NGAP Initial Context Setup三阶段信令与安全上下文注入深度解析

stateDiagram-v2
    [*] --> InitialUEMessage: gNB收到RRC Setup Complete
    InitialUEMessage --> InitialContextSetupRequest: AMF完成NAS认证/安全
    InitialContextSetupRequest --> SecurityModeCommand: gNB推送安全上下文到UE
    SecurityModeCommand --> SecurityModeComplete: UE确认安全激活
    SecurityModeComplete --> RRCReconfiguration: gNB配置PDU Session无线资源
    RRCReconfiguration --> RRCReconfigurationComplete: UE确认资源配置
    RRCReconfigurationComplete --> InitialContextSetupResponse: gNB向AMF确认
    InitialContextSetupResponse --> [*]: UE上下文建立完成

    InitialContextSetupRequest --> InitialContextSetupFailure: 资源不足/安全失败
    InitialContextSetupFailure --> [*]: 上下文建立失败

sequenceDiagram
    participant UE
    participant gNB
    participant AMF

    Note over UE,gNB: Phase 0: RRC连接建立（已提前完成）

    UE->>gNB: RRC Setup Complete + NAS Registration Request
    gNB->>AMF: NGAP Initial UE Message<br/>RAN-UE-NGAP-ID, UserLocationInformation,<br/>RRC Establishment Cause, 5G-S-TMSI

    Note over AMF: AMF执行NAS认证（5G AKA/EAP-AKA'）<br/>NAS Security Mode Command/Complete

    rect rgb(230, 240, 255)
    Note over AMF,gNB: Phase 1: 安全上下文注入
    AMF->>gNB: NGAP Initial Context Setup Request<br/>[Security Context]<br/>[UESecurityCapabilities]<br/>[SecurityKey]
    end

    rect rgb(255, 240, 230)
    Note over gNB,UE: Phase 2: 安全激活
    gNB->>UE: AS Security Mode Command<br/>选定的5G-IA/5G-EA算法<br/>+ SecurityKey衍生
    UE->>gNB: AS Security Mode Complete
    end

    rect rgb(230, 255, 230)
    Note over AMF,gNB: Phase 3: PDU会话资源建立
    AMF->>gNB: Initial Context Setup Request中携带<br/>PDU Session Resource Setup Request List<br/>[PDU Session ID, S-NSSAI, QoS Flow List,<br/>UL/DL TEID, Transport Layer Address]
    gNB->>UE: RRC Reconfiguration<br/>DRB配置、QoS Flow映射
    UE->>gNB: RRC Reconfiguration Complete
    gNB->>AMF: NGAP Initial Context Setup Response<br/>PDU Session Resource Setup Response List<br/>[AN Tunnel Info, QoS Flow Per TNL Info]
    end

SecurityKey ::= SEQUENCE {
    k-gNB          BIT STRING (SIZE(256)),   -- 5G核心网推衍的gNB密钥
    k-n3iwf        BIT STRING (SIZE(256)) OPTIONAL,  -- N3IWF密钥（非可信接入）
    k-ng-ran       BIT STRING (SIZE(256)) OPTIONAL   -- NG-RAN密钥（可信接入）
}

graph TD
    KAMF["KAMF (AMF根密钥)"] -->|"KDF: FC=0x6E, P0=accessType"| KgNB["KgNB"]
    KAMF -->|"KDF: FC=0x6E, P0=N3IWF"| KN3IWF["KN3IWF"]
    KgNB -->|"KDF: FC=0x70, P0=algorithmType"| KRRCEnc["K_RRC_enc"]
    KgNB -->|"KDF: FC=0x70"| KRRCEnt["K_RRC_int"]
    KgNB -->|"KDF: FC=0x70"| KUPEnc["K_UP_enc"]
    KgNB -->|"横向推衍 FC=0x69"| KgNB_next["Next-hop KgNB"]
    KgNB_next -->|"继续推衍"| KRRCEnc2["K_RRC_enc(next)"]

    style KAMF fill:#ff9999
    style KgNB fill:#ffcc99
    style KRRCEnc fill:#99ff99
    style KRRCEnt fill:#99ff99
    style KUPEnc fill:#99ff99

