eMTC测试信令分析之NAS Attach和TAU

iyangxin

简介

自3GPP R13推出eMTC（即LTE CAT-M1）标准以来，eMTC技术在全世界得到了广泛的应用。相比其他广域低功耗网络的技术如NB-IoT、2G、LoRA等，eMTC具有非常明显的优势，功耗低，移动性好，时延低，支持VoLTE语音，兼容LTE所以组网成本低，终端复杂度低，终端成本低，覆盖好，技术成熟度好。
目前eMTC技术已经成为北美、日本、澳洲、欧洲作为替代2G、3G的广域低功耗物联网主要技术方向。
国内由于政策原因，目前主推NB-IoT，但实际上各大运营商都已经对eMTC做了研究了实验网。只要政策放开，随时可以启动商用。

eMTC的NAS Attach信令

关于eMTC的NAS Attach的协议标准，可以阅读3GPP 24.301。
这里我们还是从实战出发，直接使用eMTC终端接入eMTC网络，在这个过程中，抓取整个入网过程的信令，对信令原始数据进行解码分析。
使用普通的信令综测仪可以测试eMTC信令接入，但是我们希望模拟现实商用的eMTC网络。比如美国Verizon的eMTC网络就是运行在其覆盖全美的4G LTE网络上的。网络里同时存在LTE终端和eMTC终端。在国内，我们可以使用微戎WR100来模拟美国运营商这样的LTE和eMTC共存的网络。
在WR100的配置界面上，设置为LTE FDD Band 13，同时勾选上eMTC，这样就可以同时使能Band 13的LTE和eMTC网络。将测试SIM卡插入两部支持Band 13的LTE手机，可以看到手机已经注册上网络，并且完成IMS注册，此时两部手机已经可以互相收发短信和拨打电话。我们再把测试 SIM卡插入eMTC终端，通过SIM卡的IMSI尾号005，我们在WR100配置界面上看到eMTC终端也成功接入网络。

WR100配置界面上可以进行信令跟踪，保存信令。下面是对刚刚eMTC接入网路过程的NAS Attach信令进行分析

NAS Attach request消息

下面是eMTC终端发到微戎WR100的Attach request消息

  [NAS] UL 2677 EMM: Attach request    Protocol discriminator = 0x7 (EPS Mobility Management)    Security header = 0x1 (Integrity protected)    Auth code = 0xf9b63a0e    Sequence number = 0x06    Protocol discriminator = 0x7 (EPS Mobility Management)    Security header = 0x0 (Plain NAS message, not security protected)    Message type = 0x41 (Attach request)    EPS attach type = 2 (combined EPS/IMSI attach)    NAS key set identifier:      TSC = 0      NAS key set identifier = 0    Old GUTI or IMSI:      MCC = 001      MNC = 01       MME Group ID = 32769      MME Code = 1      M-TMSI = 0x73898fb8    UE network capability:      0xf0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=1, EEA4=0, EEA5=0, EEA6=0, EEA7=0)      0xf0 (EIA0=1, 128-EIA1=1, 128-EIA2=1, 128-EIA3=1, EIA4=0, EIA5=0, EIA6=0, EIA7=0)      0x00 (UEA0=0, UEA1=0, UEA2=0, UEA3=0, UEA4=0, UEA5=0, UEA6=0, UEA7=0)      0x00 (UCS2=0, UIA1=0, UIA2=0, UIA3=0, UIA4=0, UIA5=0, UIA6=0, UIA7=0)      0x00 (ProSe-dd=0, ProSe=0, H.245-ASH=0, ACC-CSFB=0, LPP=0, LCS=0, 1xSRVCC=0, NF=0)      0x10 (ePCO=0, HC-CP CIoT=0, ERw/oPDN=0, S1-U data=1, UP CIoT=0, CP CIoT=0, ProSe-relay=0, ProSe-dc=0)      0x00 (15 bearers=0, SGC=0, N1mode=0, DCNR=0, CP backoff=0, RestrictEC=0, V2X PC5=0, multipleDRB=0)    ESM message container:      Protocol discriminator = 0x2 (EPS Session Management)      EPS bearer identity = 0      Procedure transaction identity = 3      Message type = 0xd0 (PDN connectivity request)      Request type = 1 (initial request)      PDN type = 3 (IPv4v6)      Protocol configuration options:        Ext = 1        Configuration protocol = 0        Protocol ID = 0x8021 (IPCP)        Data = 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00        Protocol ID = 0x0003 (DNS Server IPv6 Address Request)        Data =        Protocol ID = 0x000a (IP address allocation via NAS signalling)        Data =        Protocol ID = 0x000d (DNS Server IPv4 Address Request)        Data =        Protocol ID = 0x0010 (IPv4 Link MTU Request)        Data =      Device properties = 0x00 (not configured for NAS signalling low priority)    Last visited registered TAI:      MCC = 001      MNC = 01       TAC = 0x0001    Old location area identification:      Data = 00 f1 10 00 01    Mobile station classmark 2:      Length = 3      Data = 47 08 00    Additional update type = 0x01 (no additional information, keeping NAS signalling connection not required, SMS only)    Old GUTI type = 0    MS network feature support = 0x01 (MS supports the extended periodic timer in this domain)    TMSI based NRI container:      Length = 2      Data = 13 00

