一、UE attach 流程
UE想要获取服务，需要向网络注册，这个注册过程被称为Attach。Attach的过程建立了默认的EPS承载（承载可以简单的认为是核心网到UE之间的通路）。从而使UE/User保持“一直在线”的IP连接，并且PGW将**预告定义好的相应于此默认EPS承载的策略与计费规则。当用户完成网路接入过程后，开始向网络进行注册。
attach的流程：
attch 的信令流程：
attach log：
二、IMS注册流程
IMS注册流程log：
信令详解
1. UE首先发起一个注册请求，这个注册请求是没有任何安全机制保护的，但是它里面包含了一些注册IMS所需的安全参数。
0x156E IMS SIP Message -- IMS_SIP_REGISTER/INFORMAL_RESPONSE
Version = 1
Direction = UE_TO_NETWORK
SDP Presence = 0
SIP Call ID Length = 59
SIP Message Length = 1570
SIP Message Logged Bytes = 1571
Message ID = IMS_SIP_REGISTER
Response Code = INFORMAL_RESPONSE (0)
CM Call ID = 255
//会话标识，在整个注册流程不变。有本地标识@主机组成，其中@主机为UAC的IP地址。
SIP Call ID = [email protected]:8804:8000:186e:9fb:f711:a6d6:ead
Sip Message = REGISTER sip:ims.mnc000.mcc460.3gppnetwork.org SIP/2.0
f: ;tag=842020773
t:
CSeq: 842020765 REGISTER
i: [email protected]:8804:8000:186e:9fb:f711:a6d6:ead
v: SIP/2.0/TCP [2409:8804:8000:186e:9fb:f711:a6d6:ead]:5060;branch=z9hG4bK3403392309
Max-Forwards: 70
m: ;+g.3gpp.accesstype="cellular2";+g.3gpp.icsi-ref="urn:urn-7:3gpp-service.ims.icsi.mmtel";+g.3gpp.smsip;video
Authorization: Digest uri="sip:ims.mnc000.mcc460.3gppnetwork.org",username="[email protected]",response="",realm="ims.mnc000.mcc460.3gppnetwork.org",nonce=""
//注册周期。如果为0，则是去注册
Expires: 600000
Require: sec-agree
Proxy-Require: sec-agree
k: path,sec-agree
Allow: INVITE,BYE,CANCEL,ACK,NOTIFY,UPDATE,PRACK,INFO,MESSAGE,OPTIONS
Security-Client: ipsec-3gpp; alg=hmac-md5-96; ealg=des-ede3-cbc; spi-c=2400192191; spi-s=4029922906; port-c=8001; port-s=8901,ipsec-3gpp; alg=hmac-md5-96; ealg=aes-cbc; spi-c=2400192191; spi-s=4029922906; port-c=8001; port-s=8901,ipsec-3gpp; alg=hmac-md5-96; ealg=null; spi-c=2400192191; spi-s=4029922906; port-c=8001; port-s=8901,ipsec-3gpp; alg=hmac-sha-1-96; ealg=des-ede3-cbc; spi-c=2400192191; spi-s=4029922906; port-c=8001; port-s=8901,ipsec-3gpp; alg=hmac-sha-1-96; ealg=aes-cbc; spi-c=2400192191; spi-s=4029922906; port-c=8001; port-s=8901,ipsec-3gpp; alg=hmac-sha-1-96; ealg=null; spi-c=2400192191; spi-s=4029922906; port-c=8001; port-s=8901
l: 0
2. Server收到请求后，会对消息进行解码，并添加自己的安全参数和鉴权方式，发送一个unauthorized的响应去challenge UE。
0x156E IMS SIP Message -- IMS_SIP_REGISTER/UNAUTHORIZED
Version = 1
Direction = NETWORK_TO_UE
SDP Presence = 0
SIP Call ID Length = 59
SIP Message Length = 656
SIP Message Logged Bytes = 657
Message ID = IMS_SIP_REGISTER
Response Code = UNAUTHORIZED (401)
CM Call ID = 255
SIP Call ID = [email protected]:8804:8000:186e:9fb:f711:a6d6:ead
Sip Message = SIP/2.0 401 Unauthorized
