LIDF - Legal Intercept Delivery Function - NetSapiens Platform Administrators Guide

LIDF - Legal Intercept Delivery Function

Introduction

The Legal Intercept Delivery Function (LIDF) is responsible for delivering intercepted communication expeditiously to the Law Enforcement Agency (LEA)'s Collection Function (CF). LIDF delivers reasonably available CII and CC based on the requirements of the lawful authorization.
The function of LIDF includes:

Collect and deliver Call Content (CC) and Call-Identifying Information (CII) for each intercept subject over facilities procured by the LEA.
Ensure that the CC and CII delivered from the LIDF is authorized for a particular LEA.
To ensure privacy through the protection (i.e., prevent unauthorized access to, or manipulation and disclosure of) intercept controls, intercepted CC, and CII, through methods that are consistent with the normal security policies of the NMS.
Ensure that delivery of surveillance information is only available for the time stated in the lawful authorization.
Deliver CC over UDP and CII over TCP.
Enabling and disabling the Delivery Function is through the NMS's Web-UI.

The LIDF delivers information over two distinct types of connections: Call Content Connections(CCCs), and Call Data Connections (CDCs). The CCCs are generally used to transport CC, such as voice communications. The CDCs are generally used to transport messages which report CII, such as the calling party identities and called party identities.
CII, CC, or both, associated with a particular subject, may need to be delivered to more than one LEA's CF simultaneously. This will occur when different LEAs are conducting independent investigations on the same subject. In these circumstances, the LIDF duplicates the CC, CII, or both, and delivers authorized information to each LEA. Intercept for one LEA are transparent to any other LEA.

Deviation from PKT-SP-ES-DCI-I01-060914

The protocol used by the NMS to encapsulate the CCC and CDC are modelled after the PacketCable Electronic Surveillance Protocol (PCESP). However, there are some differences:

"Channel ID, Origination IP and Origination Port" instead of "Origination IP Header and Origination UDP Header" in CCC packet.
CDC are encapsulated in XML/HTTP instead of ASN.1

Call Content Connection (CCC)

Call Content are delivered as a stream of UDP/IP datagrams, sent to the port number at the CF as provided during provisioning of the interception.

CCC ID (4 bytes)

Timestamp (8 bytes)

Channel ID (2 bytes)

Origination IP (4 bytes)

Origination Port (2 bytes)

Intercepted RTP
(arbitrary length)
.
.
.
.

Call Content Connection Identifier (CCC ID)

LIDF generates a CCC ID that is different from all other CCC ID in use between that LIFDF and a particular LEA. That is, two streams of content delivered to a single LEA must have different CCC-ID, but a single stream of content delivered to multiple LEAs may use a single CCC-Identifier, so long as no other stream being delivered to one of the LEAs is using the same CCC ID.
The CCC ID is provided by the LIDF in the CCOpen message. It is a 32-bit quantity, and is used to identify the intercept order to the LEA.
A conversation typically consists of two separate packet streams, each corresponding to a direction of the communication. Both are delivered to the LEA's CF with the same CCC-Identifier. The party sending the media is identified by the combination of Original IP and Original Port.

Timestamp

The CCC datagrams contain a timestamp that allows the LEA to identify the time at which the corresponding information was detected by the NMS. This timestamp MUST have an accuracy of at least 200 milliseconds and adhere to the NTP time format as defined in [RFC 1305]: a 64-bit unsigned fixed-point number, in seconds relative to 0000 on 1 January 1900. The integer (whole seconds) part is in the first 32 bits and the fractional part (fractional seconds) is in the last 32 bits. This timestamp MUST have an accuracy of at least 200 milliseconds.

Channel ID

A NetSapiens proprietary ID to enumerate the parties involved in a call.

Origination IP

The IP address that the Intercepted RTP origination from.

Origination Port

The UDP port that the Intercepted RTP origination from.

Intercepted RTP

Original RTP Header
(variable length, 12-72 bytes)

Original Payload
(arbitrary length)
.
.

