[3GPP]如何学习 SMS 协议?

1. SMS AT 命令

一般情况下，AP 和 Modem 是通过 AT Command 或者类 AT Command 的消息进行发送和接收 SMS 的。

3GPP TS 27.005 Use of Data Terminal Equipment - Data Circuit terminating Equipment (DTE - DCE) interface for Short Message Service (SMS) and Cell Broadcast Service (CBS)
可参考如下两个 link 了解发送和接收 SMS 的 AT command：
Android S短消息接收流程
https://www.cnblogs.com/wuhen1024/p/16018666.html
Android S短消息发送流程
https://www.cnblogs.com/wuhen1024/p/16014413.html

2. 各系统下 SMS 架构

2.1. SMS 协议框架

如下协议介绍了 SMS 协议架构，主要是在 GSM、GPRS、WCDMA、LTE、NR 等制式下的 SMS 分层结构：
3GPP TS 24.011 Point-to-Point (PP) Short Message Service (SMS) support on mobile radio interface
2 Overview of Short Message Service (SMS) support
2.1 Protocols and protocol architecture

2.2. EPS 下 SMS over SGs

在 LTE Attach 时，必须支持 combined attach (PS+CS)。因为 SGs 是MME 与 MSC Server 的接口，而 MSC Server 需要 CS 注册才能从 LTE 获取 UE 数据。
3GPP TS 23.272 Circuit Switched (CS) fallback in Evolved Packet System (EPS); Stage 2
4.2 Reference Architecture
The CS fallback and SMS over SGs in EPS function is realized by using the SGs interface mechanism between the MSC Server and the MME.
Figure 4.2-1: EPS architecture for CS fallback and SMS over SGs

2.3. NR 下 SMS over NAS

3GPP TS 23.502 Procedures for the 5G System (5GS); Stage 2
4.13.3 SMS over NAS procedures
4.13.3.3 MO SMS over NAS in CM-IDLE (baseline)
4.13.3.6 MT SMS over NAS in CM-IDLE state via 3GPP access

2.4. SMS over IP

这里讲 SIP Register 有 "+g.3gpp.smsip" 标记则告知 IMS 网络 UE 有通过 IMS 接收 SMS的能力。
3GPP TS 24.341 Support of SMS over IP networks; Stage 3
3 Definitions and abbreviations
3.1 Definitions
SM-over-IP sender: the A party that sends an SM using a SIP MESSAGE request including a vnd.3gpp.sms payload (introduced in 3GPP TS 23.140 [4]).
SM-over-IP receiver: the B party that receives an SM encapsulated in the vnd.3gpp.sms payload of a SIP MESSAGE request.
5 SIP related procedures
5.3 Roles
5.3.2 SM-over-IP receiver
5.3.2.2 Registration
On sending a REGISTER request, the SM-over-IP receiver shall indicate its capability to receive traditional short messages over IMS network by including a "+g.3gpp.smsip" parameter into the Contact header according to RFC 3840 [16].

IMS Server 发送 SMS 到 IP-SM-GW(IP-SM Gateway)，下图是注册过程：
B.3 Signalling flows demonstrating how IP-SM-GW indicates to HSS the availability of public user identity for delivery of short messages

发送和接收过程：
B.5 Signalling flows demonstrating successful UE originated SM submit procedure over IP
B.6 Signalling flows demonstrating successful UE terminated SM deliver procedure over IP (including delivery report)

3GPP TS 23.204 Support of Short Message Service (SMS) over generic 3GPP Internet Protocol (IP) access; Stage 2
6.3 Transport-level interworking: Successful encapsulated Short Message origination procedure with MSISDN
6.4 Transport-level interworking: Successful encapsulated Short Message termination procedure from SMS-GMSC

3. SMS 应用层协议解析

3.1. SMS 各字段含义

3GPP TS 23.040 Technical realization of the Short Message Service (SMS)

3.2. SMS 内容编码规范

3GPP TS 23.038 Alphabets and language-specific information

4. SMS案例

4.1 (U)SIM Toolkit Security Headers

R15
MSG_ID_SMS_DELIVER|MSG_ID_SMS_SUBMIT|RP_DATA

SMS Deliver raw Data：

         01 00 07 91 41   40 27 95 20 f0 00 57 40
0a 91 88 38 72 91 00 7f   f6 22 11 50 01 63 85 00
45 02 70 00 00 40 15 0e   22 15 15 3f 00 00 b8 6f
95 b8 d8 50 83 07 19 75   e0 c0 dd 72 65 34 b1 62
1e 8e 7d 8e 65 99 1c df   c7 f8 ec 41 26 9e 26 05
1d 8b 7a 13 76 4d b0 03   87 e3 49 27 e0 cd 90 75
ab f4 90 66 b6 f1