NAS Attach accept消息

下面是微戎WR100回复的Attach accept消息。通过该消息，eMTC终端建立起了默认承载，并且获得到了IP地址。

[NAS] DL 2677 EMM: Attach accept    Protocol discriminator = 0x7 (EPS Mobility Management)    Security header = 0x2 (Integrity protected and ciphered)    Auth code = 0x1029edba    Sequence number = 0x03    Protocol discriminator = 0x7 (EPS Mobility Management)    Security header = 0x0 (Plain NAS message, not security protected)    Message type = 0x42 (Attach accept)    EPS attach result = 2 (combined EPS/IMSI attach)    T3412 value:      Value = 5      Unit = 1 (1 minute)    TAI list:      Length = 6      Data = 00 00 f1 10 00 01    ESM message container:      Protocol discriminator = 0x2 (EPS Session Management)      EPS bearer identity = 5      Procedure transaction identity = 3      Message type = 0xc1 (Activate default EPS bearer context request)      EPS Qos:        QCI = 9      Access point name = "default.mnc001.mcc001.gprs"      PDN address:        PDN type = 1 (IPv4)        IPv4 = 192.168.9.2      ESM cause = 0x32 (PDN type IPv4 only allowed)      Protocol configuration options:        Ext = 1        Configuration protocol = 0        Protocol ID = 0x8021 (IPCP)        Data = 03 00 00 0a 81 06 ca 60 86 85        Protocol ID = 0x000d (DNS Server IPv4 Address)        Data = ca 60 86 85    GUTI:      MCC = 001      MNC = 01       MME Group ID = 32769      MME Code = 1      M-TMSI = 0x73898fb8    Location area identification:      Data = 00 f1 10 00 01    MS identity:      TMSI/P-TMSI/M-TMSI = 0x73898fb8    Emergency number list:      Length = 8      Data = 03 1f 19 f1 03 1f 11 f2    EPS network feature support:      0x01 (CP CIoT=0, ERw/oPDN=0, ESRPS=0, CS-LCS=0, EPC-LCS=0, EMC BS=0, IMS VoPS=1)    Additional update result = 0x02 (SMS only)

