长期演进网络注册流程(3)

lte网络注册流程（3）

本文介绍下下长期演进网络注册的附着和建立默认承载的过程之中消息分析。

1 .附加请求

消息中主要包括：

电动助力转向附着式数据业务附着类型

易办事移动身份终端用户标识(IMSI或GUTI)

用户设备网络能力终端支持哪些加密和完整性保护算法

跟踪区域身份最后访问跟踪区钽

接收参数不连续接受配置

语音域首选项和用户设备的使用设置语音业务参数

注意：建立默认承载的请求也在其中，这里就是长期演进中的又一大特色，一条根升余弦信令上搭载两条鼻音(鼻的缩写)消息。

下面为一个消息具体示例

22:52:12.665[0xB0ED]LTE NAS EMM普通飞越顶部攻击(Overflying-Top Attack)外发消息

pkt_version=1 (0x1)

rel_number=9 (0x9)

rel_version_major=5 (0x5)

rel_version_minor=0 (0x0)

security _ header _ or _ skip _ ind=0(0x 0)

prot_disc=7 (0x7) (EPS移动性管理消息)

消息类型=65 (0x41)()附加请求)

lte_emm_msg

emm_attach_request

tsc=0 (0x0)(缓存的一秒钟上下文)

nas_key_set_id=3 (0x3)

att_type=2 (0x2)(组合EPS/IMSI附件)//附着类型

eps_mob_id //终端用户标识

id_type=6 (0x6) (GUTI) //GUTI

奇数_偶数_ind=0 (0x0)

Guti_1111=15 (0xf)

mcc_1=3 (0x3) //MCC MNC

mcc_2=1 (0x1)

mcc_3=1 (0x1)

mnc_3=0 (0x0)

mnc_1=4 (0x4)

mnc_2=8 (0x8)

MME_group_id=0 (0x0)

MME_code=0 (0x0)

m_tmsi=0 (0x0)

ue_netwk_cap //终端支持哪些加密和完整性保护算法

EEA0=1 (0x1) //lte加密算法支持能力

EEA1_128=1 (0x1)

EEA2_128=1 (0x1)

EEA3_128=1 (0x1)

EEA4=0 (0x0)

EEA5=0 (0x0)

EEA6=0 (0x0)

EEA7=0 (0x0)

EIA0=0 (0x0) //lte完整性保护算法支持能力

EIA1_128=1 (0x1)

EIA2_128=1 (0x1)

EIA3_128 = 1 (0x1)

2.获取终端id

1. //请求
2. 22:52:12.897 [0xB0EC] LTE NAS EMM Plain OTA Incoming Message
3. pkt_version = 1 (0x1)
4. rel_number = 9 (0x9)
5. rel_version_major = 5 (0x5)
6. rel_version_minor = 0 (0x0)
7. security_header_or_skip_ind = 0 (0x0)
8. prot_disc = 7 (0x7) (EPS mobility management messages)
9. msg_type = 85 (0x55) (Identity request) //获取终端id请求
10. lte_emm_msg
11. emm_id_req
12. identity_type_2
13. type_of_identity = 1 (0x1) //终端id类型（imsi or guti）
14. //响应
15. 22:52:12.897 [0xB0ED] LTE NAS EMM Plain OTA Outgoing Message
16. pkt_version = 1 (0x1)
17. rel_number = 9 (0x9)
18. rel_version_major = 5 (0x5)
19. rel_version_minor = 0 (0x0)
20. security_header_or_skip_ind = 0 (0x0)
21. prot_disc = 7 (0x7) (EPS mobility management messages)
22. msg_type = 86 (0x56) (Identity response)
23. lte_emm_msg
24. emm_id_resp
25. mobile_identity
26. id_type_check = 9 (0x9)
27. ident_type = 1 (0x1)
28. odd_even_ind = 1 (0x1)
29. num_ident = 15 (0xf) //获取到的Imsi 311480123456789
30. ident[0] = 3 (0x3)
31. ident[1] = 1 (0x1)
32. ident[2] = 1 (0x1)
33. ident[3] = 4 (0x4)
34. ident[4] = 8 (0x8)
35. ident[5] = 0 (0x0)
36. ident[6] = 1 (0x1)
37. ident[7] = 2 (0x2)
38. ident[8] = 3 (0x3)
39. ident[9] = 4 (0x4)
40. ident[10] = 5 (0x5)
41. ident[11] = 6 (0x6)
42. ident[12] = 7 (0x7)
43. ident[13] = 8 (0x8)
44. ident[14] = 9 (0x9)

