对于希望降低资本支出并加快产品上市速度的虚拟移动网络运营商（MVNO）和小型运营商而言，将核心网络基础设施外包已成为一种越来越普遍的策略。 基于云的核心网络、网络即服务（NaaS）以及托管核心网络服务，使运营商无需投入巨资建设并运营自有核心基础设施，即可开展业务并实现规模化。然而，这种架构模式给合法截取带来了特定的挑战，运营商必须解决这些挑战才能维持 监管合规.
When the core network is outsourced, the technical capability to intercept communications resides with the infrastructure provider, while the operator keeps legal duties of its own. This article examines the challenges this creates, the models for addressing them, and the practical steps operators should take to ensure compliance when their core network is hosted or managed by a third party.
采用外包核心网络的LI
The fundamental challenge of outsourced core networks for LI is the separation of the legal obligation from the technical capability. The operator — as the registered provider of public electronic communications services — keeps legal LI duties. But the interception points, the network functions that process subscriber communications, and the infrastructure needed to capture and deliver intercepted data are operated by a third party.
这种分离比传统的MVNO与MNO关系更为明显，在后者中，MNO至少承认其运营的电信网络本身就附带监管义务。 核心网络托管服务提供商可能来自IT基础设施或云计算领域，可能并不十分熟悉电信监管要求，包括合法截取。运营商不能假设托管服务提供商已在基础设施设计或运营流程中考虑了合法截取的要求。.
Outsourcing infrastructure rarely removes your own obligations. Depending on national law and on who actually operates the core, the hosting provider may become obliged as well (in Germany the duty follows whoever operates the installation, § 170 TKG), but you remain responsible for your own LI合规 duties and for choosing a provider that can implement orders. Regulators will not accept dependency on a third party as an excuse for non-compliance.
核心网络托管模式及其对LI的影响
这对 LI 的影响取决于具体的托管模式。在专用托管模式下，运营商拥有自己的核心网络功能实例，并在托管提供商的基础设施上运行。 运营商可能拥有管理权限来配置网络功能，包括与 LI 相关的设置。在此模式下，运营商理论上可以部署自己的 LI 调解功能，并将其与托管网络功能进行对接，但这取决于托管提供商在网络连接和访问方面的配合程度。.
在共享或多租户模式下，运营商与托管服务提供商的其他租户共享核心网络功能实例。该模式虽更具成本效益，但会给流量拦截（LI）带来额外复杂性，因为拦截操作必须仅针对特定运营商的用户，且不得影响其他租户的流量。托管服务提供商必须实现支持租户识别的 截获能力 that can segregate traffic by operator, and label every delivery with the identifier of the operator that is legally performing the intercept, so that one tenant’s intercepts are never attributed to another.
在完全托管模式下，托管服务提供商代表运营商运营核心网络，负责处理所有配置、维护和运维任务。运营商对网络功能的直接访问权限有限或完全无法访问。在此模式下，运营商必须完全依赖托管服务提供商来实施和执行LI能力，这需要全面的合同安排和经过验证的技术解决方案。.
合同要求
在外包模式下，运营商与核心网络托管服务提供商之间的合同是确保合法截获（LI）合规性的主要手段。该合同应明确规定合法截获的相关内容，涵盖托管服务提供商在托管基础设施内支持合法截获功能的义务、必须实施和支持的具体合法截获接口、 启用和停用截取操作的响应时间、处理截取数据的安全与保密要求、运营商的审计和测试权限、实施监管更新及新合法截取要求的流程，以及合法截取失败时的责任划分。.
Operators should not accept generic language or vague commitments regarding LI support. The contract should specify the concrete technical and operational deliverables that the hosting provider must supply, and should include measurable service levels with meaningful penalties for non-performance. LI compliance is a legal obligation backed by substantial fines (in Germany up to EUR 500,000 for not holding the required interception facilities, § 228 TKG), and the contractual arrangements must reflect this seriousness.
技术架构选项
Several technical architecture options can address LI in an outsourced core network environment. The first option is the operator-managed model, where the operator deploys its own LI management system (LIMS) 和 LI调解平台: the LIMS provisions the hosted network functions over X1, and the mediation platform receives their X2/X3 output (ETSI TS 103 221 and 3GPP TS 33.127, used for 4G, IMS and 5G) or a vendor-specific equivalent. This requires the hosted network functions to expose LI interfaces that the operator’s mediation platform can consume. The operator retains control over 保单管理, 、数据传输以及向执法部门的交接接口。.
