VoNR IMS注册与P-CSCF发现信令流深度拆解

UE → (R)AN → AMF → SMF → UDM/PCF → SMF → AMF → (R)AN → UE
                                    ↑
                          SMF查询PCF获取P-CSCF地址

stateDiagram-v2
    [*] --> NoIMSSession: UE开机/5GS注册完成
    NoIMSSession --> EstablishingIMSPDU: 发起IMS PDU Session<br/>(DNN=IMS)
    EstablishingIMSPDU --> PCSCF_Discovered: SMF返回<br/>P-CSCF地址
    EstablishingIMSPDU --> DHCP_Query: SMF未返回P-CSCF地址
    DHCP_Query --> PCSCF_Discovered: DHCP响应含<br/>P-CSCF地址
    PCSCF_Discovered --> SIP_Registering: 发起SIP REGISTER
    SIP_Registering --> IMS_Registered: 200 OK
    SIP_Registering --> SIP_Registering: 401/403挑战<br/>重试
    IMS_Registered --> IMS_Registered: 注册刷新<br/>(默认3600s)
    IMS_Registered --> SIP_Registering: 注册过期/网络发起<br/>de-register后重注册
    IMS_Registered --> [*]: IMS PDU Session释放

sequenceDiagram
    participant UE
    participant RAN as (R)AN/gNB
    participant AMF
    participant SMF
    participant PCF
    participant UPF
    participant PCSCF as P-CSCF
    participant ICSCF as I-CSCF
    participant HSS
    participant SCSCF as S-CSCF

    Note over UE,UPF: 阶段1：IMS PDU Session建立（若尚未建立）
    UE->>AMF: NAS PDU Session Establishment Request<br/>(DNN=IMS, SSC mode 1)
    AMF->>SMF: Nsmf_PDUSession_CreateSMContext Request
    SMF->>PCF: Npcf_SMPolicyControl_Create<br/>(获取IMS策略+P-CSCF地址)
    PCF-->>SMF: Policy Decision + P-CSCF Address
    SMF->>UPF: N4 Session Establishment<br/>(QFI=1, 5QI=5, SIP信令专用)
    SMF-->>AMF: Nsmf_PDUSession_CreateSMContext Response<br/>(含P-CSCF Address)
    AMF->>RAN: N2 PDU Session Resource Setup<br/>(QoS参数:5QI=5, Priority)
    RAN->>UE: RRC Reconfiguration + PDU Session Accept<br/>(含P-CSCF Address + IP地址)

    Note over UE,SCSCF: 阶段2：SIP REGISTER（未认证）
    UE->>PCSCF: SIP REGISTER<br/>(Contact, To, From, Call-ID, expires=3600)
    Note right of UE: 关键Header:<br/>Require: sec-agree<br/>Proxy-Require: sec-agree<br/>Security-Client: alg=ipsec-3gpp

    PCSCF->>PCSCF: 记录UE IP+Port<br/>关联IMS PDU Session
    PCSCF->>ICSCF: SIP REGISTER (转发)

    ICSCF->>HSS: Cx: UAR (User Authorization Request)<br/>(Public Identity, Visited Network)
    HSS-->>ICSCF: Cx: UAA (User Authorization Answer)<br/>(S-CSCF Name/Capability Set)

    ICSCF->>SCSCF: SIP REGISTER (转发至选定S-CSCF)

    SCSCF->>HSS: Cx: MAR (Multimedia Auth Request)<br/>(Public Identity, SIP Number Auth)
    HSS-->>SCSCF: Cx: MAA (Multimedia Auth Answer)<br/>(RAND, AUTN, XRES, IK, CK)

    Note over UE,SCSCF: 阶段3：IMS-AKA认证挑战
    SCSCF->>ICSCF: SIP 401 Unauthorized
    Note right of SCSCF: WWW-Authenticate Header:<br/>nonce=RAND:AUTN<br/>algorithm=AKAv1-MD5<br/>ik, ck参数
    ICSCF->>PCSCF: SIP 401 Unauthorized (转发)
    PCSCF->>PCSCF: 提取IK/CK<br/>建立IPSec SA参数
    PCSCF->>UE: SIP 401 Unauthorized