Via: SIP/2.0/TCP [2409:8804:8000:186E:09FB:F711:A6D6:0EAD]:5060;branch=z9hG4bK3403392309
Call-ID: [email protected]:8804:8000:186e:9fb:f711:a6d6:ead
From: ;tag=842020773
To: ;tag=o8bvb89i
CSeq: 842020765 REGISTER
WWW-Authenticate: Digest realm="ims.mnc000.mcc460.3gppnetwork.org",nonce="C7wh+VcFEIgJOIlDgpDBXQfzQf5nj3CVCjBnxfy+9wk=",algorithm=AKAv1-MD5
Security-Server: ipsec-3gpp;alg=hmac-md5-96;prot=esp;mod=trans;ealg=null;spi-c=3150465912;spi-s=3930932050;port-c=9950;port-s=9900
Content-Length: 0
3. UE收到401消息后，会进行消息解码，然后计算，重新发送一个注册请求上去。
0x156E IMS SIP Message -- IMS_SIP_REGISTER/INFORMAL_RESPONSE
Version = 1
Direction = UE_TO_NETWORK
SDP Presence = 0
SIP Call ID Length = 59
SIP Message Length = 1876
SIP Message Logged Bytes = 1877
Message ID = IMS_SIP_REGISTER
Response Code = INFORMAL_RESPONSE (0)
CM Call ID = 255
SIP Call ID = [email protected]:8804:8000:186e:9fb:f711:a6d6:ead
Sip Message = REGISTER sip:ims.mnc000.mcc460.3gppnetwork.org SIP/2.0
f: ;tag=842022485
t:
CSeq: 842020766 REGISTER
i: [email protected]:8804:8000:186e:9fb:f711:a6d6:ead
v: SIP/2.0/TCP [2409:8804:8000:186e:9fb:f711:a6d6:ead]:8901;branch=z9hG4bK1614040778
Max-Forwards: 70
m: ;+g.3gpp.icsi-ref="urn:urn-7:3gpp-service.ims.icsi.mmtel";+g.3gpp.smsip;video;+g.3gpp.accesstype="cellular2"
P-Access-Network-Info: 3GPP-E-UTRAN-TDD; utran-cell-id-3gpp=4600018BE192D322
Security-Verify: ipsec-3gpp;alg=hmac-md5-96;prot=esp;mod=trans;ealg=null;spi-c=3150465912;spi-s=3930932050;port-c=9950;port-s=9900
l: 0
Authorization: Digest username="[email protected]",realm="ims.mnc000.mcc460.3gppnetwork.org",uri="sip:ims.mnc000.mcc460.3gppnetwork.org",nonce="C7wh+VcFEIgJOIlDgpDBXQfzQf5nj3CVCjBnxfy+9wk=",algorithm=AKAv1-MD5,response="9fba77a4341e4c1a160cf7b8991aa8cf"
Expires: 600000
Require: sec-agree
Proxy-Require: sec-agree
k: path,sec-agree
Allow: INVITE,BYE,CANCEL,ACK,NOTIFY,UPDATE,PRACK,INFO,MESSAGE,OPTIONS
Security-Client: ipsec-3gpp; alg=hmac-md5-96; ealg=des-ede3-cbc; spi-c=2400192191; spi-s=4029922906; port-c=8001; port-s=8901,ipsec-3gpp; alg=hmac-md5-96; ealg=aes-cbc; spi-c=2400192191; spi-s=4029922906; port-c=8001; port-s=8901,ipsec-3gpp; alg=hmac-md5-96; ealg=null; spi-c=2400192191; spi-s=4029922906; port-c=8001; port-s=8901,ipsec-3gpp; alg=hmac-sha-1-96; ealg=des-ede3-cbc; spi-c=2400192191; spi-s=4029922906; port-c=8001; port-s=8901,ipsec-3gpp; alg=hmac-sha-1-96; ealg=aes-cbc; spi-c=2400192191; spi-s=4029922906; port-c=8001; port-s=8901,ipsec-3gpp; alg=hmac-sha-1-96; ealg=null; spi-c=2400192191; spi-s=4029922906; port-c=8001; port-s=8901
