了解 HI1、HI2 和 HI3 接口是正确实施合法截获的基础。每个合法截获系统的核心都是一组标准化接口，这些接口规定了如何管理、处理被截获的通信，并将其交付给执法部门。 在 ETSI 框架中——该框架是欧洲及全球大部分地区合法截获（LI）的主导标准——这些接口被命名为 HI1、HI2 和 HI3。它们共同构成了完整的交接架构，将运营商的网络连接到 执法监控设施 (LEMF)。尽管这三个接口具有至关重要的意义，但它们之间的区别却经常被误解，甚至连电信和执法领域的专业人士也不例外。.
本文对每个接口都作了清晰、详细的解释--它承载什么、如何工作以及为什么重要。了解 HI1、HI2 和 HI3 不仅仅是一项学术工作，对于参与设计、采购、部署或操作合法拦截系统的任何人来说都至关重要。.
了解 HI1 HI2 HI3 接口
Before examining each interface individually, it is important to understand where they sit within the broader LI architecture. The ETSI model divides the interception process into several functional components. In the classic ETSI model (TS 101 671), the key components on the operator’s side are the internal interception function (IIF), which performs the actual interception within the network, and the 中介函数 (MF), which translates the intercepted data into the standardised formats required by the handover interfaces. Current ETSI and 3GPP architectures (TS 104 007, TS 103 221, 3GPP TS 33.127) call them the point of interception (POI) and the mediation and delivery function (MDF). On the law enforcement side, the LEMF receives the intercepted data and provides tools for analysis and investigation.
三个 HI 接口跨越运营商领域和执法领域之间的边界。HI1 处理行政交换，HI2 传输与截获相关的信息，HI3 传输通信内容。每个接口都独立运行，但所有三个接口都必须协同工作，以支持完整的拦截操作。将这些功能分离成不同的接口，可确保截获的行政、元数据和内容方面能够根据其不同的要求进行管理、保护和处理。.
HI1：行政界面
HI1 是执法部门与运营商之间的行政界面。其主要目的是将执法机构的拦截命令传达给操作员，并管理拦截的生命周期--从启动、修改到停用。HI1 是截取过程的指挥和控制通道。.
执法机构通过 HI1 发送截取命令的详细信息，包括目标身份（可通过电话号码、IMSI、IMEI、IP 地址、电子邮件地址或其他标识符指定）、截取范围（仅内容、仅元数据或两者）、授权期限以及任何特定参数或限制。运营商确认收到指令、确认激活并报告截取状态。.
HI1 还可处理对现有截取的修改（例如延长期限、更改目标标识符或调整范围），以及在授权过期或撤销时停止截取。在某些实施方案中，HI1 还支持交换行政元数据，如授权令编号、案件参考和操作员响应代码。.
The implementation of HI1 varies significantly between jurisdictions and operators. In some countries, HI1 is a fully automated, machine-to-machine interface using defined protocols and message formats. In others, it remains a largely manual process, with interception orders delivered by fax, secure email, or physical document and acknowledged through similar channels. ETSI TS 103 120 now defines a complete electronic HI1 protocol, and 3GPP requires 5G networks to support it, but national legal and institutional arrangements still vary widely.
由於 HI1 載有正在進行的截取行動的敏感資料，因此其保安問題至為重要。未经授权访问 HI1 可能会向目标暴露截获行动的存在，或允许启动未经授权的截获行动。因此，实施工作必须包括强有力的身份验证、加密、访问控制和审计记录。.
HI2：拦截相关信息接口
HI2 是向 LEMF 提供截获相关信息（IRI）的接口。IRI 是与截获通信相关的元数据--通信的人员、时间、地点和方式，但不包括实际内容。HI2 通常被称为元数据接口，它所携带的信息对执法调查至关重要，其调查价值往往不亚于或超过内容本身。.
The IRI delivered over HI2 typically includes the identities of the communicating parties (calling and called numbers, IMSI, IMEI), the time and duration of the communication, the type of service (voice, SMS, data), the network elements involved, cell identifiers and location information, IP addresses and port numbers, and signalling information such as SIP headers or Diameter messages. The specific data elements included in the IRI vary depending on the type of communication and the network technology, and are defined in the applicable handover standard: ETSI TS 102 232-2 to -7 for IP-based services, ETSI TS 101 671 / 3GPP TS 33.108 for legacy mobile and circuit-switched services, and 3GPP TS 33.128 for 5G.
HI2 数据采用 ASN.1（抽象语法表示法 1）进行编码，该标准为表示 IRI 数据元素提供了一种正式且结构化的格式。使用 ASN.1 可确保数据在不同实现之间能够被无歧义地编码和解码，从而支持运营商之间的互操作性，并 执法机构. HI2 and HI3 are protected either by a private managed network, by a VPN (for example the IPsec crypto boxes mandated in Germany), or by TLS 1.2/1.3 with certificate-based mutual authentication, depending on the national framework; delivery uses TCP to ensure reliable, in-order delivery.
One of the complexities of HI2 is the need to generate IRI events in real time as the intercepted communication progresses. For a voice call, this means generating events for call setup, ringing, answer, call modification (such as hold or conference), and call release. For a data session, it means generating events for session establishment, address allocation, bearer activation, and session termination. The interception points in the network detect the call or session events, and the mediation function turns them into standard IRI records with accurate timestamps.
