5G SUCI隐私保护与ECIES双Profile公钥加密方案信令拆解

graph TB
    subgraph "4G EPS - IMSI暴露"
        UE4[UE] -->|IMSI 明文| ENB4[eNodeB]
        ENB4 -->|IMSI 明文| MME4[MME]
        ATK[伪基站/IMSI Catcher] -.->|被动监听IMSI| UE4
    end

    subgraph "5GS - SUCI保护"
        UE5[UE/USIM] -->|SUCI 加密| GNB5[gNB]
        GNB5 -->|SUCI 加密| AMF5[AMF]
        AMF5 -->|SUCI 加密| SIDF5[UDM/SIDF]
        SIDF5 -->|解密获得SUPI| SIDF5
        ATK5[攻击者] -.->|仅见密文| UE5
    end

    style ATK fill:#ff6b6b,color:#fff
    style ATK5 fill:#51cf66,color:#fff

SUCI = <SUPI Type> <MCC> <MNC> <Routing Indicator> <Protection Scheme ID> <Home Network Public Key ID> <Scheme Output>

flowchart TB
    subgraph "Phase 1: 密钥协商"
        A1["USIM读取归属网静态公钥 PK_HN<br/>(预置在USIM中)"]
        A2["UE生成临时密钥对 (sk_E, pk_E)<br/>Curve25519"]
        A3["计算共享密钥<br/>EK = X25519(sk_E, PK_HN)"]
        A1 --> A2 --> A3
    end

    subgraph "Phase 2: 密钥推衍"
        B1["输入: EK (共享密钥)"]
        B2["KDF: HKDF-SHA-256<br/>FC = 0x6B (SUCI Profile A)"]
        B3["输出: Enc Key (16B) + MAC Key (32B)"]
        B1 --> B2 --> B3
    end

    subgraph "Phase 3: 加密MSIN"
        C1["明文: MSIN (SUPI的用户标识部分)"]
        C2["AES-128-CTR 加密<br/>Key = Enc Key"]
        C3["密文: Encrypted MSIN"]
        C1 --> C2 --> C3
    end

    subgraph "Phase 4: 完整性保护"
        D1["输入: pk_E || Encrypted MSIN"]
        D2["HMAC-SHA-256<br/>Key = MAC Key"]
        D3["MAC Tag (截断至16 bytes)"]
        D1 --> D2 --> D3
    end

    A3 --> B1
    B3 --> C2
    B3 --> D2

    subgraph "最终输出: Scheme Output"
        E["pk_E (32B) || Encrypted MSIN || MAC Tag (16B)"]
    end

    C3 --> E
    D3 --> E

KDF输入参数：
  FC = 0x6B (Profile A) / 0x6C (Profile B)
  P0 = EK (共享密钥, 32 bytes)
  L0 = length(P0)
  P1 = || (空, 无附加参数)
  L1 = 0

KDF输出：
  Key = SHA-256(EK || FC || L0 || P0 || L1 || P1)

  从输出中截取：
  - Enc Key = Key[0:16]     (16 bytes, AES-128密钥)
  - MAC Key = Key[16:48]    (32 bytes, HMAC密钥)

sequenceDiagram
    participant UE as UE/USIM
    participant gNB as gNB
    participant AMF as AMF<br/>(Visited Network)
    participant AUSF as AUSF
    participant UDM as UDM/SIDF
    participant ARPF as ARPF

    Note over UE: 1. 构造SUCI
    UE->>UE: a) 读取USIM中的归属网公钥 PK_HN<br/>和Protection Scheme ID
    UE->>UE: b) 生成临时密钥对 (sk_E, pk_E)
    UE->>UE: c) ECDH/X25519协商共享密钥 EK
    UE->>UE: d) KDF推衍 Enc Key + MAC Key
    UE->>UE: e) AES-128-CTR加密MSIN
    UE->>UE: f) HMAC-SHA-256计算MAC Tag
    UE->>UE: g) 组装SUCI = SUPI Type + MCC/MNC<br/>+ Routing Indicator + Scheme ID<br/>+ PK ID + Scheme Output

    rect rgb(230, 245, 255)
    Note over UE,gNB: 2. Registration Request (NAS)
    UE->>gNB: RRC: RRCSetupRequest<br/>含5G-S-TMSI或random value
    UE->>gNB: RRC: ULInformationTransfer<br/>携带NAS Registration Request
    Note over UE,gNB: NAS消息中 <mobile identity> = SUCI<br/>(非明文SUPI!)
    end

    gNB->>AMF: N2: Initial UE Message<br/>含Registration Request (SUCI)