3.鉴权和安全通信
这里消息就不列出来了
鉴权过程，是双向鉴权，首先mme 给ue 转发鉴权请求，ue收到鉴权消息后会对网络进行鉴权，确认网络身份后，利用鉴权算法获取响应消息返回给网络，网络在通过响应对ue进行鉴权，判断用户是否为合法用户。

安全通信其实就是ue和网络商量出一组加密算法，作为相互传递消息时使用的，最终建立起安全通信。

4.接受附着
这里注意里终端用户在成功附着的同时，也会发生位置更新。
下面接受attach accept消息，主要包括下面内容：跟踪区TA列表，MME为终端分配的guti标识，定时器餐宿，EPS网络配置参数。

1. 22:52:13.806 [0xB0EC] LTE NAS EMM Plain OTA Incoming Message
2. pkt_version = 1 (0x1)
3. rel_number = 9 (0x9)
4. rel_version_major = 5 (0x5)
5. rel_version_minor = 0 (0x0)
6. security_header_or_skip_ind = 0 (0x0)
7. prot_disc = 7 (0x7) (EPS mobility management messages)
8. msg_type = 66 (0x42) (Attach accept)
9. lte_emm_msg
10. emm_attach_accept
11. attach_result = 1 (0x1) (EPS only) //附着结果
12. t3412
13. unit = 7 (0x7)
14. timer_value = 1 (0x1)
15. tai_list //TA列表
16. num_tai_list = 1 (0x1)
17. tai_list[0]
18. list_type = 0 (0x0)
19. num_element = 0 (0x0)
20. mcc_mnc //网络的mcc mnc
21. mcc_1 = 3 (0x3)
22. mcc_2 = 1 (0x1)
23. mcc_3 = 1 (0x1)
24. mnc_3 = 0 (0x0)
25. mnc_1 = 4 (0x4)
26. mnc_2 = 8 (0x8)
27. tac[0] = 11 (0xb)
28. esm_msg_container
29. eps_bearer_id_or_skip_id = 5 (0x5)
30. prot_disc = 2 (0x2) (EPS session management messages)
31. trans_id = 1 (0x1)
32. msg_type = 193 (0xc1) (Activate default EPS bearer context request)
33. lte_esm_msg
34. act_def_eps_bearer_context_req
35. eps_qos //qos服务质量
36. qci = 5 (0x5) (QC5)
37. oct4_incl = 0 (0x0)
38. oct5_incl = 0 (0x0)
39. oct6_incl = 0 (0x0)
40. oct7_incl = 0 (0x0)
41. oct8_incl = 0 (0x0)
42. oct9_incl = 0 (0x0)
43. oct10_incl = 0 (0x0)
44. oct11_incl = 0 (0x0)
45. oct12_incl = 0 (0x0)
46. oct13_incl = 0 (0x0)
47. oct14_incl = 0 (0x0)
48. oct15_incl = 0 (0x0)
49. access_point //接入方式，或者apn信息 apn 为ims
50. num_acc_pt_val = 4 (0x4)
51. acc_pt_name_val[0] = 3 (0x3) (length)
52. acc_pt_name_val[1] = 105 (0x69) (i)
53. acc_pt_name_val[2] = 109 (0x6d) (m)
54. acc_pt_name_val[3] = 115 (0x73) (s)
55. pdn_addr //pdn 地址
56. pdn_addr_len = 9 (0x9)
57. pdn_type = 2 (0x2) (IPv6)
58. ipv6_interface_id = 0x000000000000001 (0:0:0:1)
59. trans_id_incl = 1 (0x1)
60. trans_id
61. length = 1 (0x1)
62. ti_flag = 0 (0x0)
63. ti_value = 0 (0x0)
64. qos_incl = 0 (0x0)
65. llc_sapi_incl = 0 (0x0)
66. radio_priority_incl = 0 (0x0)
67. pkt_flow_id_incl = 0 (0x0)
68. apn_ambr_incl = 0 (0x0)
69. esm_cause_incl = 1 (0x1)
70. esm_cause
71. esm_cause = 51 (0x33) (PDN type IPv6 only allowed)
72. prot_config_incl = 1 (0x1)
73. prot_config
74. ext = 1 (0x1)
75. conf_prot = 0 (0x0)
76. num_recs = 0 (0x0)
77. num_recs2 = 2 (0x2)
78. sm_container[0]
79. container_id = 3 (0x3) (DNS Server IPv6 Address)
80. container_len = 16 (0x10)
81. address = 0xfc01ababcdcd6fee0000000000000001 (fc01:abab:cdcd:6fee:0:0:0:1)
