在任何合法截获系统的架构中，中介功能都占据着至关重要的地位。它位于运营商网络基础设施（通信在此生成、路由和处理）与 执法监控设施 (LEMF), where intercepted material is received and analysed. The mediation function is the component that translates the intercept records delivered by the network’s points of interception into the standardised formats required by the handover interfaces, ensuring that what law enforcement receives is complete, correctly formatted, and delivered securely.
尽管调解功能至关重要，但它往往是 LI 架构中理解最不充分的组成部分之一。本文将全面阐述调解功能的具体作用、工作原理、其不可或缺的原因，以及运营商在设计或选择 LI 架构时应考虑的因素。 调解平台.
ETSI 架构中的调解功能
In the classic ETSI model (TS 101 671), several functional components work together to execute an interception. An internal interception function (IIF) operates within network elements or in dedicated probes/taps — switches, session border controllers, packet gateways, and other infrastructure components — to identify and capture the target’s communications. A mediation function (MF) receives this captured data from the IIF and processes it for delivery to the LEMF over HI2 (IRI) and HI3 (CC). HI1, the administrative interface, terminates at the operator’s administration function. Current ETSI and 3GPP architectures (TS 104 007, TS 103 221, 3GPP TS 33.127) call these the point of interception (POI) and the mediation and delivery function (MDF), linked by the standardised X2/X3 interfaces.
The mediation function is the point at which the operator-internal intercept records — standardised xIRI and xCC received over X2 and X3 (ETSI TS 103 221-2, 3GPP TS 33.128) — are converted into the handover formats that law enforcement systems expect. The MF adds what the network elements do not know: the LIID, the delivery destinations and the national handover profile. Legacy network elements with proprietary LI interfaces still exist, but they are the exception; some network elements can even deliver handover formats directly. The mediation function provides the necessary translation, normalisation, and formatting to ensure interoperability.
在实践中，调解功能通常是作为专用软件平台实现的，通常称为调解设备或调解平台。它可以在专用硬件、虚拟机或容器环境中运行。该平台接收来自多个网元的输入，根据为每个主动拦截配置的规则对其进行处理，并生成输出以传送到一个或多个 LEMF。.
调解平台的核心功能
The mediation function performs several core processing tasks that are essential to the interception workflow. The first is task and delivery management. When an interception is activated, the administration function (ADMF, i.e. the 保单管理 system) provisions the target identifiers to the points of interception, and the task identifier (XID), the LIID(s) and the delivery destinations to the mediation function, both over X1 (ETSI TS 103 221-1). The mediation function does not need to know the target identifier: it maps every incoming X2/X3 record to its LIID(s) and LEMF(s) by the XID, and uses the correlation information carried in X2/X3 to associate events and content belonging to the same communication across network elements.
The second core function is IRI generation. From the event records (xIRI) produced by the points of interception, which may include copies of signalling such as SIP messages or RADIUS and DHCP packets, the mediation function builds the final intercept-related information records in the format required by the applicable handover standard (e.g. ETSI TS 102 232-x for IP-based handover, ETSI TS 101 671 / 3GPP TS 33.108 for legacy mobile and circuit-switched services, 3GPP TS 33.128 for 5G) and encodes them in ASN.1 (BER). The IRI events must be accurately timestamped and sequenced to provide a reliable record of the target’s communication activity.
The third core function is CC processing. The mediation function receives the intercepted content — voice and multimedia streams and IP packets — from the points of interception over X3 and prepares it for delivery over the HI3 interface. SMS content is normally delivered as IRI over HI2. With circuit-switched (ISDN) handover, media must be adapted to 64 kbit/s bearers. With IP-based handover (ETSI TS 102 232-5, 3GPP TS 33.108/33.128), the content is delivered as a transparent, decrypted copy together with its codec description. Where operator-applied media encryption cannot be removed, the decryption keys are delivered to the LEMF as IRI over HI2 instead. For data interception, it involves encapsulating IP packets in the ETSI-defined delivery format. The mediation function must handle the correlation of multiple media streams within a single session, ensuring that related voice and data streams are correctly associated and, where national rules require it (e.g. Germany, TR TKÜV section 3.1.2), that a call’s content reaches each recording connection only once, under a single correlation number.
The fourth core function is secure delivery. The mediation function establishes and maintains secure connections to the LEMF over the HI2 and HI3 interfaces. This runs over a protected path: a VPN (for example IPsec crypto boxes, as mandated in Germany) or TLS 1.2/1.3 with certificate-based authentication, depending on the national framework, and includes managing certificates and handling connection failures and reconnection. The delivery mechanism must ensure reliable, in-order delivery of IRI events and CC data, with short-term buffering (national rules set the minimum, e.g. 5 minutes in Germany) and flow control to handle temporary connectivity issues.
