商必须提供目标方通信内容的完整且未经篡改的副本。除非法庭命令明确限定范围，否则基于DPI的元数据应作为补充一并提供。.
互联网服务提供商（ISP）能否解密目标用户的HTTPS或即时通讯流量？
不。服务提供商仅会解除其自身在其网络内施加的加密。端到端加密或应用层加密仍保持完整。深度包检测（DPI）针对的是未加密的报头、握手过程和流量模式。.
DPI元数据是如何提供给执法部门的？
Where national law allows it, as additional IRI records via HI2, using standard records such as the Packet Data Summary Reporting of ETSI TS 102 232-3 where possible. Separate analytics streams outside the national handover specification are not permitted in Germany. The format must be documented and agreed with the agencies and the regulator.
服务商端和地方教育机构端DPI有什么区别？
LEA-side DPI analyses the delivered traffic in the monitoring facility. Provider-side DPI runs at the point of interception, where, if national law allows it, it can add network context such as the line identifier, NAT mappings and location, and deliver results in near real time.
相关文章
- 调解功能如何发挥作用：您的网络与执法部门之间的桥梁
- 加密 DNS（卫生部/电信部）及其对合法拦截能力的影响
- 5G SA中的网络切片：它如何使LI定位变得复杂（又如何能使其简化）
- AI辅助执法：自动化对执法人员及执法工作流程的意义
