5G AKA主认证与密钥推演全链拆解：从SUCI解密到KAMF生成的逐IE深度解析

sequenceDiagram
    participant UE as UE/USIM
    participant SEAF as SEAF(AMF)
    participant AUSF as AUSF
    participant UDM as UDM/ARPF/SIDF

    Note over UE,UDM: 阶段0: 注册请求触发
    UE->>SEAF: Registration Request<br/>SUCI或5G-GUTI + SNN

    Note over SEAF,UDM: 阶段1: 认证向量请求
    SEAF->>AUSF: Nausf_UEAuthentication Authenticate Request<br/>SUCI(或SUPI) + SNN(Serving Network Name)
    AUSF->>UDM: Nudm_UEAuthentication Get Request<br/>SUCI + SNN

    Note over UDM: 阶段2: SIDF解密SUCI→SUPI
    Note over UDM: ARPF生成5G HE AV<br/>K,Milenage算法→CK,IK,RAND,AUTN<br/>KDF(CK||IK,...)→KAUSF<br/>KDF(KAUSF,...)→KSEAF<br/>KDF(CK||IK,...)→XRES*

    UDM->>AUSF: 5G HE AV[RAND, AUTN, XRES*, KAUSF]

    Note over AUSF: 阶段3: AUSF构造5G AV
    Note over AUSF: 计算HXRES*=SHA-256(XRES*)<br/>推演KSEAF=KDF(KAUSF,FC=0x6C,SNN)

    AUSF->>SEAF: 5G AV[RAND, AUTN, HXRES*]

    Note over SEAF,UE: 阶段4: NAS认证挑战
    SEAF->>UE: Authentication Request<br/>RAND + AUTN + ngKSI

    Note over UE: 阶段5: UE侧认证计算
    Note over UE: USIM验证AUTN(MAC=XMAC?)<br/>验证SQN范围<br/>计算RES*<br/>KDF(CK||IK,...)→KAUSF→KSEAF

    UE->>SEAF: Authentication Response<br/>RES*

    Note over SEAF: 阶段6: SEAF初步验证
    Note over SEAF: 计算HRES*=SHA-256(RES*)<br/>比较HRES*==HXRES*?

    SEAF->>AUSF: Nausf_UEAuthentication Authenticate Request<br/>RES*(完整值)

    Note over AUSF: 阶段7: AUSF最终验证
    Note over AUSF: 比较RES*==XRES*?<br/>认证成功→存储KSEAF

    AUSF->>SEAF: Nausf_UEAuthentication Authenticate Response<br/>Result=SUCCESS + KSEAF + SUPI

    Note over SEAF: 阶段8: 推演KAMF
    Note over SEAF: KAMF=KDF(KSEAF,FC=0x6D,SUPI,ABBA)

    SEAF->>UE: Security Mode Command<br/>选定的NAS安全算法 + ngKSI
    UE->>SEAF: Security Mode Complete<br/>(NAS安全激活)

flowchart TD
    K[长期共享密钥 K<br/>128/256-bit] --> M[Milenage算法集<br/>f1~f5函数]
    RAND[RAND<br/>128-bit随机数] --> M

    M --> CK[CK Cipher Key<br/>128-bit]
    M --> IK[IK Integrity Key<br/>128-bit]
    M --> AK[AK Anonymity Key<br/>48-bit]
    M --> SQN[SQN Sequence Number]
    M --> MAC_A[MAC-A<br/>64-bit消息认证码]

    SQN --> AUTN_GEN[AUTN生成]
    AK --> AUTN_GEN
    MAC_A --> AUTN_GEN
AUTN_GEN --> AUTN[AUTN Authentication Token<br/>SQN⊕AK --> |AMF| MAC-A<br/>共128-bit]

    CK --> CONCAT[CK || IK<br/>256-bit]
    IK --> CONCAT

    CONCAT --> KDF_KAUSF["KDF(CK||IK, FC=0x6A)<br/>P0=SNN, P1=SQN⊕AK"]
    KDF_KAUSF --> KAUSF["KAUSF<br/>256-bit"]

    KAUSF --> KDF_KSEAF["KDF(KAUSF, FC=0x6C)<br/>P0=SNN"]
    KDF_KSEAF --> KSEAF["KSEAF<br/>256-bit"]

    CONCAT --> KDF_XRES["KDF(CK||IK, FC=0x6B)<br/>P0=SNN, P1=RAND, P2=RES"]
    KDF_XRES --> XRES_STAR["XRES*<br/>可变长度"]

    style K fill:#f9d5d5,stroke:#c0392b
    style AUTN fill:#d5e8f9,stroke:#2980b9
    style KSEAF fill:#d5f9e8,stroke:#27ae60
    style KAUSF fill:#f9f0d5,stroke:#f39c12