82. sm_container[1]
83. container_id = 1 (0x1) (P-CSCF IPV6 Address)
84. container_len = 16 (0x10)
85. address = 0xfc01ababcdcd6fee0000000000000001 (fc01:abab:cdcd:6fee:0:0:0:1)
86. connectivity_type_incl = 0 (0x0)
87. wlan_offload_acceptability_incl = 0 (0x0)
88. nbifom_incl = 0 (0x0)
89. header_compression_config_inclu = 0 (0x0)
90. ctrl_plane_only_ind_incl = 0 (0x0)
91. ext_prot_config_incl = 0 (0x0)
92. serv_plmn_rate_ctrl_incl = 0 (0x0)
93. ext_apn_ambr_incl = 0 (0x0)
94. ext_eps_qos_incl = 0 (0x0)
95. guti_incl = 1 (0x1)
96. guti //guti标识
97. id_type = 6 (0x6) (GUTI)
98. odd_even_ind = 0 (0x0)
99. Guti_1111 = 15 (0xf)
100. mcc_1 = 3 (0x3)
101. mcc_2 = 1 (0x1)
102. mcc_3 = 1 (0x1)
103. mnc_3 = 0 (0x0)
104. mnc_1 = 4 (0x4)
105. mnc_2 = 8 (0x8)
106. MME_group_id = 0 (0x0)
107. MME_code = 0 (0x0)
108. m_tmsi = 0 (0x0)
109. loc_id_incl = 0 (0x0)
110. ms_id_incl = 0 (0x0)
111. emm_cause_incl = 1 (0x1)
112. emm_cause
113. cause_value = 18 (0x12) (CS domain not available)
114. T3402_incl = 0 (0x0)
115. T3423_incl = 0 (0x0)
116. equ_plmns_incl = 0 (0x0)
117. emergnecy_num_list_incl = 0 (0x0)
118. eps_netwk_feature_support_incl = 1 (0x1)
119. eps_netwk_feature_support //网络特性描述
120. length = 1 (0x1)
121. CPCIoT = 0 (0x0)
122. ERwoPDN = 0 (0x0)
123. ESRPS = 0 (0x0)
124. CS_LCS = 0 (0x0) (No info about support of loc service via cs is available)
125. EPC_LCS = 0 (0x0) (Location Services via EPC not supported)
126. EMC_BS = 1 (0x1) (Emergency bearer services in S1 Mode supported)
127. IMSVoPS = 1 (0x1) (IMS Vo PS Session in S1 Mode supported)
128. add_update_result_incl = 0 (0x0)
129. t3412_ext_incl = 0 (0x0)
130. t3324_incl = 0 (0x0)
131. ext_drx_par_incl = 0 (0x0)
132. dcn_id_incl = 0 (0x0)
133. sms_srvc_status_incl = 0 (0x0)
134. non_3gpp_access_emerg_num_policy_incl = 0 (0x0)
135. t3448_incl = 0 (0x0)
136. nwk_policy_incl = 0 (0x0)
137. t3447_ext_incl = 0 (0x0)
138. ext_emergency_number_incl = 0 (0x0)
139. cipher_ket_data_incl = 0 (0x0)

5.建立默认承载
消息中包括默认承载id，qos参数，分配的ip地址，dns地址，默认apn，来自hss的签约信息。

备注qci含义：
GBR
QCI=1: Example Services: Conversational voicemscbsc
　　QCI=2: Conversational Video (Live streaming)
　　QCI=3: Real Time Gaming
　　QCI=4: Non-conversational voice (buffered streaming)
Non-GBR
QCI=5: IMS signaling
　　QCI=6: Video (buffered streaming), TCP-based (e.g. www, email, chat, ftp, p2p file sharing, progressive video,etc)
　　QCI=7: Voice, Video (live streaming), interactive gaming
　　QCI=8: Video (buffered streaming), TCP-based (e.g. www, email, chat, ftp, p2p file sharing, progressive video,etc)
　　QCI=9: Video (buffered streaming), TCP-based (e.g. www, email, chat, ftp, p2p file sharing, progressive video,etc)