    Note over AMF: 3. AMF路由决策
    AMF->>AMF: 解析SUCI中的MCC/MNC<br/>+ Routing Indicator<br/>确定归属网UDM地址

    AMF->>AUSF: Nausf_UEAuthentication<br/>Authenticate Request<br/>(含SUCI, SN-Name)
    AUSF->>UDM: Nudm_UEAuthentication<br/>Get Request (SUCI, SN-Name)

    rect rgb(255, 240, 230)
    Note over UDM,ARPF: 4. SIDF解密SUCI (TS 33.501 §6.12.5)
    UDM->>UDM: a) 根据Scheme ID和PK ID<br/>查找对应的私钥 sk_HN
    UDM->>UDM: b) 从Scheme Output提取<br/>临时公钥 pk_E
    UDM->>UDM: c) ECDH/X25519(sk_HN, pk_E)<br/>计算共享密钥 EK'
    UDM->>UDM: d) KDF推衍 Enc Key' + MAC Key'
    UDM->>UDM: e) 验证MAC Tag<br/>(HMAC-SHA-256)
    UDM->>UDM: f) MAC验证通过后<br/>AES-128-CTR解密MSIN
    UDM->>UDM: g) 恢复完整SUPI
    end

    UDM->>ARPF: 用SUPI查找用户订阅数据<br/>获取K/OPc等认证凭据
    ARPF->>UDM: 生成5G-AKA认证向量<br/>(RAND, AUTN, XRES*, KAUSF)

    UDM->>AUSF: Nudm_UEAuthentication<br/>Get Response (SUPI, AV)
    Note over UDM,AUSF: 此时SIDF已完成SUCI→SUPI解密<br/>后续流程使用SUPI而非SUCI
    AUSF->>AMF: Nausf_UEAuthentication<br/>Authenticate Response<br/>(RAND, AUTN, HXRES*)

    AMF->>UE: DL NAS: Authentication Request<br/>(RAND, AUTN)
    UE->>UE: USIM验证AUTN<br/>计算RES*
    UE->>AMF: UL NAS: Authentication Response<br/>(RES*)

    AMF->>AUSF: Nausf_UEAuthentication<br/>Authenticate Complete (RES*)
    AUSF->>AUSF: 验证 RES* == XRES*
    AUSF->>AMF: 认证成功 + KSEAF

    AMF->>UE: DL NAS: Security Mode Command<br/>建立NAS安全上下文
    UE->>AMF: UL NAS: Security Mode Complete

    Note over AMF,UE: 后续所有NAS消息均受加密和完整性保护<br/>UE获得5G-GUTI替代SUCI用于后续注册
    AMF->>UE: DL NAS: Registration Accept<br/>(含5G-GUTI)

stateDiagram-v2
    [*] --> InitialRegistration: UE开机/失联

    state "标识选择决策" as Decision {
        InitialRegistration --> HasValidGUTI: 检查5G-GUTI
        HasValidGUTI --> UseGUTI: 5G-GUTI有效
        HasValidGUTI --> CheckSUCI: 5G-GUTI无效/过期
        CheckSUCI --> UseSUCI: USIM有公钥
        CheckSUCI --> UseNullSUCI: USIM无公钥
        UseSUCI --> RegistrationWithECIES: ECIES加密
        UseNullSUCI --> RegistrationWithNull: Null Scheme
        UseGUTI --> RegistrationWithGUTI: 明文GUTI
    }

    RegistrationWithECIES --> AuthSuccess: 5G-AKA认证成功
    RegistrationWithNull --> AuthSuccess
    RegistrationWithGUTI --> AuthSuccess
    RegistrationWithGUTI --> GUTIFailed: AMF找不到GUTI
    GUTIFailed --> UseSUCI: Identity Request→SUCI响应

    AuthSuccess --> AssignedGUTI: 获得新5G-GUTI
    AssignedGUTI --> SubsequentRegistration: 后续注册

    SubsequentRegistration --> HasValidGUTI

# 查看所有携带SUCI的NAS Registration消息
nas_5gs.reg.message_type == 0x41 && nas_5gs.mobile_identity.type_of_identity == 1

# 查看使用Null Scheme的注册（安全风险）
nas_5gs.reg.protection_scheme_id == 0

UDM/SIDF: SUCI deconcealment failed - MAC verification failure
  Protection Scheme: Profile A (Curve25519)
  Home Network PK ID: 0x03
  Error: No matching private key found for PK ID 0x03