Call Data Connection (CDC)

CII is formatted into discrete messages using a protocol modelled after the Packet Cable Electronic Surveillance Protocol (PCESP).
The CDC messages are encapsulated by XML, and delivered to the LEA's CF by HTTP POST over TCP/IP. The URL destination for the HTTP POST is provisioned independently for each destination LEA's CF in the LIDF. CDC messages from multiple LICs may be delivered to to a single LEA's CF using a single HTTP URL.

CDC Messages Structure

CDC Message Schema

<?xml version="1.0" encoding="UTF-8"?>
<schema targetNamespace="http://www.netsapiens.com/XMLSchema/LiCdc"
    elementFormDefault="qualified" xmlns="http://www.w3.org/2001/XMLSchema"
    xmlns:tns="http://www.netsapiens.com/XMLSchema/LiCdc">

    <complexType name="CdcMessage">
        <annotation>
        	<documentation>CDC Message base Type.</documentation>
        </annotation>
        <sequence>
    		<element name="AccessingElementId" type="string"
    			minOccurs="1" maxOccurs="1">
    		</element>
    	</sequence>
    	<attribute name="CaseId" type="string" use="required"></attribute>
    	<attribute name="EventTime" type="dateTime" use="required"></attribute>
    </complexType>

    <complexType name="CdcAnswer">
        <annotation>
        	<documentation>
        		A two-way connection has been established for a call under surveillance
        	</documentation>
        </annotation>
        <complexContent>
    		<extension base="tns:CdcMessage">
    			<sequence>
    				<element name="CallId" type="string" minOccurs="1" maxOccurs="1"></element>
    				<element name="AnsweringPartyId" type="string" minOccurs="1" maxOccurs="1"></element>
    			</sequence>
    		</extension>
    	</complexContent>
    </complexType>

    <complexType name="CdcCCClose">
        <annotation>
        	<documentation>
        		End of Call Content delivery for a call under interception.
        	</documentation>
        </annotation>
        <complexContent>
    		<extension base="tns:CdcMessage">
    			<sequence>
    				<element name="CccId" type="string" minOccurs="1" maxOccurs="1"></element>
    			</sequence>
    		</extension>
    	</complexContent>
    </complexType>

    <complexType name="CdcCCOpen">
        <annotation>
        	<documentation>
        		Beginning of Call Content delivery for a call under interception.
        	</documentation>
        </annotation>
        <complexContent>
    		<extension base="tns:CdcMessage">
    			<sequence>
    				<element name="CallId" type="string" minOccurs="1" maxOccurs="1"></element>
    				<element name="CccId" type="string" minOccurs="1" maxOccurs="1"></element>
    			</sequence>
    		</extension>
    	</complexContent>
    </complexType>


    <complexType name="CdcOrigination">
        <annotation>
        	<documentation>
        		The LIDF detects that the surveillance subject is attempting to originate a call.
        	</documentation>
        </annotation>
        <complexContent>
    		<extension base="tns:CdcMessage">
    			<sequence>
    				<element name="CallId" type="string" minOccurs="1" maxOccurs="1"></element>
    				<element name="CallingPartyId" type="string" minOccurs="1" maxOccurs="1"></element>
    				<element name="CalledPartyId" type="string" minOccurs="1" maxOccurs="1"></element>
    			</sequence>
    		</extension>
    	</complexContent>
    </complexType>

    <complexType name="CdcRedirection">
        <annotation>
        	<documentation>
        		A call under surveillance is redirected (e.g. Moved, Blind or Supervised Transfer).
        	</documentation>
        </annotation>
        <complexContent>
    		<extension base="tns:CdcMessage">
    			<sequence>
    				<element name="CallId" type="string" minOccurs="1" maxOccurs="1"></element>
    				<element name="RedirectedFromPartyId" type="string" minOccurs="1" maxOccurs="1"></element>
    				<element name="RedirectedToPartyId" type="string" minOccurs="1" maxOccurs="1"></element>
    			</sequence>
    		</extension>
    	</complexContent>
    </complexType>


    <complexType name="CdcRelease">
        <annotation>
        	<documentation>
        		The resources for a call under surveillance have been released.
        	</documentation>
        </annotation>
        <complexContent>
    		<extension base="tns:CdcMessage">
    			<sequence>
    				<element name="CallId" type="string" minOccurs="1" maxOccurs="1"></element>
    				<element name="ReleaseReason" type="string" minOccurs="1" maxOccurs="1"></element>
    			</sequence>
    		</extension>
    	</complexContent>
    </complexType>

