5G NSSAA切片特定认证与授权全信令流深度拆解

graph TB
    UE["UE<br/>持有切片凭证"]
    AMF["AMF<br/>EAP Authenticator角色<br/>触发NSSAA"]
    NSSAAF["NSSAAF<br/>EAP代理/中继<br/>协议转换"]
    AAA_P["AAA-P<br/>PLMN侧AAA代理"]
    AAA_S["AAA-S<br/>切片方AAA服务器<br/>(可能第三方)"]
    UDM["UDM<br/>签约数据<br/>NSSAA指示"]
    NSSF["NSSF<br/>切片选择"]

    UE -->|"N1 NAS<br/>(EAP容器)"| AMF
    AMF -->|"Nnssaaf_NSSAA<br/>_Authenticate"| NSSAAF
    NSSAAF -->|"SWa/STa<br/>(RADIUS/Diameter)"| AAA_P
    AAA_P -->|"外部接口"| AAA_S
    AMF -->|"Nudm_SDM_Get"| UDM
    AMF -->|"Nnssf_NSSelection"| NSSF

    style NSSAAF fill:#e1f5fe
    style AAA_S fill:#fff3e0
    style UE fill:#e8f5e9

条件1: UDM签约数据中该S-NSSAI标记了 "NSSAA Required"
条件2: 该S-NSSAI不在当前Allowed NSSAI中（尚未通过NSSAA）
条件3: 该S-NSSAI不在Pending NSSAI中（未正在进行NSSAA）

sequenceDiagram
    participant UE
    participant RAN
    participant AMF
    participant UDM
    participant NSSAAF
    participant AAA_P as AAA-P
    participant AAA_S as AAA-S

    Note over UE,AMF: 阶段1: 初始注册（主认证已完成）

    UE->>RAN: Registration Request<br/>Requested NSSAI: [S-NSSAI-A, S-NSSAI-B]
    RAN->>AMF: N2 Message + Registration Request
    AMF->>UDM: Nudm_SDM_Get (SUPI)
    UDM-->>AMF: 订阅数据<br/>S-NSSAI-A: NSSAA Required=True<br/>S-NSSAI-B: NSSAA Required=False
    Note right of AMF: S-NSSAI-B → Allowed NSSAI<br/>S-NSSAI-A → Pending NSSAI<br/>触发NSSAA

    AMF->>UE: Registration Accept<br/>Allowed NSSAI: [S-NSSAI-B]<br/>Pending NSSAI: [S-NSSAI-A]

    Note over UE,AAA_S: 阶段2: NSSAA EAP认证交换

    AMF->>UE: DL NAS Transport<br/>EAP-Request/Identity<br/>(针对S-NSSAI-A)
    UE->>AMF: UL NAS Transport<br/>EAP-Response/Identity

    AMF->>NSSAAF: POST /nnssaaf-nssaa/v1/{supi}/authenticate<br/>{snssai, eapPayload, aaaSelectionData}
    NSSAAF->>AAA_P: AAA-Request (EAP-Response/Identity)
    AAA_P->>AAA_S: 转发认证请求

    AAA_S-->>AAA_P: AAA-Answer (EAP-Request/TLS-Start)
    AAA_P-->>NSSAAF: AAA-Response
    NSSAAF-->>AMF: 200 OK {eapPayload: EAP-Request/TLS-Start}

    AMF->>UE: DL NAS Transport<br/>EAP-Request/TLS-Start
    UE->>AMF: UL NAS Transport<br/>EAP-Response/TLS-ClientHello

    rect rgb(255, 248, 225)
        Note over UE,AAA_S: EAP-TLS握手（可能多轮）
        AMF->>NSSAAF: POST .../authenticate {eapPayload}
        NSSAAF->>AAA_P: AAA-Request
        AAA_P->>AAA_S: 转发
        AAA_S-->>AAA_P: AAA-Answer
        AAA_P-->>NSSAAF: AAA-Response
        NSSAAF-->>AMF: 200 OK {eapPayload}
        AMF->>UE: DL NAS Transport (EAP消息)
        UE->>AMF: UL NAS Transport (EAP消息)
    end

    Note over UE,AAA_S: 阶段3: 认证结果

    AAA_S-->>AAA_P: AAA-Answer (EAP-Success + 授权数据)
    AAA_P-->>NSSAAF: AAA-Response (EAP-Success)
    NSSAAF-->>AMF: 200 OK {authResult: SUCCESS,<br/>snssai: S-NSSAI-A}

    AMF->>UE: DL NAS Transport<br/>EAP-Success
    Note right of AMF: S-NSSAI-A从Pending移至Allowed

    AMF->>UE: Configuration Update Command<br/>Allowed NSSAI: [S-NSSAI-A, S-NSSAI-B]

sequenceDiagram
    participant UE
    participant AMF
    participant NSSAAF
    participant AAA

    AMF->>UE: EAP-Request/Identity
    UE->>AMF: EAP-Response/Identity ([email protected])
    Note over AMF: 转发至NSSAAF

