5G AMF过载控制三层防护机制全链拆解

flowchart TB
    subgraph 过载源["信令过载来源"]
        A1["海量IoT设备同时上线"]
        A2["突发事件集中注册潮"]
        A3["NF异常导致信令重传"]
        A4["恶意信令风暴攻击"]
    end

    subgraph AMF["AMF 过载控制三层防护"]
        B1["第一层: N2过载控制<br/>NGAP Overload Start/Stop<br/>→ gNB侧节流"]
        B2["第二层: NAS拥塞控制<br/>Registration/Service Reject<br/>+ T3346/T3525退避定时器<br/>→ UE侧退避"]
        B3["第三层: SBI过载控制<br/>HTTP 503/429 + OCI Header<br/>→ NF侧限流"]
    end

    subgraph 监控["AMF内部监控"]
        C1["CPU利用率"]
        C2["内存使用率"]
        C3["NAS连接数"]
        C4["消息队列深度"]
        C5["信令处理延迟"]
    end

    A1 & A2 & A3 & A4 --> B1 & B2 & B3
    C1 & C2 & C3 & C4 & C5 -->|"触发阈值"| B1 & B2 & B3

sequenceDiagram
    participant AMF
    participant gNB1 as gNB-1
    participant gNB2 as gNB-2
    participant gNB3 as gNB-3

    Note over AMF: 监控到CPU>85%<br/>NAS连接数>阈值<br/>消息队列积压

    AMF->>gNB1: NGAP Overload Start<br/>Overload Response = reject-all-non-emergency<br/>Traffic Load Reduction = 60%
    AMF->>gNB2: NGAP Overload Start<br/>Overload Response = reject-all-non-emergency<br/>Traffic Load Reduction = 60%
    AMF->>gNB3: NGAP Overload Start<br/>Overload Response = allow-emergency-high-priority-only<br/>Overload Start NSSAI List = SST:1 SD:010203

    Note over gNB1,gNB2: 开始按60%比例<br/>丢弃非紧急NAS信令
    Note over gNB3: 仅转发紧急会话<br/>且仅限特定切片

    gNB1--xAMF: RRC Reject (非紧急UE)
    gNB2--xAMF: 拒绝新NAS连接

    Note over AMF: 过载缓解<br/>CPU<60%

    AMF->>gNB1: NGAP Overload Stop
    AMF->>gNB2: NGAP Overload Stop
    AMF->>gNB3: NGAP Overload Stop

    Note over gNB1,gNB3: 恢复正常信令转发

sequenceDiagram
    participant UE
    participant gNB
    participant AMF

    UE->>gNB: RRC Connection Request
    gNB->>UE: RRC Connection Setup
    UE->>gNB: RRC Connection Setup Complete<br/>(NAS Registration Request)
    gNB->>AMF: NGAP Initial UE Message<br/>(NAS: Registration Request)

    Note over AMF: NAS拥塞状态<br/>拒绝非紧急注册

    AMF->>gNB: NGAP Downlink NAS Transport<br/>(NAS: Registration Reject)
    gNB->>UE: NAS Registration Reject<br/>5GMM Cause #22 (Congestion)<br/>T3346 = 300秒

    Note over UE: 启动T3346定时器<br/>300秒内不发起<br/>非紧急注册请求

    UE->>UE: T3346超时

    UE->>gNB: RRC Connection Request<br/>(重新尝试注册)
    gNB->>AMF: NGAP Initial UE Message<br/>(NAS: Registration Request)
    AMF->>gNB: NGAP Initial Context Setup Request<br/>(NAS: Registration Accept)

flowchart TD
    subgraph NF消费者
        SMF["SMF"]
        UDM["UDM"]
        PCF["PCF"]
        AUSF["AUSF"]
    end

    subgraph SBI过载控制
        M1["模式一: HTTP状态码<br/>503 + Retry-After<br/>429 + 速率限制<br/>307 + 重定向"]
        M2["模式二: OCI Header<br/>overload-pct<br/>OCI-RI Target"]
        M3["模式三: NRF负载感知<br/>NF负载上报<br/>加权选择"]
    end

    subgraph AMF集群
        A1["AMF-1<br/>负载 92%"]
        A2["AMF-2<br/>负载 45%"]
        A3["AMF-3<br/>负载 38%"]
    end

    SMF & UDM & PCF & AUSF -->|"HTTP/2 请求"| M1 & M2
    M1 & M2 -->|"反馈过载"| SMF & UDM & PCF & AUSF
    M3 -->|"引导至轻载实例"| A2 & A3

stateDiagram-v2
    [*] --> Normal: 系统启动

    Normal --> Early_Warning: CPU>70% 或<br/>NAS连接数>80%阈值
    Early_Warning --> Normal: 负载回落
    Early_Warning --> Moderate_Overload: CPU>80% 或<br/>消息队列积压

    Moderate_Overload --> Early_Warning: 负载下降
    Moderate_Overload --> Severe_Overload: CPU>90% 或<br/>消息处理超时率>5%
    Moderate_Overload --> Normal: 负载恢复正常

    Severe_Overload --> Moderate_Overload: 负载缓解
    Severe_Overload --> Critical_Overload: CPU>95% 或<br/>系统濒临崩溃
    Severe_Overload --> Moderate_Overload: 部分恢复

