Lawful interception in a mobile data network with data offload at the basestation
Lawful interception (LI) is supported on a flat mobile data network with breakout services at the basestation. A first service mechanism at the basestation is prevented from breaking out services for subscribers that are part of LI. A second service mechanism in the core network maintains a subscriber list of subscribers that are subject to LI. In response to a PDP context activation by a subscriber on the list, the second service mechanism does not supply PDP context information to the first service mechanism for data breakout thus preventing breakout for the subscriber subject to lawful interception.
1. A mobile data network comprising:
a plurality of basestations, each basestation communicating with a corresponding antenna that transmits and receives radio signals to and from user equipment, wherein the plurality of basestations are part of a radio access network that communicates with a core network in the mobile data network;
a first service mechanism in the radio access network that defines an existing first data path in the radio access network for non-broken out data, defines a second data path for broken out data, identifies first data received from a corresponding basestation as data to be broken out, sends the first data on the second data path, and forwards other data that is not broken out on the first data path, wherein the first service mechanism performs a first service for network messages in the radio access network based on the first data;
a second service mechanism in the core network that monitors network messages in the core network and determines what traffic meets breakout authorization criteria and sends a message to the first service mechanism with subscriber information for the first mechanism to perform breakout sessions on the second data path;
an overlay network that allows the first service mechanism to communicate with the second service mechanism to perform the first service;
wherein the first service mechanism makes a breakout decision based on internet protocol (IP) data flows matching breakout conditions to perform the first service on the second data path for subscriber sessions with subscriber information from the second service mechanism; and
a lawful interception (LI) mechanism that withholds subscriber information from the first service mechanism for subscribers subject to lawful interception so the first service mechanism will not make a breakout decision for subscribers subject to lawful interception.
2. The mobile data network of claim 1 wherein the LI mechanism monitors a subscriber identification (ID) at an activation of a packet data protocol (PDP) context and compares the subscriber ID with a LI subscriber list that contains subscribers subject to LI, and does not authorize session breakout for the subscriber ID on the LI subscriber list by the withholding of subscriber information from the first service mechanism.
3. The mobile data network of claim 2 wherein the LI mechanism monitors LI activation messages from an administrative function (ADMF) of a lawful interception system and adds subscriber IDs to the LI subscriber list.
4. The mobile data network of claim 2 wherein the LI mechanism monitors LI de-activation messages from an administrative function (ADMF) of a lawful interception system and removes subscriber IDs in the de-activation message from the LI subscriber list.
5. The mobile data network of claim 2 wherein the LI mechanism monitors subscriber IDs added to the LI subscriber list, and where the added subscriber ID is in an active PDP session that is authorized for breakout, breakout of the PDP session is discontinued at the first service mechanism.
6. The mobile data network of claim 2 wherein the LI subscriber list is stored in the second service mechanism.
7. The mobile data network of claim 1 wherein the first service mechanism sends a message to the second service mechanism on the overlay network to inform the second service mechanism of the breakout of an IP flow of a subscriber session.
8. The mobile data network of claim 1 wherein the second service mechanism is located in a serving gateway in the core network.
9. The mobile data network of claim 1 wherein the first service mechanism and the second service mechanism breakout a user session to perform the first service without requiring change to hardware in other components in the mobile data network.
10. A mobile data network comprising:
a plurality of basestations, each basestation communicating with a corresponding antenna that transmits and receives radio signals to and from user equipment, wherein the plurality of basestations are part of a radio access network that communicates with a core network in the mobile data network;
a first service mechanism in the radio access network that defines an existing first data path in the radio access network for non-broken out data, defines a second data path for broken out data, identifies first data received from a corresponding basestation as data to be broken out, sends the first data on the second data path, and forwards other data that is not broken out on the first data path, wherein the first service mechanism performs a first service for network messages in the radio access network based on the first data;
a second service mechanism in the core network that monitors network messages in the core network and determines what traffic meets breakout authorization criteria and sends a message to the first service mechanism with subscriber information for the first mechanism to perform breakout sessions on the second data path;
an overlay network that allows the first service mechanism to communicate with the second service mechanism to perform the first service;
wherein the first service mechanism makes a breakout decision based on internet protocol (IP) data flows matching breakout conditions to perform the first service on the second data path for subscriber sessions with subscriber information from the second service mechanism;
a lawful interception (LI) mechanism that withholds subscriber information from the first service mechanism for subscribers subject to lawful interception so the first service mechanism will not make a breakout decision for subscribers subject to lawful interception;
wherein the LI mechanism monitors a subscriber identification (ID) at an activation of a packet data protocol (PDP) context and compares the subscriber ID with a LI subscriber list stored in the second service mechanism that contains subscribers subject to LI, and does not authorize session breakout for the subscriber ID on the LI subscriber list by the withholding of subscriber information from the first service mechanism; and
wherein the LI mechanism monitors LI activation messages from an administrative function (ADMF) of a lawful interception system and adds subscriber IDs to the LI subscriber list.