ETSI TS 102 232-3-2017 Lawful Interception (LI) Handover Interface and Service-Specific Details (SSD) for IP delivery Part 3 Service-specific details for internet access services (.pdf

1、 ETSI TS 102 232-3 V3.5.1 (2017-03) Lawful Interception (LI); Handover Interface and Service-Specific Details (SSD) for IP delivery; Part 3: Service-specific details for internet access services floppy3TECHNICAL SPECIFICATION ETSI ETSI TS 102 232-3 V3.5.1 (2017-03)2 Reference RTS/LI-00142-3 Keywords

2、 access, internet, IP, lawful interception, security, service ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Im

3、portant notice The present document can be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior writt

4、en authorization of ETSI. In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document

5、 should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at https:/portal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of th

6、e following services: https:/portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of th

7、e PDF version shall not be modified without the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2017. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of E

8、TSI registered for the benefit of its Members. 3GPPTM and LTE are Trade Marks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered and owned by the GSM Association. ETSI ETSI TS 102 232-3 V3.5.1 (2017-03)3 Contents

9、 Intellectual Property Rights 6g3Foreword . 6g3Modal verbs terminology 6g3Introduction 6g31 Scope 7g32 References 7g32.1 Normative references . 7g32.2 Informative references 8g33 Definitions and abbreviations . 8g33.1 Definitions 8g33.2 Abbreviations . 9g34 General . 10g34.1 Internet Access Service

10、(IAS) 10g34.2 Target identity and IP address 10g34.3 Lawful Interception requirements 11g34.3.0 Introduction. 11g34.3.1 Target identity . 11g34.3.2 Result of interception 11g34.3.3 Intercept related information messages. 12g34.3.4 Time constraints 12g34.3.5 Preventing over and under collection of in

11、tercept data . 12g35 System model . 13g35.1 Reference network topologies 13g35.1.0 Introduction. 13g35.1.1 Dial-up access . 13g35.1.2 xDSL access 14g35.1.3 Cable modem access . 15g35.1.4 IEEE 802.11 Access (with Wireless LAN profile) . 16g35.2 Reference scenarios 16g35.2.1 Logon 16g35.2.2 Multi logo

12、n . 16g35.2.3 Multilink logon . 17g35.2.4 IP transport 17g35.2.5 Logoff . 17g35.2.6 Connection loss . 17g36 Intercept Related Information (IRI) . 18g36.1 IRI events . 18g36.2 HI2 attributes 19g36.2.0 List of HI2 attributes . 19g36.2.1 Use of targetIPAddress, additionalIPAddress and otherTargetIdenti

13、fiers fields 20g36.2.2 Use of location field 21g37 Content of Communication (CC) . 21g37.1 CC events . 21g37.2 HI3 attributes 21g38 ASN.1 for IRI and CC 21g3Annex A (informative): Stage 1 - RADIUS characteristics . 27g3A.1 Network topology . 27g3A.1.0 RADIUS deployment options. 27g3A.1.1 RADIUS serv

14、er 27g3A.1.2 RADIUS proxy . 28g3ETSI ETSI TS 102 232-3 V3.5.1 (2017-03)4 A.2 RADIUS service . 29g3A.2.1 Authentication service 29g3A.2.2 Accounting service . 29g3A.3 RADIUS protocol . 30g3A.3.1 Authentication protocol 30g3A.3.2 Accounting protocol . 30g3A.4 RADIUS main attributes 31g3A.5 RADIUS inte

15、rception . 32g3A.5.0 Introduction 32g3A.5.1 Collecting RADIUS packets. 32g3A.5.2 Processing RADIUS packets 32g3A.5.2.1 Mapping events to RADIUS packets 32g3A.5.2.2 Functional model 33g3A.5.2.3 RADIUS spoofing 36g3A.5.3 Mapping RADIUS on the IRI structure 36g3Annex B (informative): Stage 1 - DHCP cha

16、racteristics . 38g3B.1 Network topology . 38g3B.2 DHCP service . 38g3B.3 BOOTP protocol 39g3B.4 DHCP protocol . 39g3B.4.0 Overview 39g3B.4.1 Address assignment 41g3B.4.2 Message transmission and relay agents 41g3B.4.3 Security and authentication 41g3B.5 DHCP main attributes 41g3B.6 DHCP interception