Warrant management is not a mediation task, but it is closely linked. Through HI1 (e.g. ETSI TS 103 120), the administration function (ADMF) receives orders, validates them, manages their lifecycle and audit trail — tracking activation, modification, and deactivation — and provisions the network elements and the MF over X1. In some implementations, the ADMF is a separate component that interfaces with the mediation function; in others, it is packaged together with the mediation platform. The standards keep the two functions distinct.
调解功能为何至关重要
The mediation function is essential for several reasons. First, it adapts the operator-internal X2/X3 delivery to the handover interfaces each authority requires. Network functions from different vendors report in the same standardised X2/X3 formats; the mediation function adds the LIID, applies the national handover profile, correlates IRI with CC and delivers to each LEMF. Where older equipment still uses a proprietary LI interface, the mediation function also absorbs that format.
Second, together with the administration function, the LI platform gives the operator a single point of control and management for all interception activities. Rather than configuring interception at each individual network element, the operator manages all active intercepts in the ADMF, which provisions the network elements and the mediation platform over X1. This centralisation simplifies operations, reduces the risk of errors, and improves auditability.
第三，调解功能提供了运营商网络与执法领域之间的安全边界。通过调解功能传输所有移交数据，运营商可以实施一致的安全控制、日志记录和监控。这远比试图确保从多个网元到 LEMF 的直接连接的安全更易于管理。.
第四，调解功能使操作员能够同时支持多个LEMF。在存在多个 执法机构 may issue interception orders — or where a centralised interception platform receives data from multiple operators — the mediation function can route intercepted data to the appropriate LEMF using the LIIDs and delivery destinations provisioned for each task, while keeping each agency’s interception strictly separate and invisible to the others, and, in the multi-operator case, with each operator’s traffic labelled with that operator’s own identifier.
架构和部署注意事项
调解功能的架构取决于运营商的网络拓扑结构、拦截量、网络技术的多样性以及国家信息安全框架的具体要求。在简单的部署中，单个调解平台可服务于整个网络，接收来自所有网元的截获数据，并向单个 LEMF 传输移交数据。在更复杂的环境中，可能需要分布式调解架构，调解节点靠近主要网元，由中央管理节点协调整体运行。.
可扩展性是一个关键的设计考虑因素。调解功能必须能够在不降低性能的情况下处理预期的并发拦截数量。对于用户基数大或拦截量大的运营商来说，这可能需要多实例部署，并具备负载平衡和故障切换功能。调解平台的尺寸应能在有余量的情况下处理峰值负载，因为容量限制导致的拦截失败是不可接受的。.
可靠性同样重要。调解功能是 LI 链的关键组成部分，调解功能的任何故障都会导致截获数据无法交付。运营商应采用具有自动故障切换功能的冗余调解平台，并应持续监控调解功能的健康状况和性能。必须仔细规划维护窗口和软件更新，以避免中断正在进行的拦截。.
Integration with the operator’s existing network management and security operations infrastructure is also important. The mediation function should be integrated with the operator’s monitoring systems, alarm management systems, and security information and event management (SIEM) platforms. This integration ensures that issues with the mediation function are detected and resolved promptly, and that security events related to the LI infrastructure are captured and analysed — without exposing target identities, LIIDs or warrant data to staff who are not cleared for LI; alarms and logs leaving the LI domain must be sanitised.
选择调解平台
When selecting a mediation platform, operators should evaluate several key criteria. Standards compliance is the first consideration — the platform must support the handover standards required by the national framework (usually ETSI-based, often with a national profile). Network technology support is the second — the platform must be able to interface with all network elements and protocols in the operator’s infrastructure, including legacy circuit-switched elements, IMS/VoLTE components, and 5G core network functions, which deliver over the standardised X2/X3 interfaces (ETSI TS 103 221-2), while the platform itself is provisioned by the ADMF over X1 (ETSI TS 103 221-1).
应根据运营商当前和预计的截获量评估可扩展性和性能。安全功能（包括加密、访问控制、审计日志和证书管理）应满足运营商安全政策和国家信息安全框架的要求。可管理性和易操作性是影响总体拥有成本和信息安全团队操作负担的实际考虑因素。.
供应商的跟踪记录和支持能力也很重要。随着网络技术的发展和 LI 标准的修订，调解功能需要持续的维护、更新和支持。运营商应选择对 LI 市场有承诺、有及时支持和更新记录的供应商。.
结论
The mediation function is the essential bridge between the operator’s network and law enforcement. It turns the standardised records delivered by the points of interception into the handover formats each authority requires, provides the security boundary between the operator and law enforcement domains, and enables the reliable, scalable delivery of intercepted material, while the administration function centralises the management of interception operations. For operators, investing in a robust, well-designed mediation function is one of the most important decisions in building a compliant and effective 合法截获能力.
相关文章
如需进一步了解相关主题，请浏览这些文章：
- ETSI TS 103 120 Explained: The Electronic HI1 Warrant Interface
- HI1 vs HI2 vs HI3：了解三种合法拦截接口
- 合法拦截管理系统 (LIMS) 应具备哪些功能
外部资源
以下外部资源提供了更多背景资料和官方文件：