4. 最后，网络将UE第二次发送来的请求进行解码处理，然后和本地对比，如果匹配，则会发送200 OK出去。其中200 Ok消息包含了一系列用户注册的身份标识。
0x156E IMS SIP Message -- IMS_SIP_REGISTER/OK
Version = 1
Direction = NETWORK_TO_UE
SDP Presence = 0
SIP Call ID Length = 59
SIP Message Length = 771
SIP Message Logged Bytes = 772
Message ID = IMS_SIP_REGISTER
Response Code = OK (200)
CM Call ID = 255
SIP Call ID = [email protected]:8804:8000:186e:9fb:f711:a6d6:ead
Sip Message = SIP/2.0 200 OK
Via: SIP/2.0/TCP [2409:8804:8000:186E:09FB:F711:A6D6:0EAD]:8901;branch=z9hG4bK1614040778
Call-ID: [email protected]:8804:8000:186e:9fb:f711:a6d6:ead
From: ;tag=842022485
To: ;tag=kn9vambk
CSeq: 842020766 REGISTER
Accept-Resource-Priority: wps.4
P-Associated-URI: ,
Contact: ;expires=3600;+g.3gpp.icsi-ref="urn:urn-7:3gpp-service.ims.icsi.mmtel";+g.3gpp.smsip;video;+g.3gpp.accesstype="cellular2"
Path: 2409:8014:8201:0010:0000:0000:0000:0009] PCSCF的IP地址:9900;lr>
Content-Length: 0
5. 可是，这里有一个问题，在UE发起register之前，它是如何得知SIP server的地址的。
首先，UE会在PDN connect request 中请求PCSCF的地址，然后通过PCSCF来和server进行交互的。
LTE NAS ESM Plain OTA Outgoing Message -- PDN connectivity request Msg
pkt_version = 1 (0x1)
rel_number = 9 (0x9)
rel_version_major = 5 (0x5)
rel_version_minor = 0 (0x0)
eps_bearer_id_or_skip_id = 0 (0x0)
prot_disc = 2 (0x2) (EPS session management messages)
trans_id = 2 (0x2)
msg_type = 208 (0xd0) (PDN connectivity request)
lte_esm_msg
pdn_connectivity_req
pdn_type = 3 (0x3) (Ipv4v6)
req_type = 1 (0x1) (initial request)
info_trans_flag_incl = 0 (0x0)
access_pt_name_incl = 1 (0x1)
access_pt_name_
num_acc_pt_val = 4 (0x4)
acc_pt_name_val[0] = 3 (0x3) (length)
acc_pt_name_val[1] = 73 (0x49) (I)
acc_pt_name_val[2] = 77 (0x4d) (M)
acc_pt_name_val[3] = 83 (0x53) (S)
...
sm_container[2]
container_id = 1 (0x1) (P-CSCF IPv6 Address Request)
container_len = 0 (0x0)
sm_container[3]
container_id = 12 (0xc) (P-CSCF IPv4 Address Request)
container_len = 0 (0x0)
6. 然后，网络会提供PCSCF的地址给UE在activate default EPS bear request中。
LTE NAS ESM Plain OTA Incoming Message -- Activate default EPS bearer context request Msg
pkt_version = 1 (0x1)
rel_number = 9 (0x9)
rel_version_major = 5 (0x5)
rel_version_minor = 0 (0x0)
eps_bearer_id_or_skip_id = 6 (0x6)
prot_disc = 2 (0x2) (EPS session management messages)
trans_id = 2 (0x2)
msg_type = 193 (0xc1) (Activate default EPS bearer context request)
lte_esm_msg
act_def_eps_bearer_context_req
eps_qos
qci = 5 (0x5) (QC5)
...
access_point
num_acc_pt_val = 23 (0x17)
acc_pt_name_val[0] = 3 (0x3) (length)
acc_pt_name_val[1] = 105 (0x69) (i)
acc_pt_name_val[2] = 109 (0x6d) (m)
acc_pt_name_val[3] = 115 (0x73) (s)
...
