5G NGAP初始上下文建立（Initial Context Setup）信令全链拆解

sequenceDiagram
    participant UE
    participant gNB as gNB/NG-RAN
    participant AMF
    participant SMF

    Note over UE,AMF: 前置条件：NAS Registration + Authentication + NAS SMC已完成

    AMF->>gNB: ① NGAP: Initial Context Setup Request<br/>(AMF UE NGAP ID, RAN UE NGAP ID,<br/>GUAMI, Allowed NSSAI,<br/>UE Security Capabilities, Security Key,<br/>PDU Session Resource Setup List,<br/>NAS-PDU: Registration Accept)

    Note over gNB: gNB解析IE，创建UE Context<br/>选择加密/完整性算法

    gNB->>UE: ② RRC: SecurityModeCommand<br/>(selectedAlgorithms)

    UE->>gNB: ③ RRC: SecurityModeComplete

    Note over gNB,UE: AS层安全激活完成

    gNB->>UE: ④ RRC: RRCReconfiguration<br/>(RadioBearerConfig,<br/>MasterCellGroup,<br/>dedicatedNAS-MessageList)

    Note over gNB: 建立DRB/SRB<br/>配置CellGroup

    UE->>gNB: ⑤ RRC: RRCReconfigurationComplete

    gNB->>AMF: ⑥ NGAP: Initial Context Setup Response<br/>(AMF UE NGAP ID, RAN UE NGAP ID,<br/>PDU Session Resource Setup List CxtRes,<br/>Failed-to-Setup List [可选])

    Note over AMF,SMF: 如包含PDU Session资源<br/>AMF通知SMF建立结果

    AMF->>SMF: ⑦ Nsmf_PDUSession_UpdateSMContext<br/>(N2 SM Info: TEID, Transport Info)

graph TD
    A[Initial Context Setup Request] --> B[AMF UE NGAP ID<br/>Mandatory / Reject]
    A --> C[RAN UE NGAP ID<br/>Mandatory / Reject]
    A --> D[GUAMI<br/>Mandatory / Reject]
    A --> E[Allowed NSSAI<br/>Mandatory / Reject]
    A --> F[UE Security Capabilities<br/>Mandatory / Reject]
    A --> G[Security Key<br/>Mandatory / Reject]
    A --> H[PDU Session Resource<br/>Setup List CxtReq<br/>Optional / Reject]
    A --> I[NAS-PDU<br/>Optional / Reject]
    A --> J[UE Aggregate<br/>Maximum Bit Rate<br/>Optional / Ignore]
    A --> K[Mobility Restriction List<br/>Optional / Ignore]
    A --> L[Masked IMEISVN<br/>Optional / Ignore]
    A --> M[UESecurityCapabilities<br/>Mandatory / Reject]

    style B fill:#ff6b6b,color:#fff
    style C fill:#ff6b6b,color:#fff
    style D fill:#ff6b6b,color:#fff
    style E fill:#ff6b6b,color:#fff
    style F fill:#ff6b6b,color:#fff
    style G fill:#ff6b6b,color:#fff
    style H fill:#4ecdc4,color:#fff
    style I fill:#4ecdc4,color:#fff
    style J fill:#95e1d3,color:#333
    style K fill:#95e1d3,color:#333

graph TD
    A["K (永久密钥)<br/>USIM + UDM"] -->|"AKA/5G AKA"| B["K<sub>SEAF</sub>"]
    B -->|"KDF (TS 33.501 6.1.1.1)"| C["K<sub>AMF</sub>"]
    C -->|"KDF (TS 33.501 6.9.2)"| D["K<sub>gNB</sub>"]
    D -->|"KDF (TS 33.501 6.9.3)"| E["K<sub>RRCenc</sub><br/>K<sub>RRCint</sub><br/>K<sub>UPenc</sub><br/>K<sub>UPint</sub>"]

    style A fill:#2d3436,color:#fff
    style D fill:#ff6b6b,color:#fff
    style E fill:#4ecdc4,color:#fff

InitialContextSetupRequest ::= SEQUENCE {
    protocolIEs   ProtocolIE-Container {
        {InitialContextSetupRequest-IEs}
    },
    ...
}

