5G服务请求信令流全链拆解：UE触发与网络触发双路径深度解析

sequenceDiagram
    participant UE
    participant RAN as (R)AN/gNB
    participant AMF
    participant SMF
    participant UPF as UPF(PSA)
    participant PCF

    Note over UE,RAN: Step 1-2: AN连接建立
    UE->>RAN: RRC Connection Request
    RAN->>UE: RRC Connection Setup
    UE->>RAN: RRC Connection Setup Complete<br/>(携带NAS Service Request)

    Note over RAN,AMF: Step 3: N2消息转发
    RAN->>AMF: N2 Uplink NAS Transport<br/>(NAS Service Request + UserLocationInfo)

    Note over AMF: Step 4: NAS安全验证
    AMF->>AMF: 验证Service Request完整性保护<br/>检查5G-GUTI映射的SUPI<br/>验证Service Type

    Note over AMF,UE: Step 5: NAS SMC(条件触发)
    AMF->>UE: NAS Security Mode Command
    UE->>AMF: NAS Security Mode Complete

    Note over AMF,SMF: Step 6-7: PDU Session激活请求
    AMF->>SMF: Nsmf_PDUSession_UpdateSMContext Request<br/>(PDU Session ID, SUPI, DNN, S-NSSAI,<br/>UserLocationInfo, ReqType="existing_pdu_session")
    SMF->>SMF: 校验PDU Session状态<br/>确定UPF(PSA)隧道信息
    SMF->>PCF: SmPolicyAssociation_Update(可选)
    PCF->>SMF: Policy Update(可选)

    Note over SMF,UPF: Step 8: N4会话修改(准备UL隧道)
    SMF->>UPF: N4 Session Modification Request<br/>(Create FAR/URR, 安装检测规则)
    UPF->>SMF: N4 Session Modification Response

    Note over SMF,AMF: Step 9: N1N2消息传递
    SMF->>AMF: N1N2Message Transfer<br/>(N2 SM Info: QoS Profile List,<br/>CN Tunnel Info=UPF N3 TEID/IP,<br/>PDU Session ID)

    Note over AMF,RAN: Step 10-11: N2请求下发
    AMF->>RAN: N2 Initial Context Setup Request<br/>或 PDU Session Resource Setup Request<br/>(含N2 SM Info + NAS Service Accept)
    RAN->>UE: RRC Reconfiguration<br/>(DRB建立, NAS Service Accept)
    UE->>RAN: RRC Reconfiguration Complete

    Note over RAN,AMF: Step 12: N2响应(AN隧道信息)
    RAN->>AMF: N2 Initial Context Setup Response<br/>(含AN Tunnel Info=gNB N3 TEID/IP)

    Note over AMF,SMF: Step 13: AN隧道信息转发
    AMF->>SMF: Nsmf_PDUSession_UpdateSMContext Request<br/>(AN Tunnel Info)

    Note over SMF,UPF: Step 14: N4会话修改(完成DL隧道)
    SMF->>UPF: N4 Session Modification Request<br/>(提供AN Tunnel Info作为DL转发规则)
    UPF->>SMF: N4 Session Modification Response

    Note over UE,UPF: 用户面激活完成
    UE->>RAN: Uplink Data
    RAN->>UPF: N3 Uplink Data
    UPF->>RAN: N3 Downlink Data
    RAN->>UE: Downlink Data

N2 SM Information (PDU Session Resource Setup Request Transfer)
├── PDU Session ID
├── S-NSSAI
├── QoS Flow Setup Request List
│   ├── QoS Flow Identifier (QFI)
│   ├── QoS Flow Level QoS Parameters
│   │   ├── 5QI (5G QoS Identifier)
│   │   ├── ARP (Allocation and Retention Priority)
│   │   ├── GFBR (Guaranteed Flow Bit Rate) - 仅GBR QoS Flow
│   │   ├── MFBR (Maximum Flow Bit Rate) - 仅GBR QoS Flow
│   │   └── Notification Control
│   └── QoS Flow Map (QFI → DRB映射)
├── UL NG-U UP TNL Information (UPF侧N3隧道端点)
│   ├── UPF IP Address
│   └── UPF TEID
└── PDU Session Type (IPv4/IPv6/Ethernet/Unstructured)

