ETSI TS 102 232-3-2016 Lawful Interception (LI) Handover Interface and Service-Specific Details (SSD) for IP delivery Part 3 Service-specific details for internet access services (.pdf

1、 ETSI TS 102 232-3 V3.4.1 (2016-09) Lawful Interception (LI); Handover Interface and Service-Specific Details (SSD) for IP delivery; Part 3: Service-specific details for internet access services floppy3TECHNICAL SPECIFICATION ETSI ETSI TS 102 232-3 V3.4.1 (2016-09)2 Reference RTS/LI-00135-3 Keywords

2、 access, internet, IP, Lawful Interception, security, service ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Im

3、portant notice The present document can be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior writt

4、en authorization of ETSI. In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document

5、 should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at https:/portal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of th

6、e following services: https:/portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of th

7、e PDF version shall not be modified without the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2016. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of E

8、TSI registered for the benefit of its Members. 3GPPTM and LTE are Trade Marks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered and owned by the GSM Association. ETSI ETSI TS 102 232-3 V3.4.1 (2016-09)3 Contents

9、 Intellectual Property Rights 5g3Foreword . 5g3Modal verbs terminology 5g3Introduction 5g31 Scope 6g32 References 6g32.1 Normative references . 6g32.2 Informative references 7g33 Definitions and abbreviations . 7g33.1 Definitions 7g33.2 Abbreviations . 8g34 General . 9g34.1 Internet Access Service (

10、IAS) 9g34.2 Target identity and IP address 9g34.3 Lawful Interception requirements 10g34.3.1 Target identity . 10g34.3.2 Result of interception 10g34.3.3 Intercept related information messages. 11g34.3.4 Time constraints 11g34.3.5 Preventing over and under collection of intercept data . 11g35 System

11、 model . 12g35.1 Reference network topologies 12g35.1.1 Dial-up access . 12g35.1.2 xDSL access 13g35.1.3 Cable modem access . 14g35.1.4 IEEE 802.11 Access (with Wireless LAN profile) . 15g35.2 Reference scenarios 15g35.2.1 Logon 15g35.2.2 Multi logon . 15g35.2.3 Multilink logon . 16g35.2.4 IP transp

12、ort 16g35.2.5 Logoff . 16g35.2.6 Connection loss . 16g36 Intercept Related Information (IRI) . 17g36.1 IRI events . 17g36.2 HI2 attributes 18g36.2.1 Use of targetIPAddress, additionalIPAddress and otherTargetIdentifiers fields 19g36.2.2 Use of location field 19g37 Content of Communication (CC) . 20g

13、37.1 CC events . 20g37.2 HI3 attributes 20g38 ASN.1 for IRI and CC 20g3Annex A (informative): Stage 1 - RADIUS characteristics . 26g3A.1 Network topology . 26g3A.1.1 RADIUS server 26g3A.1.2 RADIUS proxy . 26g3A.2 RADIUS service . 27g3A.2.1 Authentication service 27g3A.2.2 Accounting service . 28g3ET

14、SI ETSI TS 102 232-3 V3.4.1 (2016-09)4 A.3 RADIUS protocol . 29g3A.3.1 Authentication protocol 29g3A.3.2 Accounting protocol . 29g3A.4 RADIUS main attributes 30g3A.5 RADIUS interception . 31g3A.5.1 Collecting RADIUS packets. 31g3A.5.2 Processing RADIUS packets 31g3A.5.2.1 Mapping events to RADIUS pa

15、ckets 31g3A.5.2.2 Functional model 32g3A.5.2.3 RADIUS spoofing 35g3A.5.3 Mapping RADIUS on the IRI structure 35g3Annex B (informative): Stage 1 - DHCP characteristics . 36g3B.1 Network topology . 36g3B.2 DHCP service . 36g3B.3 BOOTP protocol 37g3B.4 DHCP protocol . 37g3B.4.1 Address assignment 39g3B

16、.4.2 Message transmission and relay agents 39g3B.4.3 Security and authentication 39g3B.5 DHCP main attributes 39g3B.6 DHCP interception . 40g3B.6.1 Introduction 40g3B.6.2 DHCP packets 41g3B.6.3 State machine . 41g3B.6.3.1 Mapping DHCP packets to events 42g3B.6.3.2 Timers and administrative events .