InitialContextSetupRequest-IEs NGAP-PROTOCOL-IES ::= {
    { ID id-AMF-UE-NGAP-ID          CRITICALITY reject TYPE AMF-UE-NGAP-ID          PRESENCE mandatory } |
    { ID id-RAN-UE-NGAP-ID          CRITICALITY reject TYPE RAN-UE-NGAP-ID          PRESENCE mandatory } |
    { ID id-GUAMI                   CRITICALITY reject TYPE GUAMI                   PRESENCE mandatory } |
    { ID id-AllowedNSSAI            CRITICALITY reject TYPE AllowedNSSAI            PRESENCE mandatory } |
    { ID id-UESecurityCapabilities  CRITICALITY reject TYPE UESecurityCapabilities  PRESENCE mandatory } |
    { ID id-SecurityKey             CRITICALITY reject TYPE SecurityKey             PRESENCE mandatory } |
    { ID id-PDUSessionResourceSetupListCxtReq
                                    CRITICALITY reject TYPE PDUSessionResourceSetupListCxtReq
                                                                               PRESENCE optional  } |
    { ID id-NAS-PDU                 CRITICALITY reject TYPE NAS-PDU                 PRESENCE optional  } |
    { ID id-UEAggregateMaximumBitRate
                                    CRITICALITY ignore  TYPE UEAggregateMaximumBitRate
                                                                               PRESENCE optional  } |
    { ID id-MobilityRestrictionList CRITICALITY ignore  TYPE MobilityRestrictionList PRESENCE optional  } |
    { ID id-MaskedIMEISVN           CRITICALITY ignore  TYPE MaskedIMEISVN          PRESENCE optional  } |
    ...
}

NGAP-PDU
  initiatingMessage
    procedureCode: id-InitialContextSetup (15)
    criticality: reject
    value: InitialContextSetupRequest
      protocolIEs:
        id-AMF-UE-NGAP-ID: 0x000010A1 (4257)
        id-RAN-UE-NGAP-ID: 0x00000041 (65)
        id-GUAMI:
          pLMNIdentity: 00 F1 10 (MCC: 001, MNC: 01)
          aMFRegionID: 0x02
          aMFSetID: 0x155
          aMFPointer: 0x01
        id-AllowedNSSAI:
          AllowedNSSAI-Item:
            s-NSSAI:
              sST: 01 (eMBB)
              sD: 01 02 03
        id-UESecurityCapabilities:
          nRencryptionAlgorithms: 0xE000 (NEA1, NEA2, NEA3)
          nRintegrityProtectionAlgorithms: 0xE000 (NIA1, NIA2, NIA3)
          eUTROencryptionAlgorithms: 0xE000
          eUTROintegrityProtectionAlgorithms: 0xE000
        id-SecurityKey: 8F 7C A2 3D ... (256 bits / 32 bytes)
        id-PDUSessionResourceSetupListCxtReq:
          PDUSessionResourceSetupItemCxtReq:
            pDUSessionID: 10
            s-NSSAI: SST=01, SD=010203
            pDUSessionResourceSetupRequestTransfer: [Opaque]
        id-NAS-PDU:
          ProtocolDiscriminator: 5GMM (0x7E)
          SecurityHeaderType: 0x02 (Integrity Protected)
          MessageType: Registration Accept (0x42)

stateDiagram-v2
    [*] --> NG_Not_Exists: UE首次接入<br/>(无NG连接)
    NG_Not_Exists --> NG_Connected: Initial UE Message<br/>(RAN UE NGAP ID分配)

    NG_Connected --> Context_Validating: 收到Initial Context Setup Request
    Context_Validating --> Security_Activating: IE校验通过<br/>算法选择完成
    Context_Activating --> Context_Active: RRCReconfigurationComplete

    Context_Active --> Context_Active: PDU Session Resource<br/>后续建立/修改

    Context_Active --> Context_Releasing: UE Context Release Command
    Context_Releasing --> NG_Not_Exists: 资源释放完成

    Context_Validating --> Context_Failed: IE校验失败/算法不匹配
    Context_Activating --> Context_Failed: AS安全激活失败/RRC重配失败
    Context_Failed --> NG_Not_Exists: Initial Context Setup Failure<br/>或UE Context Release Request

# 过滤所有Initial Context Setup消息
ngap.procedureCode == 15

# 仅过滤Request
ngap.procedureCode == 15 && ngap.initiatingMessage

# 仅过滤Response
ngap.procedureCode == 15 && ngap.successfulOutcome

# 仅过滤Failure
ngap.procedureCode == 15 && ngap.unsuccessfulOutcome

# 检查特定AMF UE NGAP ID
ngap.procedureCode == 15 && ngap.amf_ue_ngap_id == 4257

# 提取Initial Context Setup Request中的关键IE
tshark -r trace.pcap -Y "ngap.procedureCode==15 && ngap.initiatingMessage" \
  -T fields \
  -e ngap.amf_ue_ngap_id \
  -e ngap.ran_ue_ngap_id \
  -e ngap.GUAMI \
  -e ngap.AllowedNSSAI \
  -e ngap.SecurityKey

# 统计Initial Context Setup成功/失败比例
tshark -r trace.pcap -Y "ngap.procedureCode==15" \
  -T fields -e ngap.message_type | sort | uniq -c

现象：Initial Context Setup Failure
Cause: encryption-and-or-integrity-protection-algorithms-not-supported

现象：Initial Context Setup Response中包含Failed-to-Setup List
（UE Context本身成功，但部分PDU会话资源建立失败）

现象：gNB发出SecurityModeCommand后收到SecurityModeFailure
→ 随后gNB发送UE Context Release Request