lte網絡註冊流程（3）
本文介紹下下lte網絡註冊的附着和建立默認承載的過程之中消息分析.
1.attach request
消息中主要包括：
EPS attach type 數據業務附着類型
EPS Mobile identity 終端用戶標識（IMSI or GUTI）
UE Network Capbility 終端支持哪些加密和完整性保護算法
Tracking Area Identity 最後訪問跟蹤區TA
DRX Parameter 不連續接受配置
voice domain preference and UE’S Usage setting 語音業務參數
注意：建立默認承載的請求也在其中，這裏就是lte中的又一大特色，一條rrc信令上搭載兩條nas消息。
下面爲一個消息具體示例
22:52:12.665 [0xB0ED] LTE NAS EMM Plain OTA Outgoing Message
pkt_version = 1 (0x1)
rel_number = 9 (0x9)
rel_version_major = 5 (0x5)
rel_version_minor = 0 (0x0)
security_header_or_skip_ind = 0 (0x0)
prot_disc = 7 (0x7) (EPS mobility management messages)
msg_type = 65 (0x41) (Attach request)
lte_emm_msg
emm_attach_request
tsc = 0 (0x0) (cached sec context)
nas_key_set_id = 3 (0x3)
att_type = 2 (0x2) (combined EPS/IMSI attach) //附着類型
eps_mob_id //終端用戶標識
id_type = 6 (0x6) (GUTI) //GUTI
odd_even_ind = 0 (0x0)
Guti_1111 = 15 (0xf)
mcc_1 = 3 (0x3) //MCC MNC
mcc_2 = 1 (0x1)
mcc_3 = 1 (0x1)
mnc_3 = 0 (0x0)
mnc_1 = 4 (0x4)
mnc_2 = 8 (0x8)
MME_group_id = 0 (0x0)
MME_code = 0 (0x0)
m_tmsi = 0 (0x0)
ue_netwk_cap //終端支持哪些加密和完整性保護算法
EEA0 = 1 (0x1) //lte加密算法支持能力
EEA1_128 = 1 (0x1)
EEA2_128 = 1 (0x1)
EEA3_128 = 1 (0x1)
EEA4 = 0 (0x0)
EEA5 = 0 (0x0)
EEA6 = 0 (0x0)
EEA7 = 0 (0x0)
EIA0 = 0 (0x0) //lte完整性保護算法支持能力
EIA1_128 = 1 (0x1)
EIA2_128 = 1 (0x1)
EIA3_128 = 1 (0x1)
EIA4 = 0 (0x0)
EIA5 = 0 (0x0)
EIA6 = 0 (0x0)
EIA7 = 0 (0x0)
oct5_incl = 1 (0x1)
UEA0 = 1 (0x1) //3g加密算法支持能力
UEA1 = 1 (0x1)
UEA2 = 0 (0x0)
UEA3 = 0 (0x0)
UEA4 = 0 (0x0)
UEA5 = 0 (0x0)
UEA6 = 0 (0x0)
UEA7 = 0 (0x0)
oct6_incl = 1 (0x1)
UCS2 = 0 (0x0)
UIA1 = 1 (0x1) //3G完整性保護算法的支持能力
UIA2 = 0 (0x0)
UIA3 = 0 (0x0)
UIA4 = 0 (0x0)
UIA5 = 0 (0x0)
UIA6 = 0 (0x0)
UIA7 = 0 (0x0)
oct7_incl = 1 (0x1)
ProSedd = 0 (0x0)
ProSe = 0 (0x0)
H_245_ASH = 0 (0x0)
ACC_CSFB = 1 (0x1)
LPP = 1 (0x1)
LCS = 0 (0x0)
vcc_1xsr = 0 (0x0)
NF = 1 (0x1)
oct8_incl = 0 (0x0)
oct9_incl = 0 (0x0)
oct10_incl = 0 (0x0)
oct11_incl = 0 (0x0)
oct12_incl = 0 (0x0)
oct13_incl = 0 (0x0)
oct14_incl = 0 (0x0)
oct15_incl = 0 (0x0)
esm_msg_container //激活默認承載
eps_bearer_id_or_skip_id = 0 (0x0)
prot_disc = 2 (0x2) (EPS session management messages)
trans_id = 1 (0x1)
msg_type = 208 (0xd0) (PDN connectivity request) //激活默認承載請求
lte_esm_msg
pdn_connectivity_req
pdn_type = 3 (0x3) (Ipv4v6) //PDN 類型
req_type = 1 (0x1) (initial request) //請求類型
info_trans_flag_incl = 1 (0x1)
esm_info_trans_flag = 1 (0x1)