    <complexType name="CdcTerminationAttempt">
        <annotation>
        	<documentation>
        		The LIDF detects a call attempt to a surveillance subject.
        	</documentation>
        </annotation>
        <complexContent>
    		<extension base="tns:CdcMessage">
    			<sequence>
    				<element name="CallId" type="string" minOccurs="1" maxOccurs="1"></element>
    				<element name="CallingPartyId" type="string" minOccurs="1" maxOccurs="1"></element>
    				<element name="CalledPartyId" type="string" minOccurs="1" maxOccurs="1"></element>
    			</sequence>
    		</extension>
    	</complexContent>
    </complexType>

    <complexType name="MessageChoice">
        <choice minOccurs="1" maxOccurs="1">
		<element name="Answer" type="tns:CdcAnswer" maxOccurs="1" minOccurs="0" />
		<element name="CCClose" type="tns:CdcCCClose" maxOccurs="1" minOccurs="0" />
		<element name="CCOpen" type="tns:CdcCCOpen" maxOccurs="1" minOccurs="0" />
		<element name="Origination" type="tns:CdcOrigination" maxOccurs="1" minOccurs="0"></element>
		<element name="Redirection" type="tns:CdcRedirection" maxOccurs="1" minOccurs="0" />
		<element name="Release" type="tns:CdcRelease" maxOccurs="1" minOccurs="0" />
		<element name="TerminationAttempt" type="tns:CdcTerminationAttempt" maxOccurs="1" minOccurs="0" />
	</choice>
    </complexType>

    <element name="Cdc" type="tns:MessageChoice">
    </element>
</schema>

Accessing Element ID

CDC messages contain an Accessing Element ID to identify the intercepted device. This will be populated with the AOR of the NMS server instance.

Timestamp

The CDC messages contains a timestamp that identifies the time the corresponding event was detected by the NMS. This timestamp MUST have an accuracy of at least 200 milliseconds and adhere to the NTP time format as defined in [RFC 1305]: a 64-bit unsigned fixed-point number, in seconds relative to 0000 on 1 January 1900. The integer (whole seconds) part is in the first 32 bits and the fractional part (fractional seconds) is in the last 32 bits. This timestamp MUST have an accuracy of at least 200 milliseconds.

CDC Message Types

See CDC Message Schema for the precise definiteion of the CDC Message Schema. The followings is a breif description.

Answer

A two-way connection has been established for a call under surveillance.

Field	Descriptions
CaseId	ID for Legal Intercept Case
AccessingElementId	ID for the LIDF
EventTime	Date and Time in mmmm-yy-dd hh:mm:ss
CallId	Call ID
AnsweringPartyId	SIP AOR of Answering Party

CCClose

End of Call Content delivery for a call under interception.

Field	Descriptions
CaseId	ID for Legal Intercept Case
AccessingElementId	ID for the LIDF
EventTime	Date and Time in mmmm-yy-dd hh:mm:ss
CccId	ID for CCC

CCOpen

Beginning of Call Content delivery for a call under interception.

Field	Descriptions
CaseId	ID for Legal Intercept Case
AccessingElementId	ID for the LIDF
EventTime	Date and Time in mmmm-yy-dd hh:mm:ss
CallId	Call ID
CccId	ID for CCC

Origination

The LIDF detects that the surveillance subject is attempting to originate a call.

Field	Descriptions
CaseId	ID for Legal Intercept Case
AccessingElementId	ID for the LIDF
EventTime	Date and Time in mmmm-yy-dd hh:mm:ss
CallId	Call ID
CallingPartyId	SIP AOR of Calling Party
CalledPartyId	SIP AOR of Called Party

Redirection

A call under surveillance is redirected (e.g. Moved, Blind or Supervised Transfer).

Field	Descriptions
CaseId	ID for Legal Intercept Case
AccessingElementId	ID for the LIDF
EventTime	Date and Time in mmmm-yy-dd hh:mm:ss
CallId	Call ID
RedirectedFromPartyId	SIP AOR of Redirected Rrom Party
RedirectedToPartyId	SIP AOR of Redirected To Party

Release

The resources for a call under surveillance have been released.