17、42g3B.6.3.3 State information 42g3B.6.3.4 State machine diagram 43g3B.6.4 Mapping DHCP on the IRI structure 43g3Annex C (informative): IP IRI interception . 45g3C.1 Introduction 45g3C.2 Requirements 45g3C.3 Proposed implementation . 45g3Annex D (informative): TCP and UDP IRI interception 46g3D.1 Int

18、roduction 46g3D.2 Requirements 46g3D.3 HI2 requirements 46g3D.4 HI3 requirements 47g3D.5 General requirements . 47g3Annex E (informative): Bibliography . 48g3Annex F (informative): Change Request history . 49g3History 51g3ETSI ETSI TS 102 232-3 V3.4.1 (2016-09)5 Intellectual Property Rights IPRs ess

19、ential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potenti

20、ally Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No g

21、uarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Specification (TS) has been produced by ETSI Technical Committee Lawful In

22、terception (LI). The present document is part 3 of a multi-part deliverable. Full details of the entire series can be found in part 1 2. The ASN.1 module is also available as an electronic attachment to the original document from the ETSI site (see clause 8 for more details). Modal verbs terminology

23、 In the present document “shall“, “shall not“, “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI

24、deliverables except when used in direct citation. Introduction The intention of the present document has been to follow the advice given at ETSI meetings in all cases. The present document focuses on intercepting IP data in relation to the use of Internet Access Services (IAS) and is to be used in c

25、onjunction with ETSI TS 102 232-1 2. In the latter document the handing over of the intercepted data is described. ETSI ETSI TS 102 232-3 V3.4.1 (2016-09)6 1 Scope The present document contains a stage 1 description of the interception information in relation to the process of binding a “target iden

26、tity“ to an IP address when providing Internet access and a stage 2 description of when Intercept Related Information (IRI) and Content of Communication (CC) need to be sent, and what information it needs to contain. The study includes but is not restricted to IRI based on application of Dynamic Hos

27、t Configuration Protocol (DHCP) and Remote Authentication Dial-in User Service (RADIUS) technology for binding a “target identity“ to an IP address and CC for the intercepted IP packets. The definition of the Handover Interface 2 (HI2) and Handover Interface 3 (HI3) is outside the scope of the prese

28、nt document. For the handover interface is referred to ETSI TS 102 232-1 2. 2 References 2.1 Normative references References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For n

29、on-specific references, the latest version of the referenced document (including any amendments) applies. Referenced documents which are not found to be publicly available in the expected location might be found at http:/docbox.etsi.org/Reference. NOTE: While any hyperlinks included in this clause w

30、ere valid at the time of publication, ETSI cannot guarantee their long term validity. The following referenced documents are necessary for the application of the present document. 1 ETSI TS 101 671: “Lawful Interception (LI); Handover interface for the lawful interception of telecommunications traff

31、ic“. NOTE: Periodically TS 101 671 is published as ES 201 671. A reference to the latest version of the TS as above reflects the latest stable content from ETSI/TC LI. 2 ETSI TS 102 232-1: “Lawful Interception (LI); Handover Interface and Service-Specific Details (SSD) for IP delivery; Part 1: Hando

32、ver specification for IP delivery“. 3 IETF RFC 1122: “Requirements for Internet Hosts - Communication Layers“. 4 IETF RFC 1570: “PPP LCP Extensions“. 5 IETF RFC 1990: “The PPP Multilink Protocol (MP)“. 6 IETF RFC 2131: “Dynamic Host Configuration Protocol“. 7 IETF RFC 7542: “The Network Access Ident

33、ifier“. 8 IETF RFC 2865: “Remote Authentication Dial In User Service (RADIUS)“. 9 IETF RFC 2866: “RADIUS Accounting“. 10 IETF RFC 3046: “DHCP Relay Agent Information Option“. 11 IETF RFC 3118: “Authentication for DHCP Messages“. 12 IETF RFC 3396: “Encoding Long Options in the Dynamic Host Configurat

34、ion Protocol (DHCPv4)“. ETSI ETSI TS 102 232-3 V3.4.1 (2016-09)7 13 IEEE 802.11TM(ISO/IEC 8802-11): “IEEE Standard for Information technology - Telecommunications and information exchange between systems - Local and metropolitan area networks - Specific requirements - Part 11: Wireless LAN Medium Ac