access_pt_name_incl = 0 (0x0)
prot_config_incl = 1 (0x1)
prot_config
ext = 1 (0x1)
conf_prot = 0 (0x0)
num_recs = 3 (0x3)
sm_prot[0]
protocol_id = 32801 (0x8021) (IPCP)
prot_len = 16 (0x10)
ipcp_prot
ipcp_prot_id = 1 (0x1) (CONF_REQ)
identifier = 0 (0x0)
rfc1332_conf_req
num_options = 2 (0x2)
conf_options[0]
type = 129 (0x81)
rfc1877_primary_dns_server_add
length = 6 (0x6)
ip_addr = 0 (0x0) (0.0.0.0)
conf_options[1]
type = 131 (0x83)
rfc1877_sec_dns_server_add
length = 6 (0x6)
ip_addr = 0 (0x0) (0.0.0.0)
sm_prot[1]
protocol_id = 13 (0xd) (DNS Server IPv4 Address Requestt)
prot_len = 0 (0x0)
sm_prot[2]
protocol_id = 3 (0x3) (DNS Server IPv6 Addr Req)
prot_len = 0 (0x0)
num_recs2 = 6 (0x6)
sm_container[0]
container_id = 65280 (0xff00) (unknown)
container_len = 3 (0x3)
container_contents[0] = 19 (0x13)
container_contents[1] = 1 (0x1)
container_contents[2] = 132 (0x84)
sm_container[1]
container_id = 1 (0x1) (P-CSCF IPv6 Address Request)
container_len = 0 (0x0)
sm_container[2]
container_id = 12 (0xc) (P-CSCF IPv4 Address Request)
container_len = 0 (0x0)
sm_container[3]
container_id = 10 (0xa) (IP address allocation via NAS signalling)
container_len = 0 (0x0)
sm_container[4]
container_id = 5 (0x5) (NWK Req Bearer Control indicator)
container_len = 0 (0x0)
sm_container[5]
container_id = 16 (0x10) (Ipv4 Link MTU Request)
container_len = 0 (0x0)
dev_properties_incl = 0 (0x0)
nbifom_incl = 0 (0x0)
header_compression_config_inclu = 0 (0x0)
ext_prot_config_incl = 0 (0x0)
p_tmsi_sig_incl = 0 (0x0)
add_guti_incl = 0 (0x0)
reg_tai_incl = 1 (0x1)
tracking_area_id
mcc_mnc
mcc_1 = 3 (0x3)
mcc_2 = 1 (0x1)
mcc_3 = 1 (0x1)
mnc_3 = 0 (0x0)
mnc_1 = 4 (0x4)
mnc_2 = 8 (0x8)
tracking_area_id = 11 (0xb)
drx_params_incl = 1 (0x1)
drx_params
split_pg_cycle_code = 10 (0xa)
cycle_len_coeff = 0 (0x0)
split_on_ccch = 0 (0x0)
non_drx_timer = 0 (0x0)
ms_netwk_cap_incl = 1 (0x1)
ms_netwk_cap
length = 3 (0x3)
r99 = 1 (0x1)
GEA1 bits
GEA/1 = 1 (0x1)
SM capabilities via dedicated channels = 1 (0x1)
SM capabilities via GPRS channels = 1 (0x1)
UCS2 support = 0 (0x0)
SS Screening Indicator = 1 (0x1)
SoLSA Capability = 0 (0x0)
Revision level indicator = 1 (0x1)
PFC feature mode = 1 (0x1)
Extended GEA bits
GEA/2 = 1 (0x1)
GEA/3 = 1 (0x1)
GEA/4 = 0 (0x0)
GEA/5 = 0 (0x0)
GEA/6 = 0 (0x0)
GEA/7 = 0 (0x0)
LCS VA capability = 0 (0x0)
PS inter-RAT HO from GERAN to UTRAN Iu mode capability = 0 (0x0)