stateDiagram-v2
    [*] --> NAS_Security_Check: 收到Service Request
    NAS_Security_Check --> MAC_Verify: 提取5G-S-TMSI
    MAC_Verify --> Context_Retrieval: MAC-I验证通过
    MAC_Verify --> Reject_MacFail: MAC-I验证失败
    Context_Retrieval --> ServiceType_Check: 获取UE MM Context
    ServiceType_Check --> MultiSMF_Coordination: Service Type=数据
    ServiceType_Check --> Signaling_Only: Service Type=信令
    MultiSMF_Coordination --> Wait_All_SMF: 并行发送UpdateSMContext
    Wait_All_SMF --> Aggregate_N2Info: 收集所有SMF的N2 SM Info
    Aggregate_N2Info --> N2_Request_Send: 组装N2 Request
    N2_Request_Send --> Wait_N2_Response
    Wait_N2_Response --> Forward_AN_Tunnel: 收到N2 Response
    Forward_AN_Tunnel --> [*]: 用户面激活完成
    Signaling_Only --> Service_Accept: 仅建立信令连接
    Service_Accept --> [*]
    Reject_MacFail --> [*]: 发送Service Reject(#3GPP cause)

flowchart TB
    subgraph AMF["AMF - 多SMF协调器"]
        A1[收到Service Request<br/>UL Data Status: PS1, PS3]
        A2[查询SMF上下文表<br/>PS1→SMF-A, PS3→SMF-B]
        A3[并行发送UpdateSMContext]
        A4{等待所有SMF响应}
        A5[聚合N2 SM Info]
        A6[组装N2 Request]
    end

    subgraph SMF_A["SMF-A (管理PS1)"]
        B1[UpdateSMContext Request]
        B2[N4 Session Mod with UPF]
        B3[返回N2 SM Info for PS1]
    end

    subgraph SMF_B["SMF-B (管理PS3)"]
        C1[UpdateSMContext Request]
        C2[N4 Session Mod with UPF]
        C3[返回N2 SM Info for PS3]
    end

    A1 --> A2 --> A3
    A3 --> B1 & C1
    B1 --> B2 --> B3
    C1 --> C2 --> C3
    B3 & C3 --> A4
    A4 -->|所有响应到达| A5 --> A6

    style AMF fill:#e1f5fe
    style SMF_A fill:#f3e5f5
    style SMF_B fill:#fff3e0

sequenceDiagram
    participant AF/DN
    participant UPF as UPF(PSA)
    participant SMF
    participant AMF
    participant RAN as (R)AN
    participant UE

    Note over AF/DN,UPF: 阶段一：下行数据触发
    AF/DN->>UPF: Downlink Data Packet
    Note over UPF: N3隧道不存在(UE在CM-IDLE)<br/>缓存DL Data<br/>启动Data Notification Timer
    UPF->>SMF: N4 Session Report Request<br/>(Report Type=DL Data Report<br/>PDU Session ID, DL Data Packets数量)

    Note over SMF: 校验UE状态=CM-IDLE<br/>检查PDU Session是否激活
    SMF->>UPF: N4 Session Report Response<br/>(指示UPF继续缓存)

    Note over SMF,AMF: 阶段二：Paging触发
    SMF->>AMF: Namf_Communication_N1N2MessageTransfer<br/>(SMF寻呼优先级PPI<br/>DNN, S-NSSAI, UE标识)

    Note over AMF,RAN: 阶段三：Paging下发
    AMF->>AMF: 确定Paging Area<br/>(UE的Registration Area列表)
    AMF->>RAN: NGAP Paging Request<br/>(5G-S-TMSI, TAI List,<br/>Paging Priority, DRX Cycle)
    RAN->>UE: Radio Interface Paging<br/>(P-RNTI触发Paging DCI)

    Note over UE,AMF: 阶段四：UE响应(复用UE Triggered流程)
    UE->>RAN: RRC Connection Request
    RAN->>UE: RRC Setup
    UE->>RAN: RRC Setup Complete<br/>(NAS Service Request<br/>Service Type=移动终端数据)
    RAN->>AMF: N2 Uplink NAS Transport<br/>(NAS Service Request)

    Note over AMF,UPF: 阶段五：用户面建立(同4.2.3.1 Step 6-14)
    AMF->>SMF: Nsmf_PDUSession_UpdateSMContext
    SMF->>UPF: N4 Session Modification
    SMF->>AMF: N1N2Message Transfer(N2 SM Info)
    AMF->>RAN: N2 Request
    RAN->>UE: RRC Reconfig + NAS Service Accept
    RAN->>AMF: N2 Response(AN Tunnel Info)
    AMF->>SMF: UpdateSMContext(AN Tunnel Info)
    SMF->>UPF: N4 Session Modification(DL Tunnel)