PDUSessionResourceSetupRequestList ::= SEQUENCE {
    pduSessionID           INTEGER (0..255),           -- PDU Session标识
    pDUSessionNAS-PDU      NAS-PDU OPTIONAL,           -- NAS PDU（发给UE的PDU Session Establishment Accept）
    pDUSessionResourceSetupRequestTransfer  OCTET STRING  -- N2 SM Information
}

graph LR
    subgraph "N2 SM Information (来自SMF)"
        A["PDU Session ID"]
        B["S-NSSAI"]
        C["QoS Flow List"]
        D["UL UP Transport Info<br/>(TEID + UPF IP)"]
        E["Session-AMBR"]
        F["PDU Session Type<br/>(IPv4/IPv6/Ethernet)"]
    end

    subgraph "QoS Flow Item"
        C1["QoS Flow Identifier (QFI)"]
        C2["QoS Profile<br/>(5QI, ARP, GBR参数)"]
        C3["UL/DL QoS Flow Map"]
    end

    C --> C1
    C --> C2
    C --> C3

    style A fill:#e8f4f8
    style B fill:#fff3cd
    style C fill:#d4edda
    style D fill:#f8d7da

graph TD
    subgraph "QoS Flows (来自SMF)"
        QF1["QFI=1: VoNR<br/>5QI=1, GBR, ARP=1"]
        QF2["QFI=2: Video<br/>5QI=2, GBR, ARP=3"]
        QF3["QFI=5: IMS Sig<br/>5QI=5, Non-GBR, ARP=1"]
        QF4["QFI=9: Internet<br/>5QI=9, Non-GBR, ARP=9"]
    end

    subgraph "gNB映射决策"
        M1["策略1: 1:1映射<br/>每个QFI一个DRB"]
        M2["策略2: 相似QoS合并<br/>相同5QI优先级的QFI共享DRB"]
        M3["策略3: GBR/Non-GBR分离<br/>GBR QFI独占DRB"]
    end

    subgraph "DRB结果"
        DRB1["DRB1: QFI=1<br/>专享，低时延调度"]
        DRB2["DRB2: QFI=2<br/>GBR保障"]
        DRB3["DRB3: QFI=5+9<br/>Non-GBR共享"]
    end

    QF1 --> M3
    QF2 --> M3
    QF3 --> M3
    QF4 --> M3
    M3 --> DRB1
    M3 --> DRB2
    M3 --> DRB3

    style QF1 fill:#ffcccc
    style QF2 fill:#ffddcc
    style QF3 fill:#ccffcc
    style QF4 fill:#ccccff

PDUSessionResourceSetupResponseTransfer ::= SEQUENCE {
    dLQosFlowPerTNLInformation  QosFlowPerTNLInformation,
    dLNGUPTNLInformation        UPTransportLayerInformation,  -- gNB的DL TEID + IP
    ...
}

graph LR
    T1["AMF: T3524<br/>等待Initial Context<br/>Setup Response<br/>5-10s"] -->|"超时"| F1["AMF认为gNB失败<br/>触发UE Release"]

    T2["gNB: T_RRC<br/>等待RRC Reconfig<br/>Complete<br/>10s"] -->|"超时"| F2["gNB向AMF返回<br/>Failure Cause"]

    T3["UE: T300<br/>等待RRC Setup<br/>Response<br/>400ms-2s"] -->|"超时"| F3["UE触发RRC<br/>连接重建"]

    T4["gNB: T_Algorithm<br/>安全算法协商<br/>隐含在T_RRC内"] -->|"算法不匹配"| F4["直接返回<br/>Security Failure"]

    T1 -->|"包含"| T2
    T2 -->|"包含"| T4

    style F1 fill:#ffaaaa
    style F2 fill:#ffaaaa
    style F3 fill:#ffaaaa
    style F4 fill:#ffaaaa

# Wireshark过滤NGAP Initial Context Setup
ngap.procedureCode == 15

# 过滤Initial Context Setup Request (Initiating Message)
ngap.procedureCode == 15 && ngap.messageType == 1

# 过滤Initial Context Setup Response (Successful Outcome)  
ngap.procedureCode == 15 && ngap.messageType == 2

# 过配Initial Context Setup Failure (Unsuccessful Outcome)
ngap.procedureCode == 15 && ngap.messageType == 3

症状：gNB返回Initial Context Setup Failure，Cause = "Failure in Radio Interface Procedure"
分析路径：
1. 检查AMF发送的SecurityKey是否正确（256 bits，非全零）
2. 检查gNB选择的5G-IA算法是否在UE Security Capabilities范围内
3. 检查UE是否正确计算了AS层密钥（K_RRC_int）
4. 检查AS Security Mode Complete中的MAC-I是否验证通过

症状：Initial Context Setup Response中，部分PDU Session在Failed List
分析路径：
1. 检查N2 SM Information中的UL UP Transport Info（TEID是否有效）
2. 检查gNB到UPF的N3传输路由是否可达
3. 检查QoS Flow的5QI参数是否在gNB支持的范围内
4. 检查Session-AMBR是否与UE签约数据一致