    Note over UE,SCSCF: 阶段4：UE认证响应与注册（已认证）
    UE->>UE: ISIM验证AUTN<br/>计算RES<br/>派生IK/CK
    UE->>PCSCF: SIP REGISTER (带认证响应)<br/>Authorization: response=RES<br/>Security-Verify: 服务端安全参数
    Note right of UE: 此时IPSec SA已建立<br/>port_us=UE protected port<br/>port_ps=P-CSCF protected port

    PCSCF->>PCSCF: 验证Security-Verify<br/>后续SIP消息走IPSec隧道
    PCSCF->>ICSCF: SIP REGISTER (转发)
    ICSCF->>SCSCF: SIP REGISTER (转发)

    SCSCF->>SCSCF: 验证RES == XRES<br/>认证通过
    SCSCF->>HSS: Cx: SAR (Server Assignment Request)<br/>(User Data download request)
    HSS-->>SCSCF: Cx: SAA (Server Assignment Answer)<br/>(IMS用户签约数据/Filter Criteria)

    Note over UE,SCSCF: 阶段5：注册成功
    SCSCF->>ICSCF: SIP 200 OK
    Note right of SCSCF: Service-Route Header<br/>Path Header确认<br/>关联P-CSCF信息
    ICSCF->>PCSCF: SIP 200 OK (转发)
    PCSCF->>PCSCF: 提取Service-Route<br/>绑定UE Contact→S-CSCF
    PCSCF->>UE: SIP 200 OK

    Note over UE,UPF: 阶段6：注册后SIP信令流路径
    Note over UE,PCSCF: 所有后续SIP信令经IPSec SA保护<br/>UE(port_us) ↔ P-CSCF(port_ps)<br/>经5QI=5 QoS Flow传输

REGISTER sip:ims.mnc<MNC>.mcc<MCC>.3gppnetwork.org SIP/2.0
Via: SIP/2.0/UDP [UE_IP]:[port];branch=z9hG4bK1234
From: <sip:[email protected]<MNC>.mcc<MCC>.3gppnetwork.org>;tag=abc123
To: <sip:[email protected]<MNC>.mcc<MCC>.3gppnetwork.org>
Call-ID: abcdefgh@[UE_IP]
CSeq: 1 REGISTER
Contact: <sip:public_user@[UE_IP]:[port]>;expires=3600
Expires: 3600
Require: sec-agree
Proxy-Require: sec-agree
Security-Client: ipsec-3gpp;alg=hmac-sha-1-96;prot=esp;mod=trans;
    spi-c=<client_spi>;spi-s=<server_spi>;
    port-c=<client_port>;port-s=<server_port>
Content-Length: 0

SIP/2.0 401 Unauthorized
...
WWW-Authenticate: Digest realm="ims.mnc<MNC>.mcc<MCC>.3gppnetwork.org",
    nonce="<RAND>:<AUTN>:<server_specific_data>",
    algorithm=AKAv1-MD5,
    ik="<IK_hex>",
    ck="<CK_hex>"
Security-Server: ipsec-3gpp;alg=hmac-sha-1-96;prot=esp;mod=trans;
    spi-c=<chosen_client_spi>;spi-s=<chosen_server_spi>;
    port-c=<chosen_client_port>;port-s=<chosen_server_port>

flowchart TD
    K["K (ISIM/USIM根密钥, 128bit)"] --> A5G["f1~f5函数族<br/>(Milenage算法)"]
    RAND["RAND (128bit随机数)"] --> A5G
    AUTN_SQN["SQN ⊕ AK + AMF"] --> A5G

    A5G --> RES["RES (64bit)<br/>→经MD5/HMAC响应"]
    A5G --> IK["IK (128bit)<br/>完整性密钥→IPSec ESP AUTH"]
    A5G --> CK["CK (128bit)<br/>加密密钥→IPSec ESP ENC"]
    A5G --> AK["AK (64bit)<br/>用于隐藏SQN"]

    K -.-> USIM["USIM验证:<br/>AUTN中的MAC == XMAC?<br/>SQN在有效窗口?"]
    USIM -->|"验证通过"| CALC_RES["计算RES"]
    USIM -->|"验证失败"| REJ["UE返回认证失败"]