Field	Descriptions
CaseId	ID for Legal Intercept Case
AccessingElementId	ID for the LIDF
EventTime	Date and Time in mmmm-yy-dd hh:mm:ss
CallId	Call ID
ReleaseReason	Reason for the Release

TerminationAttempt

The LIDF detects a call attempt to a surveillance subject.

Field	Descriptions
CaseId	ID for Legal Intercept Case
AccessingElementId	ID for the LIDF
EventTime	Date and Time in mmmm-yy-dd hh:mm:ss
CallId	Call ID
CallingPartyId	SIP AOR of Calling Party
CalledPartyId	SIP AOR of Called Party

CDC Message Sequence Examples

Basic Origination

DSLI <sip:1006@vbox.netsapiens.com> calling non DSLI <sip:1003@vbox.netsapiens.com>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<Origination CaseId=""Case0006"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>e5fc4ca4579dbb9b@192.168.88.177</CallId>
		<CalledPartyId>sip:1003@vbox.netsapiens.com</CalledPartyId>
		<CallingPartyId>sip:1006@vbox.netsapiens.com</CallingPartyId>
		<EventTime>2007-05-21 16:46:26</EventTime>
	</Origination>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<CCOpen CaseId=""Case0006"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>e5fc4ca4579dbb9b@192.168.88.177</CallId>
		<CccId>1234</CccId>
		<EventTime>2007-05-21 16:46:26</EventTime>
	</CCOpen>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<Answer CaseId=""Case0006"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<AnsweringPartyId>sip:1003@vbox.netsapiens.com</AnsweringPartyId>
		<CallId>e5fc4ca4579dbb9b@192.168.88.177</CallId>
		<EventTime>2007-05-21 16:46:27</EventTime>
	</Answer>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<Release CaseId=""Case0006"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>e5fc4ca4579dbb9b@192.168.88.177</CallId>
		<EventTime>2007-05-21 16:46:31</EventTime>
		<ReleaseReason>Term: Bye</ReleaseReason>
	</Release>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<CCClose CaseId=""Case0006"">
		<AccessingElementId>sip:1006@vbox.netsapiens.com</AccessingElementId>
		<CccId>1234</CccId>
		<EventTime>2007-05-21 16:46:31</EventTime>
	</CCClose>
</Cdc>

Basic Termination

Non-DSLI <sip:10010@vbox.netsapiens.com> calling DSLI <sip:1002@vbox.netsapiens.com>

<?xml version="1.0" encoding="UTF-8"?>
<Cdc xmlns="http://www.netsapiens.com/XMLSchema/LiCdc">
	<TerminationAttempt CaseId="Case00001">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521062823000011@netsapiens.com</CallId>
		<CalledPartyId>sip:1002@vbox.netsapiens.com</CalledPartyId>
		<CallingPartyId>sip:1010@vbox.netsapiens.com</CallingPartyId>
		<EventTime>2007-05-21 06:28:23</EventTime>
	</TerminationAttempt>
</Cdc>

<?xml version="1.0" encoding="UTF-8"?>
<Cdc xmlns="http://www.netsapiens.com/XMLSchema/LiCdc">
	<CCOpen CaseId="Case00001">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521062823000011@netsapiens.com</CallId>
		<CccId>1236</CccId>
		<EventTime>2007-05-21 06:28:23</EventTime>
	</CCOpen>
</Cdc>

<?xml version="1.0" encoding="UTF-8"?>
<Cdc xmlns="http://www.netsapiens.com/XMLSchema/LiCdc">
	<Answer CaseId="Case00001">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<AnsweringPartyId>sip:1002@vbox.netsapiens.com</AnsweringPartyId>
		<CallId>20070521062823000011@netsapiens.com</CallId>
		<EventTime>2007-05-21 06:28:25</EventTime>
	</Answer>
</Cdc>