17、 . 42g3B.6.1 Introduction 42g3B.6.2 DHCP packets 43g3B.6.3 State machine . 43g3B.6.3.0 Overview 43g3B.6.3.1 Mapping DHCP packets to events 44g3B.6.3.2 Timers and administrative events . 44g3B.6.3.3 State information 44g3B.6.3.4 State machine diagram 45g3B.6.4 Mapping DHCP on the IRI structure 45g3An

18、nex C (informative): IP IRI interception . 47g3C.1 Introduction 47g3C.2 Requirements 47g3C.3 Proposed implementation . 47g3Annex D (informative): TCP and UDP IRI interception 48g3D.1 Introduction 48g3D.2 Requirements 48g3D.3 HI2 requirements 48g3D.4 HI3 requirements 49g3D.5 General requirements . 49

19、g3Annex E (informative): Bibliography . 50g3Annex F (informative): Change Request history . 51g3ETSI ETSI TS 102 232-3 V3.5.1 (2017-03)5 History 54g3ETSI ETSI TS 102 232-3 V3.5.1 (2017-03)6 Intellectual Property Rights IPRs essential or potentially essential to the present document may have been dec

20、lared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, whic

21、h is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in

22、 ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Specification (TS) has been produced by ETSI Technical Committee Lawful Interception (LI). The present document is part 3 of a multi-part deliverab

23、le. Full details of the entire series can be found in part 1 2. The ASN.1 module is also available as an electronic attachment to the original document from the ETSI site (see clause 8 for more details). Modal verbs terminology In the present document “shall“, “shall not“, “should“, “should not“, “m

24、ay“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. Introduction The intent

25、ion of the present document has been to follow the advice given at ETSI meetings in all cases. The present document focuses on intercepting IP data in relation to the use of Internet Access Services (IAS) and is to be used in conjunction with ETSI TS 102 232-1 2. In the latter document the handing o

26、ver of the intercepted data is described. ETSI ETSI TS 102 232-3 V3.5.1 (2017-03)7 1 Scope The present document contains a stage 1 description of the interception information in relation to the process of binding a “target identity“ to an IP address when providing Internet access and a stage 2 descr

27、iption of when Intercept Related Information (IRI) and Content of Communication (CC) need to be sent, and what information it needs to contain. The study includes but is not restricted to IRI based on application of Dynamic Host Configuration Protocol (DHCP) and Remote Authentication Dial-in User Se

28、rvice (RADIUS) technology for binding a “target identity“ to an IP address and CC for the intercepted IP packets. The definition of the Handover Interface 2 (HI2) and Handover Interface 3 (HI3) is outside the scope of the present document. For the handover interface is referred to ETSI TS 102 232-1

29、2. 2 References 2.1 Normative references References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the referenced document (in

30、cluding any amendments) applies. Referenced documents which are not found to be publicly available in the expected location might be found at https:/docbox.etsi.org/Reference. NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee their long t

31、erm validity. The following referenced documents are necessary for the application of the present document. 1 ETSI TS 101 671: “Lawful Interception (LI); Handover interface for the lawful interception of telecommunications traffic“. NOTE: Periodically TS 101 671 is published as ES 201 671. A referen

32、ce to the latest version of the TS as above reflects the latest stable content from ETSI/TC LI. 2 ETSI TS 102 232-1: “Lawful Interception (LI); Handover Interface and Service-Specific Details (SSD) for IP delivery; Part 1: Handover specification for IP delivery“. 3 IETF RFC 1122: “Requirements for I

33、nternet Hosts - Communication Layers“. 4 IETF RFC 1570: “PPP LCP Extensions“. 5 IETF RFC 1990: “The PPP Multilink Protocol (MP)“. 6 IETF RFC 2131: “Dynamic Host Configuration Protocol“. 7 IETF RFC 7542: “The Network Access Identifier“. 8 IETF RFC 2865: “Remote Authentication Dial In User Service (RA

34、DIUS)“. 9 IETF RFC 2866: “RADIUS Accounting“. 10 IETF RFC 3046: “DHCP Relay Agent Information Option“. 11 IETF RFC 3118: “Authentication for DHCP Messages“. 12 IETF RFC 3396: “Encoding Long Options in the Dynamic Host Configuration Protocol (DHCPv4)“. ETSI ETSI TS 102 232-3 V3.5.1 (2017-03)8 13 IEEE