1. 22:52:13.806 [0xB0E2] LTE NAS ESM Plain OTA Incoming Message
2. pkt_version = 1 (0x1)
3. rel_number = 9 (0x9)
4. rel_version_major = 5 (0x5)
5. rel_version_minor = 0 (0x0)
6. eps_bearer_id_or_skip_id = 5 (0x5)
7. prot_disc = 2 (0x2) (EPS session management messages)
8. trans_id = 1 (0x1)
9. msg_type = 193 (0xc1) (Activate default EPS bearer context request)
10. lte_esm_msg
11. act_def_eps_bearer_context_req
12. eps_qos //qos参数
13. qci = 5 (0x5) (QC5)
14. oct4_incl = 0 (0x0)
15. oct5_incl = 0 (0x0)
16. oct6_incl = 0 (0x0)
17. oct7_incl = 0 (0x0)
18. oct8_incl = 0 (0x0)
19. oct9_incl = 0 (0x0)
20. oct10_incl = 0 (0x0)
21. oct11_incl = 0 (0x0)
22. oct12_incl = 0 (0x0)
23. oct13_incl = 0 (0x0)
24. oct14_incl = 0 (0x0)
25. oct15_incl = 0 (0x0)
26. access_point //接入apn ims
27. num_acc_pt_val = 4 (0x4)
28. acc_pt_name_val[0] = 3 (0x3) (length)
29. acc_pt_name_val[1] = 105 (0x69) (i)
30. acc_pt_name_val[2] = 109 (0x6d) (m)
31. acc_pt_name_val[3] = 115 (0x73) (s)
32. pdn_addr //分配的ip地址
33. pdn_addr_len = 9 (0x9)
34. pdn_type = 2 (0x2) (IPv6)
35. ipv6_interface_id = 0x000000000000001 (0:0:0:1)
36. trans_id_incl = 1 (0x1)
37. trans_id
38. length = 1 (0x1)
39. ti_flag = 0 (0x0)
40. ti_value = 0 (0x0)
41. qos_incl = 0 (0x0)
42. llc_sapi_incl = 0 (0x0)
43. radio_priority_incl = 0 (0x0)
44. pkt_flow_id_incl = 0 (0x0)
45. apn_ambr_incl = 0 (0x0)
46. esm_cause_incl = 1 (0x1)
47. esm_cause
48. esm_cause = 51 (0x33) (PDN type IPv6 only allowed)
49. prot_config_incl = 1 (0x1)
50. prot_config
51. ext = 1 (0x1)
52. conf_prot = 0 (0x0)
53. num_recs = 0 (0x0)
54. num_recs2 = 2 (0x2)
55. sm_container[0]
56. container_id = 3 (0x3) (DNS Server IPv6 Address)
57. container_len = 16 (0x10)
58. address = 0xfc01ababcdcd6fee0000000000000001 (fc01:abab:cdcd:6fee:0:0:0:1)
59. sm_container[1]
60. container_id = 1 (0x1) (P-CSCF IPV6 Address)
61. container_len = 16 (0x10)
62. address = 0xfc01ababcdcd6fee0000000000000001 (fc01:abab:cdcd:6fee:0:0:0:1)
63. connectivity_type_incl = 0 (0x0)
64. wlan_offload_acceptability_incl = 0 (0x0)
65. nbifom_incl = 0 (0x0)
66. header_compression_config_inclu = 0 (0x0)
67. ctrl_plane_only_ind_incl = 0 (0x0)
68. ext_prot_config_incl = 0 (0x0)
69. serv_plmn_rate_ctrl_incl = 0 (0x0)
70. ext_apn_ambr_incl = 0 (0x0)
71. ext_eps_qos_incl = 0 (0x0)

最后终端给网络发送一个完成附着的响应，attach complete 消息中没有携带任何具体信息，可以理解为给Mme的礼貌性的回应。

至此，关于lte注册流程应该算是有个简单的了解了。