<?xml version="1.0" encoding="UTF-8"?>
<Cdc xmlns="http://www.netsapiens.com/XMLSchema/LiCdc">
	<Release CaseId="Case00001">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521062823000011@netsapiens.com</CallId>
		<EventTime>2007-05-21 06:28:27</EventTime>
		<ReleaseReason>Term: Bye</ReleaseReason>
	</Release>
</Cdc>

<?xml version="1.0" encoding="UTF-8"?>
<Cdc xmlns="http://www.netsapiens.com/XMLSchema/LiCdc">
	<CCClose CaseId="Case00001">
		<AccessingElementId>sip:1002@vbox.netsapiens.com</AccessingElementId>
		<CccId>1236</CccId>
		<EventTime>2007-05-21 06:28:27</EventTime>
	</CCClose>
</Cdc>

Basic Termination with CDC Only

Non-DSLI <sip:10010@vbox.netsapiens.com> calling DSLI <sip:1002@vbox.netsapiens.com>. CDC Intercept enabled, and CCC Intercept disabled.

<?xml version="1.0" encoding="UTF-8"?>
<Cdc xmlns="http://www.netsapiens.com/XMLSchema/LiCdc">
	<TerminationAttempt CaseId="Case00001">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521062823000011@netsapiens.com</CallId>
		<CalledPartyId>sip:1002@vbox.netsapiens.com</CalledPartyId>
		<CallingPartyId>sip:1010@vbox.netsapiens.com</CallingPartyId>
		<EventTime>2007-05-21 06:28:23</EventTime>
	</TerminationAttempt>
</Cdc>

<?xml version="1.0" encoding="UTF-8"?>
<Cdc xmlns="http://www.netsapiens.com/XMLSchema/LiCdc">
	<Answer CaseId="Case00001">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<AnsweringPartyId>sip:1002@vbox.netsapiens.com</AnsweringPartyId>
		<CallId>20070521062823000011@netsapiens.com</CallId>
		<EventTime>2007-05-21 06:28:25</EventTime>
	</Answer>
</Cdc>

<?xml version="1.0" encoding="UTF-8"?>
<Cdc xmlns="http://www.netsapiens.com/XMLSchema/LiCdc">
	<Release CaseId="Case00001">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521062823000011@netsapiens.com</CallId>
		<EventTime>2007-05-21 06:28:27</EventTime>
		<ReleaseReason>Term: Bye</ReleaseReason>
	</Release>
</Cdc>

Basic Termination with CCC Only

Non-DSLI <sip:10010@vbox.netsapiens.com> calling DSLI <sip:1002@vbox.netsapiens.com>. CDC Intercept disabled, and CCC Intercept enabled.

<?xml version="1.0" encoding="UTF-8"?>
<Cdc xmlns="http://www.netsapiens.com/XMLSchema/LiCdc">
	<CCOpen CaseId="Case00001">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521062823000011@netsapiens.com</CallId>
		<CccId>1236</CccId>
		<EventTime>2007-05-21 06:28:23</EventTime>
	</CCOpen>
</Cdc>

<?xml version="1.0" encoding="UTF-8"?>
<Cdc xmlns="http://www.netsapiens.com/XMLSchema/LiCdc">
	<CCClose CaseId="Case00001">
		<AccessingElementId>sip:1002@vbox.netsapiens.com</AccessingElementId>
		<CccId>1236</CccId>
		<EventTime>2007-05-21 06:28:27</EventTime>
	</CCClose>
</Cdc>

Moved

Non-DSLI <sip:10003@vbox.netsapiens.com> calling DSLI <sip:1225@vbox.netsapiens.com> which signalled MoveTo <sip:1006@vbox.netsapiens.com>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<TerminationAttempt CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521170832000019@netsapiens.com</CallId>
		<CalledPartyId>sip:1225@vbox.netsapiens.com</CalledPartyId>
		<CallingPartyId>sip:1003@vbox.netsapiens.com</CallingPartyId>
		<EventTime>2007-05-21 17:08:32</EventTime>
	</TerminationAttempt>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<CCOpen CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521170832000019@netsapiens.com</CallId>
		<CccId>1238</CccId>
		<EventTime>2007-05-21 17:08:32</EventTime>
	</CCOpen>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<Redirection CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521170832000019@netsapiens.com</CallId>
		<EventTime>2007-05-21 17:08:32</EventTime>
		<RedirectedFromPartyId>sip:1225@vbox.netsapiens.com</RedirectedFromPartyId>
		<RedirectedToPartyId><sip:1006@vbox.netsapiens.com:5060></RedirectedToPartyId>
	</Redirection>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<Release CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521170832000019@netsapiens.com</CallId>
		<EventTime>2007-05-21 17:08:32</EventTime>
		<ReleaseReason>Moved</ReleaseReason>
	</Release>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
    <CCClose CaseId=""Case123456789""><AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
            <CccId>1238</CccId>
	    <EventTime>2007-05-21 17:08:32</EventTime>
    </CCClose>
</Cdc>

