5G网络切片技术为合法截获合规性带来了挑战与机遇。 网络切片是5G独立组网（SA）架构的一项标志性功能。通过在共享的物理基础设施上创建逻辑上相互隔离的网络分区，运营商可以根据不同服务、应用或客户群体的具体要求，量身定制连接特性——包括时延、带宽、可靠性和安全性。 对于合法截取而言，网络切片既带来了显著的复杂性，但矛盾的是，同时也可能带来简化。对于任何正在部署或规划5G SA网络的运营商而言，理解网络切片如何影响合法截取的目标定位、执行和交付至关重要。.
本文探讨了网络切片与合法截获之间的交集，内容涵盖技术架构、目标识别与截获执行面临的挑战，以及网络切片可能带来的潜在益处，包括 LI 操作, ，以及运营商在分片网络环境中为确保合规性应采取的具体措施。.
5G网络切片如何影响LI
In a 5G SA network, a network slice is a logically isolated end-to-end network that includes specific configurations of radio access, transport, and core network resources. Each slice is identified by a Single Network Slice Selection Assistance Information (S-NSSAI) value and is designed to meet particular service requirements. For example, one slice might be optimised for ultra-reliable low-latency communication (URLLC) for industrial control, another for massive IoT (MIoT) sensor networks, and a third might provide enhanced mobile broadband (eMBB) for consumer smartphones.
从核心网络的角度来看，每个切片可能拥有某些网络功能（如 SMF、UPF 和 PCF）的专用实例，也可能与其他切片共享网络功能实例。 切片之间的隔离程度是可配置的，取决于运营商的部署策略以及切片的要求。这种灵活性是切片技术的一大优势，但也给需要跨切片边界运行的功能（包括合法截取）带来了复杂性。.
A single subscriber may simultaneously use services across multiple slices. A smartphone user might have their voice traffic routed through one slice, their video streaming through another, and their IoT companion device connected through a third. Each slice may have its own UPF, its own PDU session, and its own IP addressing. Which slice carries which traffic is decided by the device’s route selection policy (URSP), within the slices the network allows, selected with the help of the NSSF and the subscription data in the UDM.
LI靶向治疗的并发症
Network slicing complicates LI targeting in several ways. The most fundamental complication is that a target’s traffic may be spread across multiple slices, each potentially served by different UPF instances. A single interception order must result in the capture of all the target’s communications, regardless of which slice they traverse. This requires the operator to equip every network function that can serve the target, including dedicated per-slice SMFs and UPFs, with LI functions, and to provision the task to all of them.
Target identification in a sliced environment is more complex than in a non-sliced network. The same subscriber may appear with different session contexts, different IP addresses, and different QoS characteristics depending on which slice is serving a particular communication flow. Every interception point tags its X2/X3 records with the task’s XID, so the mediation function delivers every session in every slice under the same LIID, and the IRI tells the LEA which slice (S-NSSAI) each session used.
The dynamic nature of slice allocation adds further complexity. Slices can be created, modified, and terminated dynamically, and a target’s traffic may move between slices as service requirements change. If the task was provisioned only to the network functions of some slices, a change in the target’s subscribed slices (which the UDM reports as IRI) can leave a gap, and the administration function must extend the task to the SMFs of the new slices. Provisioning every SMF that can serve the target avoids this, because UPF interception is then triggered per session.
Another complication arises from the potential for different slices to be operated by different entities. In some business models, an enterprise or vertical industry partner may operate its own slice on the operator’s infrastructure, potentially with its own network functions and operational management. The question of who is responsible for lawful interception within such a slice — the infrastructure operator, the slice tenant, or both — is a regulatory and contractual question. In most frameworks the answer follows the service: whoever provides a publicly available communications service over the slice carries the LI obligation. A private enterprise slice that is not offered to the public is usually out of scope, and the infrastructure operator remains responsible for the parts of its network that serve public services. Contracts must reflect this, and the operator must keep its LI functions secure even in slices it does not manage.
切片如何简化 LI
Despite these complications, network slicing can also offer potential benefits for lawful interception. The logical isolation of slices means that traffic within a slice is already segregated from traffic in other slices. If the target can only use certain slices, the administration function can provision the task only to the network functions of those slices (3GPP TS 33.127, clause 5.3.5.5), which keeps the number of provisioned interception points small.
Slicing can also enable more granular interception. Instead of intercepting all of a target’s traffic — which in a modern smartphone environment can include significant volumes of background data, software updates, and other non-relevant traffic — slicing could potentially allow the interception to be focused on specific service types or communication flows. In practice, however, limiting interception to particular slices is generally not an option: national rules such as § 5(2) TKÜV in Germany require a complete copy of the target’s communications. Where an order covers only certain services, the standards provide service scoping by service type, not by slice.