第二种方案是托管服务商管理的LI模式，即托管服务商作为托管核心网络服务的一部分，负责部署和运营LI基础设施。 托管服务提供商代表运营商处理拦截激活、数据捕获以及向执法部门交付数据等事宜。该模式简化了运营商的技术要求，但需要对托管服务提供商建立高度信任，并制定全面的合同和审计安排。.
The third option is a hybrid model, where certain LI functions are provided by the hosting provider (such as the points of interception within the network functions) and others are managed by the operator (such as the mediation function and handover interfaces). This model can provide a practical balance between operator control and hosting provider capability.
安全注意事项
在外包环境中，截获数据的安全性需要特别关注。在任何电信运营中，截获的通信都属于最敏感的数据类型之一，对其进行保护既是法律要求，也是实际需要。在外包模式下，截获的数据可能会经过托管服务提供商的基础设施，从而产生必须加以保护的额外风险点。.
The operator should ensure that intercepted data is encrypted in transit, and that any buffer that holds it before delivery is encrypted and kept no longer than delivery requires (in Germany, storing the content of the interception copy is not permitted, § 10 TKÜV). Access to LI systems and data should be strictly controlled and limited to authorised personnel, with comprehensive audit logging. The hosting provider’s personnel should be subject to appropriate vetting and confidentiality requirements. Physical security of the data centre hosting the LI infrastructure should meet the standards required by the national regulatory framework.
The operator should also consider the jurisdictional implications of hosting intercepted data in a third-party data centre. If the data centre is located in a different country from the operator’s home market, questions about data sovereignty, cross-border data transfers, and the applicability of foreign legal regimes may arise. Some countries settle this by law: in Germany the equipment that controls interception and the handover point must be operated in Germany (§ 14(1) TKÜV), and France requires LI systems to be installed on French territory (CPCE art. D. 98-7). Check the location rules of each market before choosing the hosting site. Operators should ensure that the location of the hosting infrastructure is compatible with their regulatory obligations and that appropriate data protection safeguards are in place.
测试与验证
无论选择何种技术模型，运营商都必须通过端到端测试来验证LI功能。该测试应涵盖国家框架要求的全部截获场景，包括使用各种目标识别方法对语音、短信和数据进行截获。 测试不仅应验证能否激活拦截并成功传输数据，还应验证响应时间、数据质量和安全性是否符合相关标准。.
测试过程应在必要时由国家技术主管部门或LEMF参与，并应在能代表生产环境的条件下进行。操作人员应规划多次测试迭代，并应保留测试文档作为符合性证明。.
结论
Outsourcing the core network rarely outsources your own lawful interception obligations. Operators using hosted or managed core network services must proactively address LI compliance through comprehensive contractual arrangements, validated technical solutions, and rigorous testing. The specific approach will depend on the hosting model, the operator’s technical capabilities, and the requirements of the national regulatory framework. By treating LI compliance as a first-class requirement in the core network hosting decision — not an afterthought — operators can achieve the cost and efficiency benefits of outsourcing while maintaining full compliance with their lawful interception obligations.
供应商选择的考虑因素
在选择核心网络托管服务提供商时，运营商应将 LI 能力作为关键评估标准之一，与性能、可扩展性和成本并列考虑。应向潜在的托管服务提供商询问其现有的 LI 能力和经验。他们目前是否为其他运营商客户提供 LI 支持？ 他们从网络功能中暴露了哪些 LI 接口？他们是否已与 LI 中介平台供应商完成了经过验证的集成？他们在支持监管更新和新 LI 要求方面有何业绩记录？无论其商业方案多么具有吸引力，如果托管服务提供商无法证明其具备实质性的 LI 能力和经验，都将带来重大的合规风险。.
运营商还应评估托管服务提供商在与国家技术主管部门进行LI测试和认证过程中，是否愿意且有能力为运营商提供支持。这一过程通常需要运营商、托管服务提供商以及可能涉及的LI调解平台供应商之间进行密切协作。 相比那些将LI视为次要问题的托管服务提供商，反应迅速、技术过硬且致力于支持LI合规的托管服务提供商将是一个更有价值的合作伙伴。随着监管要求的不断演变，托管服务提供商的选择将对运营商维持LI合规的能力产生长期影响，因此在遴选过程中应相应地重视这一因素。.
通过外包核心网络管理法律截取（LI），需要明确的合同框架和定期的合规性核查。外包核心网络的安排必须包含关于合法截取的明确条款。.
相关文章
如需进一步了解相关主题，请浏览这些文章：
外部资源
以下外部资源提供了更多背景资料和官方文件：