    Note over UPF,UE: 缓存数据转发
    UPF->>RAN: N3 Downlink Data(缓存数据)
    RAN->>UE: Downlink Data

flowchart LR
    subgraph UE状态空间
        A[CM-IDLE<br/>RRC-IDLE] -->|Service Request| B[CM-CONNECTED<br/>RRC-CONNECTED]
        C[CM-CONNECTED<br/>RRC-INACTIVE] -->|RRC Resume| B
        C -->|RAN Paging| C
        A -->|Network Triggered<br/>Paging + Service Request| B
    end

    subgraph 核心网感知
        D[AMF: UE=CM-IDLE<br/>无N2连接]
        E[AMF: UE=CM-CONNECTED<br/>有N2连接但无N3隧道]
        F[AMF: UE=CM-CONNECTED<br/>有N2+N3隧道]
    end

    A --- D
    C --- E
    B --- F

    style A fill:#ffcdd2
    style C fill:#fff9c4
    style B fill:#c8e6c9

N4 Session Modification Request (Stage 1):
├── Create FAR (Forwarding Action Rule)
│   ├── FAR ID
│   ├── Apply Action = FORK (转发)
│   └── Forwarding Parameters
│       ├── Network Instance = "access" (上行方向)
│       └── Destination Interface = "Access" (→RAN)
├── Create URR (Usage Reporting Rule) - 可选
│   ├── URR ID
│   └── Measurement Method = Volume/Duration
└── Update PDR (Packet Detection Rule)
    ├── PDR ID
    ├── Precedence
    ├── PDUI (Source Interface = Access)
    └── FAR ID → 指向上面的FAR

N4 Session Modification Request (Stage 2):
├── Update FAR
│   ├── FAR ID (复用Stage 1的FAR)
│   └── Update Forwarding Parameters
│       ├── Destination Interface = "Access" (下行方向)
│       ├── Network Instance = "access"
│       └── Outer Header Creation
│           ├── gNB IP Address (from AN Tunnel Info)
│           ├── gNB TEID (from AN Tunnel Info)
│           └── Port Number
└── Create BAR (Buffering Action Rule) - 删除
    └── 指示UPF停止缓存, 开始转发DL数据

QoS Flow Setup Request List:
├── QoS Flow #1 (QFI=1, 5QI=9)
│   └── Non-GBR, Default QoS Flow (Internet数据)
├── QoS Flow #2 (QFI=2, 5QI=1)
│   └── Non-GBR, IMS Conversational Voice
└── QoS Flow #3 (QFI=3, 5QI=4)
    └── Non-GBR, IMS Video

flowchart TD
    A[Service Request失败] --> B{抓包看到什么?}
    B -->|NAS Service Reject| C{Cause值?}
    B -->|无NAS响应| D{N2消息是否到达AMF?}
    B -->|PDU Session未激活| E{N4 Session Mod是否成功?}

    C -->|#3/#6/#9| F[UE标识问题<br/>检查S-TMSI/SUPI映射]
    C -->|#7| G[订阅问题<br/>检查UDM签约数据]
    C -->|#22| H[拥塞<br/>检查AMF/SMF负载]

    D -->|N2未到达| I[RAN问题<br/>检查NGAP连接/RRC建立]
    D -->|N2到达但AMF无响应| J[AMF处理异常<br/>检查UE Context是否丢失]

    E -->|N4成功| K[RAN资源问题<br/>检查DRB建立日志]
    E -->|N4失败| L[UPF问题<br/>检查UPF Session状态/资源]

    style A fill:#ffcdd2
    style F fill:#e1f5fe
    style G fill:#e1f5fe
    style H fill:#e1f5fe
    style I fill:#e1f5fe
    style J fill:#e1f5fe
    style K fill:#e1f5fe
    style L fill:#e1f5fe

# Wireshark过滤NAS Service Request
nas-5gs.message_type == 0x4c

# 过滤Nsmf_PDUSession_UpdateSMContext (Service Request触发)
http2.headers contains "nsmf-pdusession/v1/sm-contexts" && http2.headers contains "modify"

# 过滤N4 Session Modification (Service Request相关)
pfcp.msg_type == 53  # PFCP Session Modification Request

# 过滤NGAP Initial Context Setup (Service Request场景)
ngap.procedureCode == 30  # InitialContextSetup

# 过滤NGAP PDU Session Resource Setup
ngap.procedureCode == 39  # PDUSessionResourceSetup

# 过滤Paging (Network Triggered)
ngap.procedureCode == 23  # Paging