5G初始注册完整信令流拆解：从RRC到NAS的20步全链路解析

sequenceDiagram
    participant UE
    participant gNB as gNB(NG-RAN)
    participant AMF
    participant AUSF
    participant UDM
    participant SNSSAI as NSSF

    Note over UE,gNB: 阶段1: RRC连接建立
    UE->>gNB: 1. RRC Setup Request (Random Access)
    gNB->>UE: 2. RRC Setup
    UE->>gNB: 3. RRC Setup Complete (携带NAS: Registration Request)

    Note over gNB,AMF: 阶段2: NGAP Initial UE Message + AMF选择
    gNB->>AMF: 4. NGAP Initial UE Message(NAS-PDU=Registration Request, RAN UE NGAP ID, UserLocationInformation, RRC Establishment Cause)

    Note over AMF,AMF: 5. AMF执行Initial AMF Selection(基于GUAMI/SUCI/PLMN)
    AMF->>AMF: 6. 检查UE Context是否存在(5G-GUTI)

    alt UE Context不存在 或 需要Identity
        AMF-->>UE: 7. NAS: Identity Request(SUCI类型)
        UE-->>AMF: 8. NAS: Identity Response(SUCI=加密后的SUPI)
    end

    Note over AMF,AUSF: 阶段3: 5G-AKA主认证
    AMF->>AUSF: 9. Nausf_UEAuthentication Authenticate(SUPI, SNN)
    AUSF->>UDM: 10. Nudm_UEAuthentication Get(Authentication Vector)
    UDM->>UDM: 11. 生成AV(RAND, AUTN, XRES*, KAUSF)
    UDM-->>AUSF: 12. 返回5G HE AV
    AUSF->>AUSF: 13. 计算HXRES*和KSEAF
    AUSF-->>AMF: 14. 返回5G AV(RAND, AUTN, HXRES*)

    AMF-->>UE: 15. NAS: Authentication Request(RAND, AUTN, ngKSI)
    UE->>UE: 16. UE验证AUTN, 计算RES*
    UE-->>AMF: 17. NAS: Authentication Response(RES*)

    AMF->>AMF: 18. 比较HXRES*与H(RES*)

    Note over AMF,UE: 阶段4: NAS安全模式控制
    AMF-->>UE: 19. NAS: Security Mode Command(Selected Security Algorithm, ngKSI, ReplayComplete)
    UE-->>AMF: 20. NAS: Security Mode Complete(IMEISV)

    Note over AMF,NSSAI: 阶段5: 切片选择 + UDM注册
    AMF->>SNSSAI: 21. Nnssf_NSSelection Get(Requested NSSAI, TA)
    SNSSAI-->>AMF: 22. Allowed NSSAI + Configured NSSAI
    AMF->>UDM: 23. Nudm_UECM_Registration(Registration Type, Access Type)
    UDM-->>AMF: 24. 返回Subscription Data(AccessAndMobilitySubscriptionData)

    Note over gNB,UE: 阶段6: NGAP上下文建立 + Registration Accept
    AMF->>gNB: 25. NGAP Initial Context Setup Request(AMF UE NGAP ID, NAS-PDU=Registration Accept, Security Key, UE Aggregate Max Bit Rate)
    gNB->>UE: 26. RRC Reconfiguration(AS Security激活 + NAS: Registration Accept)
    UE-->>gNB: 27. RRC Reconfiguration Complete
    gNB-->>AMF: 28. NGAP Initial Context Setup Response
    UE->>gNB: 29. NAS: Registration Complete(UL NAS Transport)
    gNB->>AMF: 30. NGAP Uplink NAS Transport(NAS-PDU=Registration Complete)

flowchart TD
    A[NGAP Initial UE Message到达gNB] --> B{5G-GUTI中GUAMI有效?}
    B -->|是| C[基于GUAMI路由到对应AMF]
    B -->|否| D{gNB配置了AMF Set?}
    D -->|是| E[从AMF Set中选择负载最低的AMF]
    D -->|否| F[基于Selected PLMN + S-NSSAI选择Default AMF]
    C --> G[转发NAS-PDU至目标AMF]
    E --> G
    F --> G
    G --> H{AMF接受?}
    H -->|是| I[正常处理Registration]
    H -->|否: Overload/Unavailable| J[NGAP Reroute NAS Message至备用AMF]

SUCI: 0-460-00-0-<encrypted_payload>
        ↑  ↑    ↑ ↑        ↑
        |  |    | |    ECIES加密的MSIN
        |  |    | 保护方案(0=空方案,1=Profile A,2=Profile B)
        |  |    路由指示(可用于AUSF路由)
        |  PLMN(460-00=CMCC)
        SUPI类型(0=IMSI, 1=NAI, 2=GMSI...)

