ETSI TS 103 221-1: X1 administration
The X1 interface is the provider-internal administration path between a central administration function and LI functions. It carries controlled provisioning and lifecycle state, not a license for local components to invent scope.
Safety boundary: this chapter teaches lawful, governed system design from public standards. It does not provide operational targeting, activation, decryption, surveillance-evasion, or covert collection instructions.
The mental model
| Concept | Plain meaning | Control that must travel with it |
|---|---|---|
| Central administration | One governed source coordinates authorized technical state | Avoid uncontrolled local tasking |
| Provisioning | Distributes the minimum parameters needed by a function | Do not send legal documents or unrelated identifiers |
| Function discovery/capability | Administration understands supported features and status | Capability must not silently downgrade safeguards |
| Acknowledgement | Each function reports applied state | Success is reconciled across the whole path |
| Keepalive/status | Detects control-path health | Health does not prove correct target scope |
| De-provisioning | Removes authorized state promptly at end | Local expiry is a safety backstop |
Apply it as a controlled workflow
- Inventory every X1-controlled function and assign stable identity.
- Authenticate and authorize both sides with narrow service credentials.
- Send idempotent versioned desired state with effective and expiry times.
- Collect positive and negative acknowledgements and reconcile drift.
- Keep target parameters out of generic infrastructure telemetry.
- Exercise control-plane outage, rollback, revocation, and stale-node recovery.
Evidence to demand
- Desired and observed state can be compared without exposing content.
- A newly restored node cannot reactivate expired state.
- Unknown fields, versions, and functions fail safely.
- Certificate rotation does not require bypassing peer authentication.
Failure to reason about
A function restores from an old snapshot containing an active task. If it trusts local disk instead of authoritative current state and expiry, it can resume unlawful collection. Boot must reconcile signed/authorized state before observation.
Feynman check
X1 is the provider’s private control line. It tells approved internal machines exactly which bounded job exists and when it ends.