Blind Xfer

Non-DSLI <sip:1003@vbox.netsapiens.com> calling DSLI <sip:1225@vbox.netsapiens.com> which Blind-Xfer to <sip:1006@vbox.netsapiens.com>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<TerminationAttempt CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521171508000025@netsapiens.com</CallId>
		<CalledPartyId>sip:1225@vbox.netsapiens.com</CalledPartyId>
		<CallingPartyId>sip:1003@vbox.netsapiens.com</CallingPartyId>
		<EventTime>2007-05-21 17:15:08</EventTime>
	</TerminationAttempt>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<CCOpen CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521171508000025@netsapiens.com</CallId>
		<CccId>123A</CccId>
		<EventTime>2007-05-21 17:15:08</EventTime>
	</CCOpen>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<Answer CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<AnsweringPartyId>sip:1225@vbox.netsapiens.com</AnsweringPartyId>
		<CallId>20070521171508000025@netsapiens.com</CallId>
		<EventTime>2007-05-21 17:15:10</EventTime>
	</Answer>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<Redirection CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521171508000025@netsapiens.com</CallId>
		<EventTime>2007-05-21 17:15:16</EventTime>
		<RedirectedFromPartyId>sip:1225@vbox.netsapiens.com</RedirectedFromPartyId>
		<RedirectedToPartyId>sip:1006@vbox.netsapiens.com</RedirectedToPartyId>
	</Redirection>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<Release CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521171508000025@netsapiens.com</CallId>
		<EventTime>2007-05-21 17:15:16</EventTime>
		<ReleaseReason>Transferred</ReleaseReason>
	</Release>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<CCClose CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CccId>123A</CccId>
		<EventTime>2007-05-21 17:15:16</EventTime>
	</CCClose>
</Cdc>

Supervised Xfer

Non-DSLI <sip:1003@vbox.netsapiens.com> calling DSLI <sip:1225@vbox.netsapiens.com> which make 2nd call to <sip:1006@vbox.netsapiens.com>, and then request Supervised Xfer to connect <sip:1003@vbox.netsapiens.com> with <sip:1006@vbox.netsapiens.com>.