35、cess Control (MAC) and Physical Layer (PHY) Specifications“. 14 Recommendation ITU-T X.680: “Information technology - Abstract Syntax Notation One (ASN.1): Specification of basic notation“. 15 IETF RFC 2132: “DHCP Options and BOOTP Vendor Extensions“. 16 ISO 3166-1: “Codes for the representation of

36、names of countries and their subdivisions - Part 1: Country codes“. 2.2 Informative references References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific referen

37、ces, the latest version of the referenced document (including any amendments) applies. NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee their long term validity. The following referenced documents are not necessary for the application of

38、 the present document but they assist the user with regard to a particular subject area. i.1 ETSI TR 102 205: “Methods for Testing and Specification (MTS); UML 2.0 action syntax feasibility study“. i.2 IEEE 802.1X-2001TM: “IEEE Standards for Local and Metropolitan Area Networks: Port-Based Network A

39、ccess Control“. i.3 draft-ietf-dhc-agentopt-radius-04.txt: “RADIUS Attributes Sub-option for the DHCP Relay Agent Information Option“. 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in ETSI TS 102 232-1 2 and the following ap

40、ply: access provider: Communications Service Provider (CSP), providing access to a network NOTE: In the context of the present document, the network access is defined as IP based network access to the Internet. access service: set of access methods provided to a user to access a service and/or a sup

41、plementary service NOTE: In the context of the present document, the service to be accessed is defined as the Internet. accounting: act of collecting information on resource usage for the purpose of trend analysis, auditing, billing, or cost allocation authentication: property by which the correct i

42、dentity of an entity or party is established with a required assurance authorization: property by which the access rights to resources are established and enforced ETSI ETSI TS 102 232-3 V3.4.1 (2016-09)8 3.2 Abbreviations For the purposes of the present document, the following abbreviations apply:

43、AAA Authentication, Authorization and Accounting ACK Acknowledge ADSL Asymmetric Digital Subscriber Line ANP Access Network Provider AP Access Provider ARP Address Resolution Protocol ASN.1 Abstract Syntax Notation One ATM Asynchronous Transfer Mode BOOTP BOOTstrap Protocol CC Content of Communicati

44、on CHAP Challenge Handshake Authentication Protocol CIN Communication Identity Number CMTS Cable Modem Termination System CPE Customer Premises Equipment CSP Communications Service Provider (covers all AP/NWO/SvP) DHCP Dynamic Host Configuration Protocol DNS Domain Name System DoS Denial of Service

45、DSL Digital Subscriber Line DSLAM Digital Subscriber Line Access Multiplexer FQDN Fully Qualified Domain Name FSM Functional State Machine GWR GateWay Router HI1 Handover Interface 1 (for Administrative Information) HI2 Handover Interface 2 (for Intercept Related Information) HI3 Handover Interface

46、3 (for Content of Communication) IANA Internet Assigned Numbers Authority IAP Internet Access Provider IAS Internet Access Service IETF International Engineering Task Force IF Interception Function IIF Internal Interception Function IP Internet Protocol IPCC Internet Protocol Call Content IPFIX Inte

47、rnet Protocol Flow Information eXport IPSEC Internet Protocol Security IRI Intercept Related Information ISDN Integrated Services Digital Network ISP Internet Service Provider LAN Local Area Network LCP Link Control Protocol LEA Law Enforcement AgencyLEMF Law Enforcement Monitoring Facility LI Lawfu

48、l Interception MAC Media Access Control MF Mediation Function NA Not Applicable NAS Network Access Server NIC Network Interface Controller NWO NetWork Operator OID Object IDentifierOSI Open Systems Interconnection PAP Password Authentication Protocol PC Personal Computer PDA Personal Digital Assista

49、nt PDU Packet Data Unit POP Point of Presence ETSI ETSI TS 102 232-3 V3.4.1 (2016-09)9 PPP Point-to-Point Protocol PPPoA Point-to-Point Protocol over ATM PPPoE Point-to-Point Protocol over Ethernet PSTN Public Switched Telephone Network QoS Quality of Service RADIUS Remote Authentication Dial-In User Service SLIP Serial Line Interface Protocol SvP Service Provider TCP Transmission Control Protocol TCP/IP Transmission Control Protocol/Internet Protocol TLV Type-Length Value UDP User Datagram Protocol WAN Wide Area Network WINS Win