PS inter-RAT HO from GERAN to E-UTRAN S1 mode capability = 0 (0x0)
EMM Combined procedures Capability = 1 (0x1)
ISR support = 1 (0x1)
SRVCC to GERAN/UTRAN capability = 1 (0x1)
EPC capability = 1 (0x1)
NF capability = 1 (0x1)
spare_bits0_count = 0 (0x0)
old_loc_area_id_incl = 0 (0x0)
tmsi_stat_incl = 1 (0x1)
tmsi_stat
tmsi_flag = 0 (0x0)
ms_class_mark2_incl = 1 (0x1)
ms_class_mark2
rev_level = 2 (0x2)
es_ind = 0 (0x0)
a5_1_alg_sup = 1 (0x1)
rf_power_cap = 7 (0x7)
pseudo_sync_cap = 0 (0x0)
ss_screen_ind = 1 (0x1)
sm_cap = 1 (0x1)
vbs = 0 (0x0)
vgcs = 0 (0x0)
freq_cap = 0 (0x0)
class_3_avail = 1 (0x1)
lcsva_cap = 1 (0x1)
ucs2 = 0 (0x0)
solsa = 0 (0x0)
cmsp = 1 (0x1)
a5_3_alg_sup = 0 (0x0)
a5_2_alg_sup = 0 (0x0)
ms_class_mark3_incl = 0 (0x0)
supp_codecs_incl = 1 (0x1)
supp_codecs
num_codecs = 2 (0x2)
codecs[0]
sysid = 4 (0x4)
length = 2 (0x2)
bitmap[0] = 96 (0x60)
bitmap[1] = 4 (0x4)
codecs[1]
sysid = 0 (0x0)
length = 2 (0x2)
bitmap[0] = 31 (0x1f)
bitmap[1] = 2 (0x2)
add_update_type_incl = 0 (0x0)
voice_domain_pref_incl = 1 (0x1)
voice_domain_pref //語音業務相關參數
length = 1 (0x1)
UE_usage_setting = 1 (0x1) (Data centric)
//volte 優先 cs語音
voice_domain_pref_for_EUTRAN = 3 (0x3) (IMS PS Voice preferred, CS Voice as secondary)
dev_properties_incl = 0 (0x0)
old_guti_incl = 0 (0x0)
ms_network_feature_incl = 1 (0x1)
ms_network_feature_support
ext_periodic_timers = 1 (0x1)
network_resource_id_container_incl = 0 (0x0)
t3324_incl = 0 (0x0)
t3412_ext_incl = 0 (0x0)
ext_drx_par_incl = 0 (0x0)
ue_add_security_cap_incl = 0 (0x0)
ue_status_incl = 0 (0x0)
2.獲取終端id
//請求
22:52:12.897 [0xB0EC] LTE NAS EMM Plain OTA Incoming Message
pkt_version = 1 (0x1)
rel_number = 9 (0x9)
rel_version_major = 5 (0x5)
rel_version_minor = 0 (0x0)
security_header_or_skip_ind = 0 (0x0)
prot_disc = 7 (0x7) (EPS mobility management messages)
msg_type = 85 (0x55) (Identity request) //獲取終端id請求
lte_emm_msg
emm_id_req
identity_type_2
type_of_identity = 1 (0x1) //終端id類型（imsi or guti）
//響應
22:52:12.897 [0xB0ED] LTE NAS EMM Plain OTA Outgoing Message
pkt_version = 1 (0x1)
rel_number = 9 (0x9)
rel_version_major = 5 (0x5)
rel_version_minor = 0 (0x0)
security_header_or_skip_ind = 0 (0x0)
prot_disc = 7 (0x7) (EPS mobility management messages)
msg_type = 86 (0x56) (Identity response)
lte_emm_msg
emm_id_resp
mobile_identity
id_type_check = 9 (0x9)
ident_type = 1 (0x1)
odd_even_ind = 1 (0x1)