NAS Attach complete消息   [NAS] UL 2677 EMM: Attach complete    Protocol discriminator = 0x7 (EPS Mobility Management)    Security header = 0x2 (Integrity protected and ciphered)    Auth code = 0xf0a95e39    Sequence number = 0x07    Protocol discriminator = 0x7 (EPS Mobility Management)    Security header = 0x0 (Plain NAS message, not security protected)    Message type = 0x43 (Attach complete)    ESM message container:      Protocol discriminator = 0x2 (EPS Session Management)      EPS bearer identity = 5      Procedure transaction identity = 0      Message type = 0xc2 (Activate default EPS bearer context accept)    00:00:40.780 [NAS] DL 2677 EMM: EMM information    Protocol discriminator = 0x7 (EPS Mobility Management)    Security header = 0x2 (Integrity protected and ciphered)    Auth code = 0xac51debc    Sequence number = 0x04    Protocol discriminator = 0x7 (EPS Mobility Management)    Security header = 0x0 (Plain NAS message, not security protected)    Message type = 0x61 (EMM information)    Full name for network:      Length = 14      Data = 86 d7 72 5a fe 76 83 9c 65 fa fd 2d 5f 03    Short name for network:      Length = 7      Data = 86 d7 72 5a fe 76 03    Local time zone = 0    Universal time and local time zone:      Data = 91 80 71 00 00 04 00    Network daylight saving time:      Length = 1      Data = 00

Tracking area update request    [NAS] UL 2681 EMM: Tracking area update request    Protocol discriminator = 0x7 (EPS Mobility Management)    Security header = 0x1 (Integrity protected)    Auth code = 0xdaef7b3c    Sequence number = 0x0a    Protocol discriminator = 0x7 (EPS Mobility Management)    Security header = 0x0 (Plain NAS message, not security protected)    Message type = 0x48 (Tracking area update request)    EPS update type:      Value = 3 (periodic updating)      Active flag = 0    NAS key set identifier:      TSC = 0      NAS key set identifier = 0    Old GUTI:      MCC = 001      MNC = 01       MME Group ID = 32769      MME Code = 1      M-TMSI = 0x73898fb8    Last visited registered TAI:      MCC = 001      MNC = 01       TAC = 0x0001    EPS bearer context status:      Length = 2      Data = 20 00    Additional update type = 0x01 (no additional information, keeping NAS signalling connection not required, SMS only)    Old GUTI type = 0    MS network feature support = 0x01 (MS supports the extended periodic timer in this domain)

Tracking area update accept    [NAS] DL 2681 EMM: Tracking area update accept    Protocol discriminator = 0x7 (EPS Mobility Management)    Security header = 0x2 (Integrity protected and ciphered)    Auth code = 0x7fba2f00    Sequence number = 0x05    Protocol discriminator = 0x7 (EPS Mobility Management)    Security header = 0x0 (Plain NAS message, not security protected)    Message type = 0x49 (Tracking area update accept)    EPS update result = 1 (combined TA/LA updated)    T3412 value:      Value = 5      Unit = 1 (1 minute)    GUTI:      MCC = 001      MNC = 01       MME Group ID = 32769      MME Code = 1      M-TMSI = 0x73898fb8    TAI list:      Length = 6      Data = 00 00 f1 10 00 01    EPS bearer context status:      Length = 2      Data = 20 00    Location area identification:      Data = 00 f1 10 00 01    Emergency number list:      Length = 8      Data = 03 1f 19 f1 03 1f 11 f2    EPS network feature support:      0x01 (CP CIoT=0, ERw/oPDN=0, ESRPS=0, CS-LCS=0, EPC-LCS=0, EMC BS=0, IMS VoPS=1)    Additional update result = 0x02 (SMS only)

Detach request    [NAS] UL 2675 EMM: Detach request    Protocol discriminator = 0x7 (EPS Mobility Management)    Security header = 0x1 (Integrity protected)    Auth code = 0x06c6f8e9    Sequence number = 0x05    Protocol discriminator = 0x7 (EPS Mobility Management)    Security header = 0x0 (Plain NAS message, not security protected)    Message type = 0x45 (Detach request)    Detach type = 11 (switch_off=1, combined EPS/IMSI detach)    NAS key set identifier = 0    GUTI or IMSI:      MCC = 001      MNC = 01       MME Group ID = 32769      MME Code = 1      M-TMSI = 0x73898fb8