Enhanced lawful interception

1. A method of operation of a network node in a cellular communications network to provide monitoring of cellular network traffic, comprising:

receiving a list of one or more obfuscated target identifiers from a monitoring node, each obfuscated target identifier of the one or more obfuscated target identifiers being a user identifier of a target user that is encrypted using a first encryption key that is unknown to the network node;

receiving an encrypted packet from an element that operates to intercept traffic on another network node in the cellular communications network, where the encrypted packet is a concatenation of:

a first encrypted user identifier, which is a user identifier encrypted using the first encryption key; and

an encrypted data block, which is a block of data associated with the user identifier where the block of data is encrypted using the first encryption key;

determining whether the first encrypted user identifier of the encrypted packet matches one of the one or more obfuscated target identifiers; and

if the first encrypted user identifier of the encrypted packet matches one of the one or more obfuscated target identifiers:

further encrypting the encrypted packet using a second encryption key negotiated between the network node and the monitoring node to thereby provide a further encrypted packet; and

transmitting the further encrypted packet to the monitoring node.

2. The method of claim 1 wherein the block of data is an intercept related information or communication of content type of data.

3. The method of claim 1 wherein the block of data comprises data related to an attach procedure performed for a wireless device having the associated user identifier, data related to a connection procedure performed for the wireless device having the associated user identifier, data related to a tracking area update performed for the wireless device having the associated user identifier, an Internet Protocol, IP, header for an IP packet to or from the wireless device having the associated user identifier, and/or an IP payload for the IP packet to or from the wireless device having the associated user identifier.

4. The method of claim 1 further comprising:

receiving, from the element, a second encrypted packet and associated cryptographic information, where the second encrypted packet is a concatenation of:

a second encrypted user identifier, which is a second user identifier encrypted using an updated version of the first encryption key; and

a second encrypted data block, which is a block of data associated with the second user identifier where the block of data is encrypted using the updated version of the first encryption key;

updating the one or more obfuscated target identifiers based on the associated cryptographic information to provide one or more updated obfuscated target identifiers;

determining whether the second encrypted user identifier of the second encrypted packet matches one of the one or more updated obfuscated target identifiers; and

if the second encrypted user identifier of the second encrypted packet matches one of the one or more updated obfuscated target identifiers:

further encrypting the second encrypted packet using the second encryption key negotiated between the network node and the monitoring node to thereby provide a second further encrypted packet; and

transmitting the second further encrypted packet to the monitoring node.

5. The method of claim 4 wherein transmitting the second further encrypted packet to the monitoring node comprises transmitting the second further encrypted packet and at least a portion of the cryptographic information to the monitoring node.

6. The method of claim 5 wherein the at least a portion of the cryptographic information comprises an indication that enables the monitoring node to update the one or more obfuscated target identifiers.

7. The method of claim 4 wherein the cryptographic information comprises information that enables updating the one or more obfuscated target identifiers without secret keys.

8. The method of claim 4 wherein the cryptographic information comprises a delta value that represents a difference between a first pseudorandom keystream that represents the first encryption key and a second pseudorandom keystream that represents the updated version of the first encryption key.

9. The method of claim 8 wherein the cryptographic information further comprises a sequence number used to generate the updated version of the first encryption key.

10. The method of claim 8 wherein the first encryption key is a pseudorandom keystream generated via Advanced Encryption Standard, AES, in counter mode.

11. A network node in a cellular communications network to provide monitoring of cellular network traffic, comprising:

at least one processor; and

memory comprising instructions executable by the at least one processor whereby the network node is operable to:

receive a list of one or more obfuscated target identifiers from a monitoring node, each obfuscated target identifier of the one or more obfuscated target identifiers being a user identifier of a target user that is encrypted using a first encryption key that is unknown to the network node;

receive an encrypted packet from an element that operates to intercept traffic on another network node in the cellular communications network, where the encrypted packet is a concatenation of:

a first encrypted user identifier, which is a user identifier encrypted using the first encryption key; and

an encrypted data block, which is a block of data associated with the user identifier where the block of data is encrypted using the first encryption key;

determine whether the first encrypted user identifier of the encrypted packet matches one of the one or more obfuscated target identifiers; and

if the first encrypted user identifier of the encrypted packet matches one of the one or more obfuscated target identifiers:

further encrypt the encrypted packet using a second encryption key negotiated between the network node and the monitoring node to thereby provide a further encrypted packet; and

transmit the further encrypted packet to the monitoring node.