flowchart TD
    A[UE收到RAND+AUTN+ngKSI] --> B[从USIM读取K]
    B --> C[计算AK=f5_K RAND]
    C --> D[恢复SQN = AUTN中SQN⊕AK ⊕ AK]
    D --> E[计算XMAC = f1_K SQN, RAND, AMF]
    E --> F{XMAC == AUTN中MAC?}
    F -->|否| G[返回Authentication Failure#cause=MAC Failure]
    F -->|是| H{SQN在有效窗口内?}
    H -->|否| I[返回Authentication Failure#cause=SYNC Failure,携带AUTS]
    H -->|是| J[计算RES*=KDF XRES, SNN]
    J --> K[返回Authentication Response携带RES*]

K (USIM/UDM共享根密钥)
├── CK, IK (认证向量分量)
    ├── KAUSF = KDF(CK||IK, SNN||SQN⊕AK)         [UDM→AUSF]
        ├── KSEAF = KDF(KAUSF, SNN)                [AUSF→SEAF(AMF)]
            ├── KAMF = KDF(KSEAF, SUPi||ABBA)      [AMF锚点密钥]
                ├── KNASenc = KDF(KAMF, NAS-enc-algo)
                ├── KNASint = KDF(KAMF, NAS-int-algo)
                ├── KgNB = KDF(KAMF, access-type)   [AS层锚点]
                    ├── KRRCenc = KDF(KgNB, RRC-enc-algo)
                    ├── KRRCint = KDF(KgNB, RRC-int-algo)
                    ├── KUPenc = KDF(KgNB, UP-enc-algo)
                    └── KUPint = KDF(KgNB, UP-int-algo)

stateDiagram-v2
    [*] --> Requested: UE携带Requested NSSAI
    Requested --> Allowed: NSSF匹配成功
    Requested --> Rejected: 切片未订阅或TA不支持
    Requested --> Configured: 需要UE更新Configured NSSAI
    Allowed --> HomeRouted: S-NSSAI需Home路由
    Configured --> Requested: UE重新发起Registration
    Rejected --> Requested: UE修改Requested NSSAI

graph TD
    subgraph "Registration Request NAS消息结构"
        A["Protocol Discriminator (5GMM) = 0x7E<br/>4 bit"] --> B["Security Header Type = 0x00<br/>4 bit"]
        B --> C["Message Type = 0x41 (Registration Request)<br/>1 octet"]
        C --> D["5GS Registration Type<br/>1 octet"]
        D --> E["Mobile Identity (SUCI/GUTI)<br/>可变长度"]
        E --> F["Optional IEs..."]
    end

    subgraph "5GS Registration Type (1 octet)"
        D1["bit 4: Follow-on request pending<br/>bit 3-1: Registration Type<br/>000=Initial, 001=Mobility, 010=Periodic, 011=Emergency"]
    end

    subgraph "Optional IEs (按O/T/V排列)"
        F1["5G-GUTI (Type 5G-GUTI)<br/>5GS Tracking Area Identity<br/>5GS DRX Parameters<br/>5GMM Capability<br/>UE Security Capability<br/>Requested NSSAI<br/>Last Visited Registered TAI<br/>UE Usage Setting<br/>Update Type<br/>MICO Indication<br/>UE Status<br/>EPS NAS Message Container<br/>Payload Container"]
    end

    D --> D1
    F --> F1

# 过滤NAS Registration消息
nas-5gs.message_type == 0x41  # Registration Request
nas-5gs.message_type == 0x42  # Registration Accept
nas-5gs.message_type == 0x43  # Registration Complete

# 过滤NGAP Initial UE Message
ngap.procedureCode == 15  # Initial UE Message
ngap.procedureCode == 15 && ngap.BearerType == "nas-pdu"  # 含NAS-PDU

# 过滤完整认证流程
nas-5gs.message_type == 0x52  # Authentication Request
nas-5gs.message_type == 0x53  # Authentication Response
nas-5gs.message_type == 0x5c  # Security Mode Command
nas-5gs.message_type == 0x5d  # Security Mode Complete

stateDiagram-v2
    [*] --> RM_DEREGISTERED: UE开机
    RM_DEREGISTERED --> RM_REGISTERED: Registration Accept
    RM_REGISTERED --> RM_REGISTERED: Mobility/Periodic Update
    RM_REGISTERED --> RM_DEREGISTERED: Deregistration
    RM_REGISTERED --> RM_DEREGISTERED: Implicit Deregistration(T3502超时)

    state RM_DEREGISTERED {
        [*] --> PLMN_SEARCH
        PLMN_SEARCH --> CELL_SELECTION
        CELL_SELECTION --> RRC_CONNECTING
        RRC_CONNECTING --> NAS_REGISTERING
    }

    state RM_REGISTERED {
        [*] --> CM_IDLE
        CM_IDLE --> CM_CONNECTED: Service Request/RAN Paging
        CM_CONNECTED --> CM_IDLE: RRC Release/UE Context Release
        CM_IDLE --> CM_IDLE: Periodic Registration(T3512)
        CM_IDLE --> CM_IDLE: Mobility Registration(TAI变化)
    }

    state CM_CONNECTED {
        [*] --> ACTIVE
        ACTIVE --> INACTIVE: RRC Inactive(挂起)
        INACTIVE --> ACTIVE: Resume
    }