截获的相关信息构成了每个的元数据骨干 合法拦截 操作。在合法截获中，有两类数据对每项截获操作都至关重要：截获相关信息（IRI）和通信内容（CC）。 在执行截获令时，这两类数据构成了运营商向执法部门提供的核心内容，并且在ETSI框架中，它们通过各自独立的交接接口进行传输——IRI通过HI2接口传输，CC通过HI3接口传输。 尽管大多数从业者都理解这一基本区别——IRI是元数据，CC是内容——但这种区别在实践中的影响比表面看起来更为复杂。.
本文探讨了 IRI 和 CC 在实践中的实际含义、各自包含的数据元素、数据元素的生成和传输方式，以及为什么这种区别对运营商、执法部门和更广泛的合法拦截生态系统很重要。.
拦截相关信息的含义
Intercept-related information encompasses all the metadata associated with an intercepted communication. In the simplest terms, IRI answers the questions: who communicated, with whom, when, for how long, using what service, and from where? It does not include the substance of the communication itself — that is the domain of CC. IRI is defined by the applicable handover standard: the ETSI TS 102 232 series for IP-based services, ETSI TS 101 671 / 3GPP TS 33.108 for legacy mobile and circuit-switched services, and 3GPP TS 33.128 for 4G/5G under the current 3GPP architecture. These specify the data elements, encoding formats, and delivery mechanisms for different network technologies.
IRI 中包含的具体数据元素因通信类型和涉及的网络技术而异。对于传统语音呼叫，IRI 通常包括主叫号码（A 号码）、被叫号码（B 号码）、目标设备的 IMSI 和 IMEI、呼叫发起时间、接听时间、呼叫持续时间、呼叫开始时和呼叫过程中的小区标识符（提供位置信息）以及呼叫的处理（接听、忙、无应答、转发）。对于 IP 数据会话，IRI 可能包括目标的 IP 地址、分配的 APN（接入点名称）、承载参数、会话开始和结束时间以及传输的数据量。.
IRI is generated as a series of events that correspond to the progression of the communication. The ETSI standards define specific IRI event types for different stages of a communication — for example, a call setup event, an answer event, a call release event, and various supplementary service events. Each event carries the relevant data elements and an accurate timestamp. Interception points in the network elements detect these events in the signalling (SIP, Diameter, GTP, SS7 and others) and pass them to the 中介函数, which turns them into standard IRI records in ETSI format.
IRI 最重要的特点之一是其结构性。由于 IRI 是按照定义明确的数据结构以 ASN.1 格式编码的，因此执法系统可以对其进行自动解析、处理和分析。这种结构化格式可实现自动关联、模式分析和数据挖掘操作，而这些操作对于非结构化数据来说要困难得多。IRI 的调查价值不容低估--在许多情况下，IRI 提供的元数据与内容本身一样有价值，甚至更有价值。.
定义 CC：内容层
Content of communication is the actual substance of the intercepted communication — the words spoken in a phone call, the web pages browsed during a data session, the files attached to an email. CC represents what was communicated, as opposed to the contextual information about the communication. CC is delivered over the HI3 interface to the LEMF.
The format of CC varies dramatically depending on the type of communication. For voice calls, CC is a real-time audio stream, typically encoded using codecs such as AMR (Adaptive Multi-Rate), AMR-WB (Wideband), or G.711. The audio must be delivered in real time so that law enforcement can monitor the conversation as it occurs, though it is also typically recorded for later review. SMS is a notable exception: in 3GPP networks the message text travels with the IRI over HI2, not as CC over HI3, and whether the full text may be delivered depends on the scope of the warrant. For data sessions, CC consists of the IP packets exchanged by the target, which may contain web browsing traffic, email content, application data, streaming media, and any other type of IP-based communication.
数据拦截产生的 CC 流量远远大于语音拦截。一个语音通话会产生连续但带宽相对较低的音频流，而一个数据会话可产生数千兆字节的流量，具体取决于目标的活动。这种差异对 LI 系统的尺寸、HI3 传输通道的带宽以及 LEMF 所需的存储容量都有重要影响。.
The delivery of CC must be timely. For voice interception, this means real-time delivery with minimal latency. For data interception, near-real-time delivery is typically required, though the exact requirements may vary by jurisdiction. For IP-based handover, ETSI TS 102 232-1 delivers CC over TCP, protected by a VPN or TLS; legacy circuit-switched handover uses ISDN bearer channels.
区别为何重要
The distinction between IRI and CC is not merely technical — it has significant legal, operational, and strategic implications. From a legal perspective, many jurisdictions treat metadata and content differently. Some interception orders may authorise the collection of both IRI and CC, while others may be limited to metadata only. The legal thresholds for obtaining authorisation may differ, with content interception typically requiring a higher standard of evidence or a more serious category of offence. Operators must be able to activate IRI-only, CC-only and combined IRI-plus-CC intercepts independently, as the scope of the interception order dictates what data can be collected and delivered.