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<TerminationAttempt CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521171952000030@netsapiens.com</CallId>
		<CalledPartyId>sip:1225@vbox.netsapiens.com</CalledPartyId>
		<CallingPartyId>sip:1003@vbox.netsapiens.com</CallingPartyId>
		<EventTime>2007-05-21 17:19:52</EventTime>
	</TerminationAttempt>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<CCOpen CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521171952000030@netsapiens.com</CallId>
		<CccId>123C</CccId>
		<EventTime>2007-05-21 17:19:52</EventTime>
	</CCOpen>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<Answer CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<AnsweringPartyId>sip:1225@vbox.netsapiens.com</AnsweringPartyId>
		<CallId>20070521171952000030@netsapiens.com</CallId>
		<EventTime>2007-05-21 17:19:54</EventTime>
	</Answer>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<Origination CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>76858d54-5f921f6e-dc00b725@192.168.88.111</CallId>
		<CalledPartyId>sip:1006@vbox.netsapiens.com</CalledPartyId>
		<CallingPartyId>sip:1225@vbox.netsapiens.com</CallingPartyId>
		<EventTime>2007-05-21 17:20:02</EventTime>
	</Origination>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<CCOpen CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>76858d54-5f921f6e-dc00b725@192.168.88.111</CallId>
		<CccId>123D</CccId>
		<EventTime>2007-05-21 17:20:02</EventTime>
	</CCOpen>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<Answer CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<AnsweringPartyId>sip:1006@vbox.netsapiens.com</AnsweringPartyId>
		<CallId>76858d54-5f921f6e-dc00b725@192.168.88.111</CallId>
		<EventTime>2007-05-21 17:20:02</EventTime>
	</Answer>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<Redirection CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521171952000030@netsapiens.com</CallId>
		<EventTime>2007-05-21 17:20:07</EventTime>
		<RedirectedFromPartyId>sip:1225@vbox.netsapiens.com</RedirectedFromPartyId>
		<RedirectedToPartyId>sip:1006@vbox.netsapiens.com</RedirectedToPartyId>
	</Redirection>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<Release CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>20070521171952000030@netsapiens.com</CallId>
		<EventTime>2007-05-21 17:20:07</EventTime>
		<ReleaseReason>Transferred</ReleaseReason>
	</Release>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<Release CaseId=""Case123456789"">
		<AccessingElementId>sip:NewInstall@netsapiens.com</AccessingElementId>
		<CallId>76858d54-5f921f6e-dc00b725@192.168.88.111</CallId>
		<EventTime>2007-05-21 17:20:07</EventTime>
		<ReleaseReason>Transferred</ReleaseReason>
	</Release>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<CCClose CaseId=""Case123456789"">
		<AccessingElementId>sip:1225@vbox.netsapiens.com</AccessingElementId>
		<CccId>123D</CccId>
		<EventTime>2007-05-21 17:20:07</EventTime>
	</CCClose>
</Cdc>

<?xml version=""1.0"" encoding=""UTF-8""?>
<Cdc xmlns=""http://www.netsapiens.com/XMLSchema/LiCdc"">
	<CCClose CaseId=""Case123456789"">
		<AccessingElementId>sip:1225@vbox.netsapiens.com</AccessingElementId>
		<CccId>123C</CccId>
		<EventTime>2007-05-21 17:20:07</EventTime>
	</CCClose>
</Cdc>

Provisioning

Provisioning of the LIDF is through TAC level login at the NMS's Web-UI.

Law Enforcement Agency (LEA)

The Law Enforcement Agency host its own CF, and provide the connectivity informatiom, i.e. IP address, port and URL, to the operator of the NMS.

Field	Type	Descriptions
LEA ID	varchar(128)	An unique ID for each LEA
Name	varchar(128)	Name of the LEA
Address	varchar(256)	Address of the LEA
Contact Person	varchar(128)	Name of the contact person at the LEA
Contact Phone Number	varchar(64)	Phone Number of the contact person at the LEA
Contact E-Mail	varchar(128)	E-Mail address of the contact person at the LEA
CCC IP Address	varchar(32)	IP Address to send the CCC packet
CCC Port	integer(11)	UDP port to send the CCC packet
CDC URL	varchar(127)	URL destinatio to send the CDC packet

Legal Intercept Case (LIC)

Legal Intercept Case (LIC) identifies each case of Legal Intercept.

Field	Type	Descriptions
LEA ID	varchar(128)	LEA ID for intercept requestor
Device AOR	varchar(128)	Unique System AOR of the device subjected to this LIC
Case ID	varchar(64)	An ID to identify the intercept case to the LEA
Intercept CCC	varchar(8)	Enable or Disable CCC Intercept
Intercept CDC	varchar(8)	Enable or Disable CDC Intercept
Valid From	datetime	Date and Time to start intercept
Valid To	datetime	Date and Time to stop intercept

Abbreviations and Acronyms

CALEA Communications Assistance for Law Enforcement Act CC Call Content CCC Call Content Connection CDC Call Data Connection CF Collection Function CII Call-Identifying Information DF Delivery Function DSLI Device Subjected to Legal Intercept LEA Law Enforcement Agency LI Legal Intercept LIC Legal Intercept Case PCESP PacketCable Electronic Surveillance Protocol PSTN Public Switched Telephone Network

References

PKT-SP-ES-DCI-I01-060914

PacketCable Electronic Surveillance Delivery Function to Colleciton Function Interface Specification

Comments

	Search this site