num_ident = 15 (0xf) //獲取到的Imsi 311480123456789
ident[0] = 3 (0x3)
ident[1] = 1 (0x1)
ident[2] = 1 (0x1)
ident[3] = 4 (0x4)
ident[4] = 8 (0x8)
ident[5] = 0 (0x0)
ident[6] = 1 (0x1)
ident[7] = 2 (0x2)
ident[8] = 3 (0x3)
ident[9] = 4 (0x4)
ident[10] = 5 (0x5)
ident[11] = 6 (0x6)
ident[12] = 7 (0x7)
ident[13] = 8 (0x8)
ident[14] = 9 (0x9)
3.鑑權和安全通信
這裏消息就不列出來了
鑑權過程，是雙向鑑權，首先mme 給ue 轉發鑑權請求，ue收到鑑權消息後會對網絡進行鑑權，確認網絡身份後，利用鑑權算法獲取響應消息返回給網絡，網絡在通過響應對ue進行鑑權，判斷用戶是否爲合法用戶。
安全通信其實就是ue和網絡商量出一組加密算法，作爲相互傳遞消息時使用的，最終建立起安全通信。
4.接受附着
這裏注意裏終端用戶在成功附着的同時，也會發生位置更新。
下面接受attach accept消息，主要包括下面內容：跟蹤區TA列表，MME爲終端分配的guti標識，定時器餐宿，EPS網絡配置參數。
22:52:13.806 [0xB0EC] LTE NAS EMM Plain OTA Incoming Message
pkt_version = 1 (0x1)
rel_number = 9 (0x9)
rel_version_major = 5 (0x5)
rel_version_minor = 0 (0x0)
security_header_or_skip_ind = 0 (0x0)
prot_disc = 7 (0x7) (EPS mobility management messages)
msg_type = 66 (0x42) (Attach accept)
lte_emm_msg
emm_attach_accept
attach_result = 1 (0x1) (EPS only) //附着結果
t3412
unit = 7 (0x7)
timer_value = 1 (0x1)
tai_list //TA列表
num_tai_list = 1 (0x1)
tai_list[0]
list_type = 0 (0x0)
num_element = 0 (0x0)
mcc_mnc //網絡的mcc mnc
mcc_1 = 3 (0x3)
mcc_2 = 1 (0x1)
mcc_3 = 1 (0x1)
mnc_3 = 0 (0x0)
mnc_1 = 4 (0x4)
mnc_2 = 8 (0x8)
tac[0] = 11 (0xb)
esm_msg_container
eps_bearer_id_or_skip_id = 5 (0x5)
prot_disc = 2 (0x2) (EPS session management messages)
trans_id = 1 (0x1)
msg_type = 193 (0xc1) (Activate default EPS bearer context request)
lte_esm_msg
act_def_eps_bearer_context_req
eps_qos //qos服務質量
qci = 5 (0x5) (QC5)
oct4_incl = 0 (0x0)
oct5_incl = 0 (0x0)
oct6_incl = 0 (0x0)
oct7_incl = 0 (0x0)
oct8_incl = 0 (0x0)
oct9_incl = 0 (0x0)
oct10_incl = 0 (0x0)
oct11_incl = 0 (0x0)
oct12_incl = 0 (0x0)
oct13_incl = 0 (0x0)
oct14_incl = 0 (0x0)
oct15_incl = 0 (0x0)
access_point //接入方式，或者apn信息 apn 爲ims
num_acc_pt_val = 4 (0x4)
acc_pt_name_val[0] = 3 (0x3) (length)
acc_pt_name_val[1] = 105 (0x69) (i)
acc_pt_name_val[2] = 109 (0x6d) (m)
acc_pt_name_val[3] = 115 (0x73) (s)
pdn_addr //pdn 地址
pdn_addr_len = 9 (0x9)
pdn_type = 2 (0x2) (IPv6)
ipv6_interface_id = 0x000000000000001 (0:0:0:1)
trans_id_incl = 1 (0x1)
trans_id
length = 1 (0x1)
ti_flag = 0 (0x0)
ti_value = 0 (0x0)
qos_incl = 0 (0x0)
llc_sapi_incl = 0 (0x0)
radio_priority_incl = 0 (0x0)
pkt_flow_id_incl = 0 (0x0)
apn_ambr_incl = 0 (0x0)
esm_cause_incl = 1 (0x1)
esm_cause
esm_cause = 51 (0x33) (PDN type IPv6 only allowed)