AUTN (128 bits total):
┌─────────────────┬──────────┬──────────────────────────────┐
│   SQN ⊕ AK      │   AMF    │         MAC-A                │
│    (48 bits)     │ (16 bits)│        (64 bits)              │
└─────────────────┴──────────┴──────────────────────────────┘
  字节0-5            字节6-7     字节8-15

SQN ⊕ AK: 序列号与匿名密钥的异或值，UE通过AK还原SQN
AMF: Authentication Management Field，包含分离指示符
MAC-A: 基于K和RAND计算的消息认证码，f1(K, RAND, SQN, AMF)

Derived Key = HMAC-SHA-256(Key, FC || P0 || L0 || P1 || L1 || ... || Pn || Ln)

flowchart TD
    subgraph USIM_UDM["USIM / UDM (共享K)"]
        K["K<br/>永久密钥"] --> Milenage
        RAND2["RAND"] --> Milenage
        Milenage["Milenage<br/>f1~f5"] --> CK_IK["CK || IK"]
    end

    subgraph ARPF_KDF["ARPF密钥推演"]
        CK_IK -->|"FC=0x6A<br/>P0=SNN, P1=SQN⊕AK"| KAUSF["KAUSF"]
        CK_IK -->|"FC=0x6B<br/>P0=SNN, P1=RAND, P2=RES"| XRES2["XRES*"]
        KAUSF -->|"FC=0x6C<br/>P0=SNN"| KSEAF["KSEAF"]
    end

    subgraph AMF_KDF["AMF(SEAF)密钥推演"]
        KSEAF -->|"FC=0x6D<br/>P0=SUPI, P1=ABBA"| KAMF["KAMF"]
        KAMF -->|"FC=0x6E<br/>P0=UL NAS COUNT, P1=AccessType"| KgNB["KgNB"]
        KAMF -->|"FC=0x69<br/>P0=算法类型+算法ID"| KNAS["KNASint / KNASenc"]
    end

    subgraph GNB_KDF["gNB密钥推演"]
        KgNB -->|"FC=0x6F"| KRRC["KRRCint / KRRCenc"]
        KgNB -->|"FC=0x70"| KUP["KUPint / KUPenc"]
    end

    style K fill:#f9d5d5,stroke:#c0392b
    style KSEAF fill:#d5f9e8,stroke:#27ae60
    style KAMF fill:#d5e8f9,stroke:#2980b9
    style KgNB fill:#f9f0d5,stroke:#f39c12

flowchart LR
    subgraph FiveG_AKA["5G-AKA (3GPP接入)"]
        direction TB
        F1["Authentication Request<br/>RAND+AUTN+ngKSI"] --> F2["Authentication Response<br/>RES*"]
        F2 --> F3["(隐式确认)<br/>Security Mode Command"]
    end

    subgraph EAP_AKAP["EAP-AKA' (非3GPP接入)"]
        direction TB
        E1["EAP-Request/AKA'-Challenge<br/>RAND+AUTN+AT_KDF+MAC"] --> E2["EAP-Response/AKA'-Challenge<br/>RES*+MAC"]
        E2 --> E3["EAP-Success<br/>(显式确认)"]
        E3 --> E4["Security Mode Command"]
    end

    style F3 fill:#f9d5d5,stroke:#c0392b
    style E3 fill:#d5f9e8,stroke:#27ae60

HXRES* = SHA-256(XRES*)[0:128]  — 由AUSF计算，发送给SEAF
HRES*  = SHA-256(RES*)[0:128]   — 由SEAF在收到UE响应后计算

判断条件：HRES* == HXRES* ?

stateDiagram-v2
    [*] --> WAIT_AUTH: Registration Request received
    WAIT_AUTH --> WAIT_RES: Authentication Request sent<br/>(RAND+AUTN+ngKSI)

    WAIT_RES --> SEAF_VERIFY: Authentication Response<br/>RES* received

    SEAF_VERIFY --> AUSF_VERIFY: HRES*==HXRES* ✓<br/>(初步验证通过)
    SEAF_VERIFY --> AUTH_FAIL: HRES*!=HXRES* ✗<br/>(初步验证失败)

    AUSF_VERIFY --> AUTH_SUCCESS: RES*==XRES* ✓<br/>(AUSF最终验证通过)
    AUSF_VERIFY --> AUTH_FAIL: RES*!=XRES* ✗<br/>(AUSF最终验证失败)

    AUTH_SUCCESS --> SMC_SENT: KSEAF+SUPI received<br/>KAMF推演完成<br/>Security Mode Command sent
    SMC_SENT --> SECURITY_ACTIVE: Security Mode Complete<br/>NAS安全激活

    AUTH_FAIL --> WAIT_AUTH: 可能重试<br/>(新认证向量)
    SECURITY_ACTIVE --> [*]

SUCI = SUPI Type (4bit) | MCC (3 digits) | MNC (2~3 digits) | 
       Routing Indicator (1~4 digits) | 
       Protection Scheme ID (4bit) | 
       Home Network Public Key ID (8bit) | 
       Scheme Output (可变长度)