从安全角度来看，切片之间的隔离可以为 LI 功能提供额外的保护。通过在专用的、安全的切片内部署 LI 组件——或者确保网络功能之间以及与 调解平台 is carried on a separate, isolated transport path — operators can enhance the confidentiality and integrity of the interception process. Slice isolation can help, but LI functions still need their own protected trust domain. In virtualised networks 3GPP requires them to meet ETSI GS NFV-SEC 012 (TS 33.126, R6.6-160).
切片网络中 LI 的 3GPP 标准
The 3GPP LI architecture for 5G, defined in TS 33.127 and TS 33.128, addresses network slicing explicitly. 3GPP’s LI requirements (TS 33.126) are technology-neutral: interception must be complete regardless of how the network is built, and that includes slicing. TS 33.127 and TS 33.128 add slice-aware provisioning and report slice information (S-NSSAI) in the IRI. On X1, a task names the target and, optionally, the service types to intercept. Slices are not an X1 parameter. Instead, the administration function decides which network functions, and therefore which slices, receive the task (3GPP TS 33.127, clause 5.3.5.5), and the X2 and X3 interfaces carry xIRI and xCC from interception points in any slice to the MDF, which turns them into IRI and CC for delivery.
The standards define that the AMF, which handles the target’s registration and mobility management, is a key interception point for slice-related IRI. When a target registers with the network and is allocated to one or more slices, the AMF generates IRI events that include the slice information. CC interception in the UPF is triggered per PDU session: the SMF serving that session, which holds the LI task, instructs its UPF over the internal LI_T3 interface. The operator must therefore make sure every SMF that can serve the target, in every slice, carries the task and that every UPF supports LI_T3 and X3.
The UDM is itself an interception point: it reports changes to the target’s subscribed slices as IRI. To keep coverage complete as slices change, the LI administration function learns about new SMFs and UPFs from the operator’s management and orchestration systems when they are instantiated, and from the System Information Retrieval Function (SIRF) in the NRF when they register and are ready for traffic (3GPP TS 33.127, clauses 5.3.5.3 and 5.3.6).
对运营商的实际影响
Operators deploying 5G SA networks with slicing capabilities should address LI requirements from the earliest stages of slice design and deployment. Several practical steps are recommended. First, ensure that your LI system is aware of the slice architecture and can dynamically discover and configure interception points within any slice. This requires integration between the LI administration function and the operator’s orchestration systems and the NRF-based System Information Retrieval Function (SIRF), so that new SMFs and UPFs are provisioned as they are created.
Second, verify that the UPFs deployed within each slice support the LI_T3 trigger and the X3 interface for content delivery to the LI mediation function, and that the SMFs serving those slices support the IRI point of interception and the CC triggering function. If a slice uses a UPF that does not support X3, the operator will have a gap in its interception capability for traffic traversing that slice. This is a procurement requirement that should be included in all UPF vendor specifications.
Third, develop procedures for handling interception orders that span multiple slices. The LI operations team must understand how to provision tasks that cover all of a target’s slice allocations and when the administration function has to extend a task to the network functions of additional slices. Automation of this process is highly recommended, as manual configuration across multiple slices is error-prone and slow.
第四，解决共享或企业运营的切片中LI涉及的治理和合同问题。如果第三方在您的基础设施上运营切片，则必须在商业协议中明确界定合法截获的责任，且必须符合各相关司法管辖区的监管要求。.
结论
5G独立组网（SA）中的网络切片为合法截获带来了挑战与机遇。目标流量分布在多个切片中、切片分配的动态特性，以及第三方运营切片的可能性，都使截获过程变得更加复杂。 与此同时，切片的逻辑隔离性和粒度特性，为实现精准、高效的截取提供了新途径。 对于运营商而言，关键在于在切片设计阶段就主动满足合法截取的要求，确保其合法截取系统具备切片感知能力并能动态适应，同时在多租户切片环境中建立明确的截取责任治理机制。通过这些措施，运营商既能履行合规义务，又能充分发挥5G网络切片的全部潜力。.
展望未来，网络切片向更动态、基于意图的模型演进，将进一步增加切片环境中流量拦截（LI）的复杂性。 未来的网络可能会出现按需创建和销毁的切片，资源将根据服务需求实时分配和释放。LI系统必须与这些功能同步演进，即使底层网络拓扑不断变化，仍能保持全面的拦截覆盖。那些投资于灵活且符合标准的 LI 解决方案 随着其5G网络日趋成熟，这些企业将能够更好地适应未来的发展，并确保持续合规。.
随着5G网络切片部署日趋成熟，拦截方面的挑战也将随之演变。运营商在设计5G网络切片LI架构时，应着眼于未来的可扩展性。.
相关文章
如需进一步了解相关主题，请浏览这些文章：
外部资源
以下外部资源提供了更多背景资料和官方文件：
