5G SEPP N32跨域安全互通与PRINS加密保护信令拆解

graph TB
    subgraph VPLMN["Visited PLMN (VPLMN)"]
        V_AMF[AMF]
        V_SMF[SMF]
        vSEPP[vSEPP]
        V_AMF -->|SBI| vSEPP
        V_SMF -->|SBI| vSEPP
    end

    subgraph IPX["IPX Transit Network"]
        IPX1[IPX Provider 1]
        IPX2[IPX Provider 2]
        IPX1 -.->|TLS hop-by-hop| IPX2
    end

    subgraph HPLMN["Home PLMN (HPLMN)"]
        H_UDM[UDM]
        H_AUSF[AUSF]
        hSEPP[hSEPP]
        hSEPP -->|SBI| H_UDM
        hSEPP -->|SBI| H_AUSF
    end

    vSEPP <==>|N32-c<br/>Security Context<br/>Establishment| hSEPP
    vSEPP --> IPX1
    IPX2 --> hSEPP
    IPX1 -.->|N32-f<br/>Protected Messages| IPX2

    style vSEPP fill:#e74c3c,color:#fff
    style hSEPP fill:#2980b9,color:#fff
    style IPX1 fill:#95a5a6,color:#fff
    style IPX2 fill:#95a5a6,color:#fff

sequenceDiagram
    participant vSEPP as vSEPP (VPLMN)
    participant hSEPP as hSEPP (HPLMN)

    Note over vSEPP,hSEPP: Phase 1: TLS Mutual Authentication
    vSEPP->>hSEPP: TLS ClientHello (SNI: hSEPP FQDN)
    hSEPP->>vSEPP: TLS ServerHello + Certificate
    vSEPP->>hSEPP: TLS Certificate + CertificateVerify
    hSEPP->>vSEPP: TLS Finished
    Note over vSEPP,hSEPP: mTLS隧道建立完成

    Note over vSEPP,hSEPP: Phase 2: Application Layer - N32-c Parameter Exchange
    vSEPP->>hSEPP: ExchangeApplicationData REQUEST<br/>SecurityPolicyRequest<br/>{3gpp-Sbi-Sender-Plmn, supportedSecCapabilities,<br/>n32Policies, vSEPP FQDN}

    hSEPP->>vSEPP: ExchangeApplicationData RESPONSE<br/>SecurityPolicyResponse<br/>{selectedSecCapability,<br/>n32Policies, hSEPP FQDN,<br/>SecurityContext ID}

    Note over vSEPP,hSEPP: Phase 3: Key Derivation (Local)
    Note right of vSEPP: KDF(TLS-Exporter Secret,<br/>N32-Context-Info) →<br/>N32-Forwarding-Key
    Note right of hSEPP: KDF(TLS-Exporter Secret,<br/>N32-Context-Info) →<br/>N32-Forwarding-Key

    Note over vSEPP,hSEPP: 安全上下文建立完成，N32-f通道就绪

N32-Forwarding-Key = KDF(
    TLS-Exporter-Secret,
    "N32 Forwarding Key",
    N32-Context-Info,
    key_length
)

sequenceDiagram
    participant NF_A as VPLMN NF<br/>(e.g. AMF)
    participant vSEPP as vSEPP
    participant IPX as IPX Provider
    participant hSEPP as hSEPP
    participant NF_B as HPLMN NF<br/>(e.g. UDM)

    NF_A->>vSEPP: HTTP/2 Request<br/>原始JSON (含SUPI等敏感字段)

    Note over vSEPP: Step 1: 头部替换<br/>保存原始Target-apiRoot<br/>替换为hSEPP地址
    Note over vSEPP: Step 2: 选择性加密<br/>按Data-type加密策略<br/>将敏感字段移入_encryptedDataArray
    Note over vSEPP: Step 3: 完整性保护<br/>对整个修改后的消息体<br/>计算IntegrityProtection MAC

    vSEPP->>IPX: N32-f Protected Request<br/>{modified headers,<br/>_encryptedDataArray,<br/>integrityProtection}
    Note over IPX: IPX仅能读取非加密头<br/>用于路由转发<br/>无法读取敏感内容

    IPX->>hSEPP: N32-f Protected Request

    Note over hSEPP: Step 4: 完整性验证<br/>使用N32-Integrity-Key<br/>验证MAC
    Note over hSEPP: Step 5: 解密敏感字段<br/>使用N32-Encryption-Key<br/>解密_encryptedDataArray
    Note over hSEPP: Step 6: 头部还原<br/>恢复原始Target-apiRoot<br/>指向目的NF

    hSEPP->>NF_B: HTTP/2 Request<br/>还原后的完整JSON
    NF_B->>hSEPP: HTTP/2 Response
    hSEPP->>vSEPP: N32-f Protected Response
    vSEPP->>NF_A: HTTP/2 Response (unprotected)

{
  "supi": "imsi-460001234567890",
  "plmnId": {"mcc": "460", "mnc": "00"},
  "ueId": "imsi-460001234567890",
  "supportedFeatures": "ffffff",
  "accessType": "3GPP_ACCESS"
}

{
  "_encryptedDataArray": [
    "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0..base64IV.base64Ciphertext.base64Tag"
  ],
  "plmnId": {"mcc": "460", "mnc": "00"},
  "supportedFeatures": "ffffff",
  "accessType": "3GPP_ACCESS",
  "integrityProtection": {
    "securityContextId": "ctx-2026-001",
    "macValue": "base64EncodedMAC"
  }
}

graph LR
    subgraph Original["原始JSON消息"]
        A1["supi: imsi-460..."]
        A2["plmnId: {mcc:460}"]
        A3["ueId: imsi-460..."]
        A4["accessType: 3GPP"]
    end

    subgraph Classification["字段分类"]
        B1["敏感字段"]:::sensitive
        B2["非敏感字段"]:::nonsensitive
    end

    subgraph Protected["保护后消息"]
        C1["_encryptedDataArray:<br/>JWE(supi+ueId)"]:::encrypted
        C2["plmnId: {mcc:460}"]
        C3["accessType: 3GPP"]
        C4["integrityProtection:<br/>MAC(whole body)"]:::mac
    end

    A1 --> B1
    A3 --> B1
    A2 --> B2
    A4 --> B2
    B1 --> C1
    B2 --> C2
    B2 --> C3
    B1 -.->|完整性覆盖全部| C4
    B2 -.->|完整性覆盖全部| C4

    classDef sensitive fill:#e74c3c,color:#fff
    classDef nonsensitive fill:#27ae60,color:#fff
    classDef encrypted fill:#8e44ad,color:#fff
    classDef mac fill:#f39c12,color:#fff

stateDiagram-v2
    [*] --> Init: SEPP启动
    Init --> TLS_Establishing: 发起/接收N32-c连接
    TLS_Establishing --> ParamNegotiating: mTLS认证成功
    TLS_Establishing --> Failed: TLS握手失败
    ParamNegotiating --> Active: 安全参数协商成功<br/>密钥派生完成
    ParamNegotiating --> Failed: 策略不兼容
    Active --> Active: N32-f消息收发<br/>(protect/unprotect)
    Active --> KeyRekeying: 密钥有效期将至
    KeyRekeying --> Active: 密钥更新成功
    KeyRekeying --> Terminating: 更新失败
    Active --> Terminating: 连接关闭/错误
    Failed --> [*]
    Terminating --> [*]