sm_container[1]
container_id = 1 (0x1) (P-CSCF IPV6 Address)
container_len = 16 (0x10)
address = 0x24098014820100100000000000000009 (2409:8014:8201:10:0:0:0:9)
sm_container[2]
container_id = 1 (0x1) (P-CSCF IPV6 Address)
container_len = 16 (0x10)
address = 0x24098014860100100000000000000009 (2409:8014:8601:10:0:0:0:9)
connectivity_type_incl = 0 (0x0)
7. 在注册成功后，UE通过订阅的方式从网络得到自己的状态。
IMS SIP Message -- IMS_SIP_SUBSCRIBE/INFORMAL_RESPONSE
Version = 1
Direction = UE_TO_NETWORK
SDP Presence = 0
SIP Call ID Length = 59
SIP Message Length = 893
SIP Message Logged Bytes = 894
Message ID = IMS_SIP_SUBSCRIBE
Response Code = INFORMAL_RESPONSE (0)
CM Call ID = 255
SIP Call ID = [email protected]:8804:8000:186e:9fb:f711:a6d6:ead
Sip Message = SUBSCRIBE sip:[email protected] SIP/2.0
f: ;tag=842022751
t:
CSeq: 842022747 SUBSCRIBE
i: [email protected]:8804:8000:186e:9fb:f711:a6d6:ead
v: SIP/2.0/UDP [2409:8804:8000:186e:9fb:f711:a6d6:ead]:8901;branch=z9hG4bK2298242861
Max-Forwards: 70
Route:
P-Access-Network-Info: 3GPP-E-UTRAN-TDD; utran-cell-id-3gpp=4600018BE192D322
Security-Verify: ipsec-3gpp;alg=hmac-md5-96;prot=esp;mod=trans;ealg=null;spi-c=3150465912;spi-s=3930932050;port-c=9950;port-s=9900
//UE是在查询注册的状态可以从"reg"关键字知道
o: reg
l: 0
Require: sec-agree
Proxy-Require: sec-agree
m:
//订阅周期
Expires: 600000
P-Preferred-Identity:
8. 网络收到订阅请求后通过200 Ok表示收到请求。
0x156E IMS SIP Message -- IMS_SIP_SUBSCRIBE/OK
Version = 1
Direction = NETWORK_TO_UE
SDP Presence = 0
SIP Call ID Length = 59
SIP Message Length = 816
SIP Message Logged Bytes = 817
Message ID = IMS_SIP_SUBSCRIBE
Response Code = OK (200)
CM Call ID = 255
SIP Call ID = [email protected]:8804:8000:186e:9fb:f711:a6d6:ead
Sip Message = SIP/2.0 200 OK
9. 接着网络向UE发送通知消息告诉UE的状态
0x156E IMS SIP Message -- IMS_SIP_NOTIFY/INFORMAL_RESPONSE
Version = 1
Direction = NETWORK_TO_UE
SDP Presence = 0
SIP Call ID Length = 59
SIP Message Length = 1737
SIP Message Logged Bytes = 1738
Message ID = IMS_SIP_NOTIFY
Response Code = INFORMAL_RESPONSE (0)
CM Call ID = 255
SIP Call ID = [email protected]:8804:8000:186e:9fb:f711:a6d6:ead
Sip Message = NOTIFY
...
Max-Forwards: 69
Event: reg
//订阅状态为active表明订阅已被接受且授权成功。时间周期为600000
Subscription-State: active;expires=600000
P-Asserted-Identity:
Content-Length: 666
Content-Type: application/reginfo+xml
sip:[email protected][2409:8804:8000:186E:09FB:F711:A6D6:0EAD]:8901;Hpt=8e82_16;srti=d0_1025
sip:[email protected][2409:8804:8000:186E:09FB:F711:A6D6:0EAD]:8901;Hpt=8e82_16;srti=d0_1025
10. 最后，UE回复200 Ok确认已经收到回复
2019 Jul 19 03:42:29.233 [FB] 0x156E IMS SIP Message -- IMS_SIP_NOTIFY/OK
Subscription ID = 1
Version = 1
Direction = UE_TO_NETWORK
SDP Presence = 0
SIP Call ID Length = 61
SIP Message Length = 695
SIP Message Logged Bytes = 696
Message ID = IMS_SIP_NOTIFY
Response Code = OK (200)
CM Call ID = 255
SIP Call ID = [email protected]:8805:445:24c3:17d1:369d:93a1:9217
Sip Message = SIP/2.0 200 OK
Via: SIP/2.0/UDP [2409:8095:0500:0000:0000:0000:0000:012F]:9900;branch=z9hG4bK5n9ncrlm5dlj3n4jj99cdb4gj;Role=3;Hpt=8e62_36;X-HwDim=3
Record-Route: <sip:[2409:8095:0500:0000:0000:0000:0000:012F]:9900;lr;Hpt=8e62_16;CxtId=3;TRC=ffffffff-ffffffff>
Call-ID: [email protected]:8805:445:24c3:17d1:369d:93a1:9217
From: <sip:[email protected]>;tag=ztesipUt0kdP15AOTda*9-12-16648*hbfh.9
To: +8615827428390 <sip:[email protected]>;tag=2002433287
CSeq: 1001 NOTIFY
Content-Length: 0
P-Access-Network-Info: 3GPP-E-UTRAN-TDD; utran-cell-id-3gpp=4600051D0DC5900B
User-Agent: KEPLER_SS8825_PKQ1.190223.001