    IK --> SA["IPSec SA建立<br/>ESP transport mode<br/>alg=hmac-sha-1-96"]
    CK --> SA

REGISTER sip:ims.mnc<MNC>.mcc<MCC>.3gppnetwork.org SIP/2.0
...
Authorization: Digest username="[email protected]<MNC>.mcc<MCC>.3gppnetwork.org",
    realm="ims.mnc<MNC>.mcc<MCC>.3gppnetwork.org",
    nonce="<RAND>:<AUTN>:<server_specific_data>",
    response="<MD5(RES)>",
    algorithm=AKAv1-MD5
Security-Verify: ipsec-3gpp;alg=hmac-sha-1-96;prot=esp;mod=trans;
    spi-c=<server_chosen_spi>;spi-s=<client_chosen_spi>;
    port-c=<server_chosen_port>;port-s=<client_chosen_port>

SIP/2.0 200 OK
...
Contact: <sip:public_user@[UE_IP]:[port]>;expires=3600
Date: Mon, 02 Jun 2026 08:30:00 GMT
Service-Route: <sip:[email protected]<MNC>.mcc<MCC>.3gppnetwork.org;lr>
Path: <sip:pcscf.ims.mnc<MNC>.mcc<MCC>.3gppnetwork.org;lr>
P-Associated-URI: <sip:[email protected]<MNC>.mcc<MCC>.3gppnetwork.org>,
    <tel:+8613800138000>

flowchart LR
    subgraph "UE侧"
        UE_SPIC["spi-c<br/>(UE→P-CSCF方向SPI)"]
        UE_SPIS["spi-s<br/>(P-CSCF→UE方向SPI)"]
        UE_PORTC["port-c<br/>(UE受保护发送端口)"]
        UE_PORTS["port-s<br/>(UE受保护接收端口)"]
    end

    subgraph "P-CSCF侧"
        PS_SPIC["spi-c'<br/>(与UE spi-c配对)"]
        PS_SPIS["spi-s'<br/>(与UE spi-s配对)"]
        PS_PORTC["port-c'<br/>(P-CSCF受保护发送端口)"]
        PS_PORTS["port-s'<br/>(P-CSCF受保护接收端口)"]
    end

    UE_SPIC -.->|"Security-Client提议"| PS_SPIC
    UE_SPIS -.->|"Security-Client提议"| PS_SPIS
    PS_PORTC -.->|"Security-Server选定"| UE_PORTS
    PS_PORTS -.->|"Security-Server选定"| UE_PORTC

    subgraph "SA_1 (UE→P-CSCF)"
        SA1["SPI=spi-c<br/>Src=UE_IP:port-c<br/>Dst=P-CSCF_IP:port-s<br/>Key=IK/CK"]
    end

    subgraph "SA_2 (P-CSCF→UE)"
        SA2["SPI=spi-s<br/>Src=P-CSCF_IP:port-s<br/>Dst=UE_IP:port-c<br/>Key=IK/CK"]
    end

SMF → PCF: Npcf_SMPolicyControl_Create (DNN=IMS)
PCF → SMF: Policy + QoS Data (5QI=5, ARP)
SMF → UPF:  N4 Session Establishment (QFI=1, 5QI=5)
SMF → AMF:  N1N2MessageTransfer (QoS Flow描述)
AMF → gNB:  N2 PDU Session Resource Setup (QoS参数)
gNB → UE:   RRC Reconfiguration (DRB配置, QFI=1→5QI=5)

# 过滤SIP注册信令
sip.Method == "REGISTER" || sip.Status-Code == 401 || sip.Status-Code == 200

# 过滤IMS PDU Session
gtp.message_type == 168 && nas_5gs.dnn == "ims"

# 过滤IPSec ESP
esp.spi == 0xFF000001

# 过滤Cx Diameter
diameter.Command-Code == 300 || diameter.Command-Code == 303 || diameter.Command-Code == 301

# 查询用户IMS签约
show subscriber imsi=<IMSI> ims-profile
# 检查S-CSCF分配
show scscf-assignment public-id=<IMPU>