从操作角度看，IRI 和 CC 在数量、格式、处理要求和传输机制方面具有不同的特点。IRI 结构相对紧凑，非常适合自动处理和分析。而 CC 可能数量庞大，格式千差万别，需要不同的处理、存储和分析方法。运营商必须设计自己的 LI 系统，通过适当的缓冲、流量控制和服务质量机制，高效处理这两种数据类型。.
从战略和调查的角度来看，IRI和CC提供不同类型的情报。IRI能够进行模式分析、网络绘图、位置追踪，并识别随时间变化的通信模式。CC则能直接洞悉特定通信的内容，但其处理和分析可能需要投入大量精力——特别是对于产生大量混合媒体内容的通信截获数据而言。. 执法机构 越来越认识到元数据的战略价值，在某些调查中，IRI 可能成为截获行动的主要目标。.
现代网络中的 IRI
从电路交换网络到分组交换网络的过渡大大扩展了 IRI 的范围和复杂性。在传统电话网络中，IRI 相对简单--呼叫设置信令提供了一套定义明确的元数据元素。在现代 IP 网络中，信令环境更加多样化和复杂，涉及 SIP、Diameter、GTP-C 等协议和各种应用层协议。.
VoLTE, for example, uses SIP signalling over the IMS (IP Multimedia Subsystem) core, combined with Diameter for authentication and policy control and GTP for bearer management. Generating complete IRI for a VoLTE call requires interception points in several IMS and packet-core functions, whose events the mediation function must correlate into one coherent picture of the call. The ETSI standards define specific IRI data elements for IMS-based services, but the practical implementation can be challenging.
In 5G networks, the complexity increases further. The service-based architecture of the 5G core introduces new network functions and signalling interfaces that must be monitored for IRI generation. The 3GPP LI architecture for 5G defines specific point-of-interception (POI) locations and IRI data elements for 5G services, but operators must ensure that each 5G network function’s built-in point of interception is enabled and delivers the 3GPP-defined X2 records (TS 33.128), and that their mediation and delivery function supports them.
加密对 CC 的影响
在现代网络中，CC 传输面临的最大挑战之一是加密技术的日益普及。端到端加密通信（如使用 E2EE 的消息应用程序提供的通信）无法在网络层进行有效拦截。运营商可以捕获加密数据包，但如果没有加密密钥，就无法理解其内容。这就造成了一种情况，即运营商可以提供 IRI（由网络信令生成，不依赖于对内容的访问），但无法提供可用的 CC。.
This encryption challenge has become one of the central policy debates in the lawful interception community. Law enforcement agencies argue that encryption creates blind spots that hinder criminal investigations, while privacy advocates maintain that strong encryption is essential for protecting fundamental rights. The resolution of this debate — if one is reached — will have profound implications for the CC component of lawful interception. In the meantime, operators must remove any encryption they provide or manage, or hand over the keys. End-to-end encryption that an over-the-top application controls is outside their reach, so they deliver that content as they see it, while being transparent with law enforcement about the limitations imposed by encryption.
运营商的实际考虑因素
Operators implementing LI systems must ensure that their points of interception and their mediation function together produce complete, accurate, and timely IRI and CC for all services and network technologies in their portfolio. This requires every relevant network function to support standard X2/X3 delivery (ETSI TS 103 221-2, 3GPP TS 33.128), and careful attention to correlation and timing in the mediation function.
测试对于验证 IRI 和 CC 的正确生成至关重要。运营商应根据 ETSI IRI 数据结构定义进行全面测试，确保每个事件类型都存在并正确填入所有必要的数据元素。应在所有支持的媒体类型中测试 CC 传输的保真度、定时和完整性。.
最后，随着网络的发展，运营商必须维护其 LI 系统。新服务、新协议和新网络技术需要更新 IRI 生成和 CC 捕获功能。一个在部署时完全合规的合法拦截系统可能会随着网络的变化而变得不合规，因此持续维护和开发是合规计划的关键部分。.
结论
IRI 和 CC 是合法拦截数据传输的两大支柱。IRI 提供结构化元数据，可用于模式分析、位置跟踪和通信映射。CC 提供截获通信的实际内容，可直接洞察目标的通信内容。它们共同构成一幅完整的画面，为执法调查提供支持。对于运营商而言，了解 IRI 和 CC 的技术、法律和操作影响，并建立能有效处理这两种情况的 LI 系统，对于履行其在现代电信网络中的合法拦截义务至关重要。.
准确收集截获相关信息是合法截获行动的基础。操作人员必须确保其系统捕获所有必要的拦截相关信息字段。.
相关文章
如需进一步了解相关主题，请浏览这些文章：
- HI1 vs HI2 vs HI3：了解三种合法拦截接口
- 调解功能如何发挥作用：您的网络与执法部门之间的桥梁
- ETSI TS 103 120 Explained: The Electronic HI1 Warrant Interface
外部资源
以下外部资源提供了更多背景资料和官方文件：