    Critical_Overload --> Severe_Overload: 负载缓解

    state Early_Warning {
        [*] --> SBI_Throttle
        SBI_Throttle: SBI层: 上报NRF负载升高
        SBI_Throttle: N2层: 无动作
        SBI_Throttle: NAS层: 无动作
    }

    state Moderate_Overload {
        [*] --> N2_Throttle
        N2_Throttle: SBI层: 503+Retry-After
        N2_Throttle: N2层: Overload Start<br/>Response=reject-non-emergency<br/>Reduction=30%
        N2_Throttle: NAS层: 无直接动作
    }

    state Severe_Overload {
        [*] --> NAS_Congestion
        NAS_Congestion: SBI层: 503+OCI Header
        NAS_Congestion: N2层: Overload Start<br/>Response=allow-emergency-only<br/>Reduction=60%
        NAS_Congestion: NAS层: Registration Reject<br/>Cause#22 + T3346
    }

    state Critical_Overload {
        [*] --> Full_Protection
        Full_Protection: SBI层: 503 全部拒绝
        Full_Protection: N2层: Overload Start<br/>Response=reject-all<br/>Reduction=100%
        Full_Protection: NAS层: 全部拒绝<br/>仅保留紧急会话
    }

sequenceDiagram
    participant gNB
    participant NRF
    participant AMF1 as AMF-1<br/>(负载92%)
    participant AMF2 as AMF-2<br/>(负载45%)
    participant UDM

    AMF1->>NRF: Nnrf_NFUpdate<br/>负载=92%, 容量=低
    Note over NRF: 更新AMF-1负载信息

    gNB->>NRF: Nnrf_NFDiscovery<br/>查找可用AMF
    NRF->>gNB: 返回AMF-2（负载最优）

    gNB->>AMF2: NGAP Initial UE Message<br/>(新UE注册引导至AMF-2)

    Note over AMF1: 对已连接UE<br/>启动过载控制

    AMF1->>gNB: NGAP Overload Start<br/>Reduction=40%
    AMF1->>AMF1: 对部分已注册UE<br/>发起UE Configuration Update
    AMF1->>AMF2: Namf_Communication<br/>转移UE上下文

# 过滤NGAP Overload Start消息
tshark -i eth0 -f "tcp port 38412" \
  -Y "ngap.procedureCode == 17 && ngap.initiatingMessage"

# 过滤NGAP Overload Stop消息
tshark -i eth0 -f "tcp port 38412" \
  -Y "ngap.procedureCode == 18 && ngap.initiatingMessage"

# 过滤NAS Registration Reject Cause #22
tshark -i eth0 -f "tcp port 38412" \
  -Y "nas-5gs.regist.reject && nas-5gs.cause == 22"

# 过滤AMF返回的503/429响应
tshark -i eth0 -f "tcp port 8000" \
  -Y "http2.response.code == 503 || http2.response.code == 429"

sequenceDiagram
    participant UE1 as 普通UE
    participant UE2 as 紧急UE
    participant gNB
    participant AMF
    participant SMF
    participant UDM
    participant NRF

    Note over AMF: T0: 正常运行状态

    Note over AMF: T1: 大量IoT设备同时注册<br/>CPU升至85%

    rect rgb(255, 230, 230)
        Note over AMF: 第一阶段：SBI+轻微N2节流
        AMF->>NRF: Nnrf_NFUpdate(负载=85%)
        AMF->>gNB: NGAP Overload Start<br/>Response=reject-non-emergency<br/>Reduction=20%
    end

    Note over UE1: UE1发起注册
    UE1->>gNB: NAS Registration Request
    Note over gNB: gNB按20%比例随机丢弃
    gNB--xUE1: RRC Reject（被节流）

    Note over AMF: T2: 负载继续上升至92%

    rect rgb(255, 200, 200)
        Note over AMF: 第二阶段：加强N2节流+NAS拥塞
        AMF->>gNB: NGAP Overload Start<br/>Response=allow-emergency-high-priority<br/>Reduction=60%
    end

    UE1->>gNB: NAS Registration Request
    gNB->>AMF: NGAP Initial UE Message
    AMF->>gNB: NGAP DL NAS Transport
    gNB->>UE1: Registration Reject<br/>Cause #22, T3346=300s
    Note over UE1: 300秒内不再注册

    UE2->>gNB: NAS Registration Request<br/>(Emergency)
    gNB->>AMF: NGAP Initial UE Message<br/>(Emergency Registration)
    Note over AMF: 紧急注册不受过载控制
    AMF->>UDM: Nudm_SDM_Get
    UDM-->>AMF: 签约数据
    AMF->>gNB: Registration Accept

    Note over AMF: AMF调用SMF遭遇过载
    AMF->>SMF: Nsmf_PDUSession_CreateSMContext
    SMF-->>AMF: HTTP 503 + Retry-After:30
    Note over AMF: 30秒后重试SMF

    Note over AMF: T3: 负载下降至65%

    rect rgb(230, 255, 230)
        Note over AMF: 第三阶段：逐步恢复
        AMF->>gNB: NGAP Overload Start<br/>Response=reject-non-emergency<br/>Reduction=10%
    end

    Note over AMF: T4: 负载降至50%

    AMF->>gNB: NGAP Overload Stop
    AMF->>NRF: Nnrf_NFUpdate(负载=50%)
    Note over AMF,gNB: 恢复正常运行