HI2 对于涉及位置跟踪、网络分析和生活模式评估的调查尤为重要。通过 HI2 传输的元数据可以揭示通信模式、地理移动和网络使用情况，这对许多类型的犯罪调查至关重要。对于运营商而言，确保 HI2 数据的完整性和准确性是其 LI 系统的关键质量指标。.
HI3：通信接口的内容
HI3 is the interface for delivering the content of communications (CC) to the LEMF. CC is the actual substance of the intercepted communication — the voice audio, the web pages viewed, the emails sent and received, the files transferred. (SMS is the classic exception: in 3GPP networks its text is delivered as IRI over HI2.) HI3 is the interface that carries the material that law enforcement needs to understand what the target is communicating, as opposed to the metadata about how and when the communication occurs.
CC 数据的格式和数量因截获的通信类型不同而有很大差异。对于语音通话，CC 是实时音频流，通常使用 AMR（自适应多速率）或 G.711 等标准编解码器编码。对于数据会话，CC 包括目标交换的 IP 数据包，其中可能包括网络流量、电子邮件信息、文件传输、流媒体和任何其他类型的 IP 通信。单次数据截取产生的数据量可能比语音截取产生的数据量大几个数量级。.
HI3 delivery must be real-time for voice and near-real-time for data. The intercepted content must be delivered to the LEMF with minimal latency to support time-critical investigations. For IP-based handover (ETSI TS 102 232), all content, including voice, is wrapped in PS-PDUs and sent over TCP (protected by a VPN or TLS). Captured RTP media becomes the payload of these PDUs rather than being sent as RTP. Legacy circuit-switched handover uses ISDN bearer channels instead.
The handling of encrypted content on HI3 is one of the most challenging aspects of modern LI. If the target’s communications are encrypted at the application layer (for example, using end-to-end encryption in a messaging application), the operator may only be able to deliver the encrypted content on HI3, which is of limited value to law enforcement. Operators must remove any encryption they apply or manage themselves, or supply the keys (3GPP TS 33.126). End-to-end encryption applied by an over-the-top application is outside the operator’s control, so the operator can only deliver that content as it sees it — and the growing prevalence of such encryption is creating a widening gap between what law enforcement expects and what operators can deliver.
三个接口如何协同工作
在典型的监听行动中，这三个接口协同工作的方式如下。首先，执法机构通过 HI1 向运营商发送监听令，其中明确了监听目标、范围和持续时间。运营商 LI管理系统 processes the order, validates the warrant, and provisions the points of interception (POIs) and the mediation function over X1 to begin intercepting the target’s communications.
When the target initiates or receives a communication, the POIs capture the relevant signalling and content and pass them to the mediation function over X2 and X3. The mediation function processes this data, turning the detected events into IRI records encoded in ASN.1 format for delivery over HI2, and encapsulating the CC for delivery over HI3. Both streams are transmitted securely to the LEMF, where they are correlated and presented to investigators.
在整个拦截过程中，HI1 出于管理目的保持激活状态--执法机构可使用它请求更新状态、修改拦截参数或发出停用命令。当拦截终止时，操作员通过 HI1 确认停用，并停止通过 HI2 和 HI3 发送 IRI 和 CC。.
运营商的实际考虑因素
实施三种 HI 接口的操作员必须考虑几个实际问题。首先是系统尺寸。HI2 和 HI3 接口的尺寸必须能够处理预期的并发拦截量，而不会出现数据丢失或过度延迟。对于数据量大的拦截，HI3 的带宽要求可能很高，运营商必须确保其传输基础设施配置充足。.
The second consideration is security. All three interfaces carry sensitive information and must be protected against unauthorised access, eavesdropping, and tampering. This requires a protected delivery path (a private network, VPN or TLS with mutual authentication, as the national framework prescribes) and comprehensive audit logging. Security failures on any of the three interfaces can compromise the integrity of the interception process and potentially expose sensitive law enforcement operations.
第三个考虑因素是互操作性。运营商必须确保其 HI 实施与辖区内执法机构使用的系统兼容。这通常需要进行正式的互操作性测试，这可能是一个耗时的过程。在开发过程中，运营商应尽早与其国家执法技术联系人联系，以确定并解决兼容性问题。.
结论
HI1、HI2 和 HI3 接口构成了 ETSI 合法拦截移交架构的主干。HI1 提供管理控制通道，HI2 提供对调查至关重要的丰富元数据，而 HI3 则传输截获通信的实际内容。它们共同实现了完整的、基于标准的拦截能力，支持运营商和执法部门的需求。了解每个接口的不同作用、技术要求和实际挑战，对于参与现代电信网络合法拦截系统的设计、部署或运营的任何人来说都至关重要。.
正确实现 HI1、HI2 和 HI3 接口对于……至关重要 合法截取合规性. 运营商必须在正式上线前对其 HI1、HI2 和 HI3 的实现进行彻底测试。.
相关文章
如需进一步了解相关主题，请浏览这些文章：
- ETSI TS 103 120 Explained: The Electronic HI1 Warrant Interface
- IRI 与 CC：截获相关信息的实际意义
- 5G 中的 X1/X2/X3 接口：3GPP LI 架构解析
外部资源
以下外部资源提供了更多背景资料和官方文件：