    AMF->>UE: EAP-Request/TLS (Start)
    UE->>AMF: EAP-Response/TLS (ClientHello)
    AMF->>UE: EAP-Request/TLS (ServerHello + Certificate + ServerKeyExchange + CertificateRequest)
    UE->>AMF: EAP-Response/TLS (Certificate + ClientKeyExchange + CertificateVerify + ChangeCipherSpec + Finished)
    AMF->>UE: EAP-Request/TLS (ChangeCipherSpec + Finished)
    AMF->>UE: EAP-Success

    Note over UE,AAA: 关键: UE和AAA双向证书认证<br/>TLS隧道保护后续数据

stateDiagram-v2
    [*] --> Requested: UE在Registration Request<br/>中携带该S-NSSAI
    Requested --> Pending: AMF判定需NSSAA<br/>且发起EAP认证
    Requested --> Allowed: 签约数据中<br/>NSSAA Required=False
    Pending --> Allowed: NSSAA成功<br/>EAP-Success
    Pending --> Rejected: NSSAA失败<br/>EAP-Failure
    Pending --> Pending: EAP多轮交换<br/>(authResult=ONGOING)
    Allowed --> Pending_NSSAA: 重认证触发<br/>(定时器到期/AAA通知)
    Pending_NSSAA --> Allowed: 重认证成功
    Pending_NSSAA --> Revoked: 重认证失败
    Revoked --> [*]: PDU Session释放
    Rejected --> [*]: UE可重新请求
    Allowed --> Revoked: AAA撤销通知<br/>(Nnssaaf_NSSAA_Revoke)

sequenceDiagram
    participant AAA_S as AAA-S
    participant NSSAAF
    participant AMF
    participant UE

    Note over NSSAAF,AMF: 定时器到期或AAA触发

    NSSAAF->>AMF: Nnssaaf_NSSAA_Authenticate<br/>通知(重认证触发)
    AMF->>UE: DL NAS Transport<br/>EAP-Request/Identity (重认证)
    UE->>AMF: UL NAS Transport<br/>EAP-Response/Identity

    rect rgb(232, 245, 233)
        Note over UE,AAA_S: EAP认证交换（同初始流程）
        AMF->>NSSAAF: POST /authenticate
        NSSAAF->>AAA_S: AAA-Request
        AAA_S-->>NSSAAF: AAA-Answer
        NSSAAF-->>AMF: 200 OK {eapPayload}
        AMF->>UE: DL NAS Transport (EAP消息)
    end

    alt 重认证成功
        AAA_S-->>NSSAAF: EAP-Success + 新授权数据
        NSSAAF-->>AMF: authResult=SUCCESS
        AMF->>UE: Configuration Update (维持Allowed NSSAI)
    else 重认证失败
        AAA_S-->>NSSAAF: EAP-Failure
        NSSAAF-->>AMF: authResult=FAILURE
        AMF->>UE: Configuration Update (从Allowed移除S-NSSAI)
        Note right of AMF: 按TS 23.502 4.3.4<br/>释放关联PDU Session
    end

{
  "supportedFeatures": "ffff",
  "snssai": {
    "sst": 1,
    "sd": "010203"
  },
  "sliceAuthData": {
    "eapPayload": "0x01...（EAP-Response原始字节）",
    "routingIndicator": "1234",
    "aaaSelectionData": {
      "aaaServerAddress": "aaa.enterprise.com",
      "aaaProtocol": "DIAMETER"
    }
  },
  "notificationUri": "https://amf.operator.com/nssaa-notify",
  "notificationCorrelationId": "corr-id-20260602-001"
}

{
  "report": {
    "supi": "imsi-460001234567890",
    "snssai": {"sst": 1, "sd": "010203"},
    "authResult": "FAILURE",
    "aaaFailureCause": "SUBSCRIPTION_EXPIRED"
}

排查路径:
1. 检查UDM签约数据中该S-NSSAI是否标记NSSAA Required
2. 确认AMF是否将S-NSSAI放入Pending NSSAI
3. 检查Registration Accept中是否有Pending NSSAI IE
4. 如无Pending NSSAI → AMF判定逻辑问题或UDM数据缺失
5. 如有Pending NSSAI → 检查后续EAP交换是否正常发起

排查路径:
1. 抓取Nnssaaf接口HTTP/2消息，确认authResult是否为ONGOING
2. 检查NSSAAF→AAA-P的连通性（RADIUS/Diameter可达性）
3. 检查AAA-S是否可达（第三方服务器状态）
4. 查看AMF日志中EAP超时定时器配置（典型值30-60秒）
5. EAP分片场景下检查MTU设置是否合理

排查路径:
1. 确认UE切片证书的有效期（openssl x509 -checkend）
2. 检查证书链完整性（根CA + 中间CA + 终端证书）
3. 确认AAA-S信任的CA列表包含UE证书的签发CA
4. 检查CRL/OCSP可达性（证书吊销检查）
5. 确认TLS版本兼容性（UE和AAA-S支持的TLS版本交集）