Interception of high-throughput data traffic
Systems, devices, and techniques described herein relate to interception of data traffic that is traversing a network at a relatively high throughput rate. In some examples, a request to initiate interception is received from a server. In response to receiving the request to initiate interception, an instruction to forward user plane data to the server can be transmitted to a User Plane Function (UPF). The UPF may be transferring the user plane data in a data flow. The instruction may cause the UPF to forward the user plane data to the server in multiple streams. In addition, control plane data associated with the data flow can be transmitted to the server.
1. A method performed by a Session Management Function (SMF), the method comprising:
selecting a User Plane Function (UPF) to transfer user plane data in a data flow between a User Equipment (UE) and a Data Network (DN);
receiving, from an interception server, a request to initiate interception;
in response to receiving the request:
causing the UPF to forward the user plane data to the interception server via multiple first Transfer Control Protocol (TCP) streams by transmitting, to the UPF, an instruction to forward the user plane data to the interception server;
transmitting, to the interception server, control plane data associated with the data flow via a second TCP stream; and
transmitting, to the interception server, a key indicating how the user plane data can be reassembled from the multiple first TCP streams.
2. The method of claim 1 , wherein the user plane data comprises at least one of image data, video data, voice data, web browsing data, or audio data.
3. The method of claim 1 , wherein the control plane data comprises Non-Access Stratum (NAS) data associated with the data flow.
4. The method of claim 1 , further comprising:
transmitting, to the UPF, a message instructing how the user plane data should be split between the multiple first TCP streams.
5. The method of claim 1 , further comprising:
receiving, from the UPF, the key.
6. The method of claim 1 , wherein a rate at which the user plane data is received at the UPF exceeds a maximum data transfer rate of one of the multiple first TCP streams.
7. The method of claim 1 , wherein the request to initiate interception identifies at least one of the UE or a device communicating with the UE.
8. A system, comprising:
at least one processor; and
memory storing instructions that, when executed by the at least one processor, cause the at least one processor to perform operations comprising:
receiving, from a server, a request to initiate interception; and
in response to receiving the request to initiate interception:
causing a User Plane Function (UPF) to forward user plane data associated with a data flow to the server via multiple data streams by transmitting, to the UPF, an instruction to forward the user plane data to the server; and
transmitting, to the server, control plane data associated with the data flow; and
transmitting, to the server, a key instructing how the user plane data can be reassembled from the multiple data streams.
9. The system of claim 8 , wherein the operations further comprise:
receiving, from the UPF, the key.
10. The system of claim 8 , wherein the request to initiate interception identifies at least one of the data flow or a User Equipment (UE) associated with the data flow.
11. The system of claim 8 , wherein the user plane data comprises at least one of image data, video data, voice data, web browsing data, or audio data.
12. The system of claim 8 , wherein the control plane data comprises Non-Access Stratum (NAS) data associated with the data flow.
13. The system of claim 8 , wherein the control plane data is transmitted via a Transfer Control Protocol (TCP) stream.
14. The system of claim 8 , wherein the operations further comprise:
transmitting, to the UPF, a message instructing how the user plane data should be split between the multiple streams.