35、 802.11TM(ISO/IEC 8802-11): “IEEE Standard for Information technology - Telecommunications and information exchange between systems - Local and metropolitan area networks - Specific requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications“. 14 Recommen

36、dation ITU-T X.680: “Information technology - Abstract Syntax Notation One (ASN.1): Specification of basic notation“. 15 IETF RFC 2132: “DHCP Options and BOOTP Vendor Extensions“. 16 ISO 3166-1: “Codes for the representation of names of countries and their subdivisions - Part 1: Country codes“. 2.2

37、Informative references References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the referenced document (including any amendm

38、ents) applies. NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee their long term validity. The following referenced documents are not necessary for the application of the present document but they assist the user with regard to a particul

39、ar subject area. i.1 ETSI TR 102 205: “Methods for Testing and Specification (MTS); UML 2.0 action syntax feasibility study“. i.2 IEEE 802.1X-2001TM: “IEEE Standards for Local and Metropolitan Area Networks: Port-Based Network Access Control“. i.3 draft-ietf-dhc-agentopt-radius-04.txt: “RADIUS Attri

40、butes Sub-option for the DHCP Relay Agent Information Option“. i.4 IANA bootp parameters. NOTE: Available at http:/www.iana.org/assignments/bootp-dhcp-parameters. 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in ETSI TS 102

41、232-1 2 and the following apply: access provider: Communications Service Provider (CSP), providing access to a network NOTE: In the context of the present document, the network access is defined as IP based network access to the Internet. access service: set of access methods provided to a user to a

42、ccess a service and/or a supplementary service NOTE: In the context of the present document, the service to be accessed is defined as the Internet. accounting: act of collecting information on resource usage for the purpose of trend analysis, auditing, billing, or cost allocation authentication: pro

43、perty by which the correct identity of an entity or party is established with a required assurance authorization: property by which the access rights to resources are established and enforced ETSI ETSI TS 102 232-3 V3.5.1 (2017-03)9 3.2 Abbreviations For the purposes of the present document, the fol

44、lowing abbreviations apply: AAA Authentication, Authorization and Accounting ACK Acknowledge ADSL Asymmetric Digital Subscriber Line ANP Access Network Provider AP Access Provider ARP Address Resolution Protocol ASN.1 Abstract Syntax Notation One ATM Asynchronous Transfer Mode BOOTP BOOTstrap Protoc

45、ol CC Content of Communication CHAP Challenge Handshake Authentication Protocol CIN Communication Identity Number CMTS Cable Modem Termination System CPE Customer Premises Equipment CSP Communications Service Provider (covers all AP/NWO/SvP) DHCP Dynamic Host Configuration Protocol DNS Domain Name S

46、ystem DoS Denial of Service DSL Digital Subscriber Line DSLAM Digital Subscriber Line Access Multiplexer FQDN Fully Qualified Domain Name FSM Functional State Machine GWR GateWay Router HI1 Handover Interface 1 (for Administrative Information) HI2 Handover Interface 2 (for Intercept Related Informat

47、ion) HI3 Handover Interface 3 (for Content of Communication) IANA Internet Assigned Numbers Authority IAP Internet Access Provider IAS Internet Access Service IETF International Engineering Task Force IF Interception Function IIF Internal Interception Function IP Internet Protocol IPCC Internet Prot

48、ocol Call Content IPFIX Internet Protocol Flow Information eXport IPSEC Internet Protocol Security IRI Intercept Related Information ISDN Integrated Services Digital Network ISP Internet Service Provider LAN Local Area Network LCP Link Control Protocol LEA Law Enforcement AgencyLEMF Law Enforcement

49、Monitoring Facility LI Lawful Interception MAC Media Access Control MF Mediation Function NA Not Applicable NAS Network Access Server NIC Network Interface Controller NWO NetWork Operator OID Object IDentifierOSI Open Systems Interconnection PAP Password Authentication Protocol PC Personal Computer PDA Personal Digital Assistant PDU Packet Data Unit POP Point of Presence ETSI ETSI TS 102 232-3 V3.5.1 (2017-03)10 PPP Point-to-Point Protocol PPPoA Point-to-Point Protocol over ATM PPPoE Point-to-Point Protocol over Ethernet PSTN