GSM A-I/F RP - RP-DATA (Network to MS)
    Message Type RP-DATA (Network to MS)
    RP-Message Reference
        RP-Message Reference: 0x00 (0)
    RP-Originator Address - (14047259020)
        Length: 7
        1... .... = Extension: No Extension
        .001 .... = Type of number: International Number (0x1)
        .... 0001 = Numbering plan identification: ISDN/Telephony Numbering (ITU-T Rec. E.164 / ITU-T Rec. E.163) (0x1)
        Called Party BCD Number: 14047259020
    RP-Destination Address
        Length: 0
    RP-User Data
        Length: 87
        TPDU (not displayed)
GSM SMS TPDU (GSM 03.40) SMS-DELIVER
    0... .... = TP-RP: TP Reply Path parameter is not set in this SMS SUBMIT/DELIVER
    .1.. .... = TP-UDHI: The beginning of the TP UD field contains a Header in addition to the short message
    ..0. .... = TP-SRI: A status report shall not be returned to the SME
    .... 0... = TP-LP: The message has not been forwarded and is not a spawned message
    .... .0.. = TP-MMS: More messages are waiting for the MS in this SC
    .... ..00 = TP-MTI: SMS-DELIVER (0)
    TP-Originating-Address - (8883271900)
        Length: 10 address digits
        1... .... = Extension: No extension
        .001 .... = Type of number: International (1)
        .... 0001 = Numbering plan: ISDN/telephone (E.164/E.163) (1)
        TP-OA Digits: 8883271900
        E.164 number (MSISDN): 8883271900
            Country Code: Telecommunications for Disaster Relief (TDR) (888)
    TP-PID: 127
        01.. .... = Defines formatting for subsequent bits: 0x1
        ..11 1111 = Message type: (U)SIM Data download (63)
    TP-DCS: 246
        1111 .... = Coding Group Bits: Data coding/message class (15)
        .... 0... = Reserved: 0
        .... .1.. = Message coding: 8 bit data
        .... ..10 = Message Class: Class 2 (U)SIM specific message (0x2)
    TP-Service-Centre-Time-Stamp
        Year: 22
        Month: 11
        Day: 5
        Hour: 10
        Minutes: 36
        Seconds: 58
        Timezone: GMT + 0 hours 0 minutes
    TP-User-Data-Length: (69) depends on Data-Coding-Scheme
    TP-User-Data
        User-Data Header
            User Data Header Length: 2
            IE: (U)SIM Toolkit Security Headers (SMS Control)
                Information Element Identifier: 0x70
                Length: 0
        SMS body: 0040150e2215153f0000b86f95b8d85083071975e0c0dd726534b1621e8e7d8e65991cdf…

SMS Submit raw Data, 解析后面一条：

00 db 00 07 91 41 40 27 95 20 f0 1f 41 db 0a 91 88 38 72 91 00 7f f6 13 02 71 00 00 0e 0a 3f 00 00 00 00 00 01 2e 00 00 01 6e 00
00 db 00 07 91 41 40 27 95 20 f0 1f 45 db 0a 91 88 38 72 91 00 7f f6 13 02 71 00 00 0e 0a 3f 00 00 00 00 00 01 2e 00 00 01 6e 00

GSM A-I/F RP - RP-DATA (MS to Network)
    Message Type RP-DATA (MS to Network)
    RP-Message Reference
        RP-Message Reference: 0xdb (219)
    RP-Originator Address
        Length: 0
    RP-Destination Address - (14047259020)
        Length: 7
        1... .... = Extension: No Extension
        .001 .... = Type of number: International Number (0x1)
        .... 0001 = Numbering plan identification: ISDN/Telephony Numbering (ITU-T Rec. E.164 / ITU-T Rec. E.163) (0x1)
        Called Party BCD Number: 14047259020
    RP-User Data
        Length: 31
        TPDU (not displayed)
GSM SMS TPDU (GSM 03.40) SMS-SUBMIT
    0... .... = TP-RP: TP Reply Path parameter is not set in this SMS SUBMIT/DELIVER
    .1.. .... = TP-UDHI: The beginning of the TP UD field contains a Header in addition to the short message
    ..0. .... = TP-SRR: A status report is not requested
    ...0 0... = TP-VPF: TP-VP field not present (0)
    .... .1.. = TP-RD: Instruct SC to reject duplicates
    .... ..01 = TP-MTI: SMS-SUBMIT (1)
    TP-MR: 219
    TP-Destination-Address - (8883271900)
        Length: 10 address digits
        1... .... = Extension: No extension
        .001 .... = Type of number: International (1)
        .... 0001 = Numbering plan: ISDN/telephone (E.164/E.163) (1)
        TP-DA Digits: 8883271900
        E.164 number (MSISDN): 8883271900
            Country Code: Telecommunications for Disaster Relief (TDR) (888)
    TP-PID: 127
        01.. .... = Defines formatting for subsequent bits: 0x1
        ..11 1111 = Message type: (U)SIM Data download (63)
    TP-DCS: 246
        1111 .... = Coding Group Bits: Data coding/message class (15)
        .... 0... = Reserved: 0
        .... .1.. = Message coding: 8 bit data
        .... ..10 = Message Class: Class 2 (U)SIM specific message (0x2)
    TP-User-Data-Length: (19) depends on Data-Coding-Scheme
    TP-User-Data
        User-Data Header
            User Data Header Length: 2
            IE: (U)SIM Toolkit Security Headers (SMS Control)
                Information Element Identifier: 0x71
                Length: 0
        SMS body: 000e0a3f0000000000012e0000016e00

此类协议会在UDH中进行定义：
3GPP TS 23.040 Technical realization of the Short Message Service (SMS)
9.2.3.24.7 (U)SIM Toolkit Security Headers
具体的解析方式需要参考如下协议：
3GPP TS 31.115 (Universal) Subscriber Identity Module (U)SIM Toolkit applications
4.2 Structure of the Command Packet contained in a Single Short Message Point to Point

5. 参考资料

3GPP TS 24.301 Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3
4.3.2 Change of UE mode of operation
Figure 4.3.2.1.1: Change of UE mode of operation for a CS voice capable UE

9.9.3.44 Voice domain preference and UE's usage setting
3GPP TS 24.008 Mobile radio interface Layer 3 specification; Core network protocols; Stage 3
10.5.5.28 Voice domain preference and UE's usage setting

http://www.nobbi.com/pduspy.html
http://smstools3.kekekasvi.com/topic.php?id=288
http://3gppdecoder.free.fr/?q=node/1
https://smspdu.benjaminerhart.com/
https://onlinehextools.com/convert-hex-to-string

posted @ 2022-12-05 15:32  无痕1024  阅读(105)  评论(0)    收藏  举报