prot_config_incl = 1 (0x1)
prot_config
ext = 1 (0x1)
conf_prot = 0 (0x0)
num_recs = 0 (0x0)
num_recs2 = 2 (0x2)
sm_container[0]
container_id = 3 (0x3) (DNS Server IPv6 Address)
container_len = 16 (0x10)
address = 0xfc01ababcdcd6fee0000000000000001 (fc01:abab:cdcd:6fee:0:0:0:1)
sm_container[1]
container_id = 1 (0x1) (P-CSCF IPV6 Address)
container_len = 16 (0x10)
address = 0xfc01ababcdcd6fee0000000000000001 (fc01:abab:cdcd:6fee:0:0:0:1)
connectivity_type_incl = 0 (0x0)
wlan_offload_acceptability_incl = 0 (0x0)
nbifom_incl = 0 (0x0)
header_compression_config_inclu = 0 (0x0)
ctrl_plane_only_ind_incl = 0 (0x0)
ext_prot_config_incl = 0 (0x0)
serv_plmn_rate_ctrl_incl = 0 (0x0)
ext_apn_ambr_incl = 0 (0x0)
ext_eps_qos_incl = 0 (0x0)
guti_incl = 1 (0x1)
guti //guti標識
id_type = 6 (0x6) (GUTI)
odd_even_ind = 0 (0x0)
Guti_1111 = 15 (0xf)
mcc_1 = 3 (0x3)
mcc_2 = 1 (0x1)
mcc_3 = 1 (0x1)
mnc_3 = 0 (0x0)
mnc_1 = 4 (0x4)
mnc_2 = 8 (0x8)
MME_group_id = 0 (0x0)
MME_code = 0 (0x0)
m_tmsi = 0 (0x0)
loc_id_incl = 0 (0x0)
ms_id_incl = 0 (0x0)
emm_cause_incl = 1 (0x1)
emm_cause
cause_value = 18 (0x12) (CS domain not available)
T3402_incl = 0 (0x0)
T3423_incl = 0 (0x0)
equ_plmns_incl = 0 (0x0)
emergnecy_num_list_incl = 0 (0x0)
eps_netwk_feature_support_incl = 1 (0x1)
eps_netwk_feature_support //網絡特性描述
length = 1 (0x1)
CPCIoT = 0 (0x0)
ERwoPDN = 0 (0x0)
ESRPS = 0 (0x0)
CS_LCS = 0 (0x0) (No info about support of loc service via cs is available)
EPC_LCS = 0 (0x0) (Location Services via EPC not supported)
EMC_BS = 1 (0x1) (Emergency bearer services in S1 Mode supported)
IMSVoPS = 1 (0x1) (IMS Vo PS Session in S1 Mode supported)
add_update_result_incl = 0 (0x0)
t3412_ext_incl = 0 (0x0)
t3324_incl = 0 (0x0)
ext_drx_par_incl = 0 (0x0)
dcn_id_incl = 0 (0x0)
sms_srvc_status_incl = 0 (0x0)
non_3gpp_access_emerg_num_policy_incl = 0 (0x0)
t3448_incl = 0 (0x0)
nwk_policy_incl = 0 (0x0)
t3447_ext_incl = 0 (0x0)
ext_emergency_number_incl = 0 (0x0)
cipher_ket_data_incl = 0 (0x0)
5.建立默認承載
消息中包括默認承載id，qos參數，分配的ip地址，dns地址，默認apn，來自hss的簽約信息。
備註qci含義：
GBR
QCI=1: Example Services: Conversational voicemscbsc
QCI=2: Conversational Video (Live streaming)
QCI=3: Real Time Gaming
QCI=4: Non-conversational voice (buffered streaming)
Non-GBR
QCI=5: IMS signaling
QCI=6: Video (buffered streaming), TCP-based (e.g. www, email, chat, ftp, p2p file sharing, progressive video,etc)
QCI=7: Voice, Video (live streaming), interactive gaming
QCI=8: Video (buffered streaming), TCP-based (e.g. www, email, chat, ftp, p2p file sharing, progressive video,etc)
QCI=9: Video (buffered streaming), TCP-based (e.g. www, email, chat, ftp, p2p file sharing, progressive video,etc)
22:52:13.806 [0xB0E2] LTE NAS ESM Plain OTA Incoming Message
pkt_version = 1 (0x1)
rel_number = 9 (0x9)
rel_version_major = 5 (0x5)
rel_version_minor = 0 (0x0)
eps_bearer_id_or_skip_id = 5 (0x5)
prot_disc = 2 (0x2) (EPS session management messages)
trans_id = 1 (0x1)
msg_type = 193 (0xc1) (Activate default EPS bearer context request)
lte_esm_msg
act_def_eps_bearer_context_req
eps_qos //qos參數
qci = 5 (0x5) (QC5)
oct4_incl = 0 (0x0)
oct5_incl = 0 (0x0)
oct6_incl = 0 (0x0)
oct7_incl = 0 (0x0)
oct8_incl = 0 (0x0)
oct9_incl = 0 (0x0)
oct10_incl = 0 (0x0)
oct11_incl = 0 (0x0)
oct12_incl = 0 (0x0)
oct13_incl = 0 (0x0)
oct14_incl = 0 (0x0)
oct15_incl = 0 (0x0)
access_point //接入apn ims
num_acc_pt_val = 4 (0x4)
acc_pt_name_val[0] = 3 (0x3) (length)
acc_pt_name_val[1] = 105 (0x69) (i)
acc_pt_name_val[2] = 109 (0x6d) (m)
acc_pt_name_val[3] = 115 (0x73) (s)
pdn_addr //分配的ip地址
pdn_addr_len = 9 (0x9)
pdn_type = 2 (0x2) (IPv6)
ipv6_interface_id = 0x000000000000001 (0:0:0:1)
trans_id_incl = 1 (0x1)
trans_id
length = 1 (0x1)
ti_flag = 0 (0x0)
ti_value = 0 (0x0)
qos_incl = 0 (0x0)
llc_sapi_incl = 0 (0x0)
radio_priority_incl = 0 (0x0)
pkt_flow_id_incl = 0 (0x0)
apn_ambr_incl = 0 (0x0)
esm_cause_incl = 1 (0x1)
esm_cause
esm_cause = 51 (0x33) (PDN type IPv6 only allowed)
prot_config_incl = 1 (0x1)
prot_config
ext = 1 (0x1)
conf_prot = 0 (0x0)
num_recs = 0 (0x0)
num_recs2 = 2 (0x2)
sm_container[0]
container_id = 3 (0x3) (DNS Server IPv6 Address)
container_len = 16 (0x10)
address = 0xfc01ababcdcd6fee0000000000000001 (fc01:abab:cdcd:6fee:0:0:0:1)
sm_container[1]
container_id = 1 (0x1) (P-CSCF IPV6 Address)
container_len = 16 (0x10)
address = 0xfc01ababcdcd6fee0000000000000001 (fc01:abab:cdcd:6fee:0:0:0:1)
connectivity_type_incl = 0 (0x0)
wlan_offload_acceptability_incl = 0 (0x0)
nbifom_incl = 0 (0x0)
header_compression_config_inclu = 0 (0x0)
ctrl_plane_only_ind_incl = 0 (0x0)
ext_prot_config_incl = 0 (0x0)
serv_plmn_rate_ctrl_incl = 0 (0x0)
ext_apn_ambr_incl = 0 (0x0)
ext_eps_qos_incl = 0 (0x0)
最後終端給網絡發送一個完成附着的響應，attach complete 消息中沒有攜帶任何具體信息，可以理解爲給Mme的禮貌性的迴應。
至此，關於lte註冊流程應該算是有個簡單的瞭解了。