🌐 中文版：繁體中文

User identifiers and location identifiers

User identifiers split into permanent and non-permanent:

  • Permanent identifiers
    Once bound to a user they aren’t modified, offering a degree of privacy

    1
    2
    3
    1. SUPI
    2. Generic Public Subscription Identifier (GPSI)
    3. Permanent Equipment Identifier (PEI)

  • Non-permanent identifiers
    Used to temporarily identify a user; 3GPP periodically changes the identifier

    1
    2
    1. 5G Globally Unique Temporary Identifier (5G-GUTI)
    2. SUCI

    Location identifiers include the Tracking Area Identity (TAI) and Tracking Area Code (TAC).

SUPI

The SUPI is a permanent identifier; every subscribed user in the 5G system is allocated a 5G SUPI, used to identify that subscriber within the 3GPP system.
The SUPI is stored in UDM/UDR (an NF), functioning like 4G’s IMSI.
The SUPI can contain IMSI information or a network-specific identifier for private networks.

IMSI format:

Field MCC MNC MSIN
Length 3bit 2~3bit <=10bit
PLMN PLMN
  • In roaming scenarios: the SUPI must carry the home network’s address info: MNC, MCC
  • When interworking with an EPC network: the SUPI is always based on IMSI

Generic Public Subscription Identifier (GPSI)

The GPSI is a permanent identifier, used to identify a 3GPP subscription within non-3GPP networks.
The GPSI-to-3GPP mapping is stored in the subscription data; the GPSI can serve as a public identifier both inside and outside the system.
The GPSI can be an MSISDN or another external identifier.

Permanent Equipment Identifier (PEI)

The PEI is a permanent identifier, for a 3GPP UE accessing the 5G network.
For different UE types and use cases, the PEI may have different formats.
When sending the PEI, the UE can carry instruction info corresponding to the format used by that PEI.
If the UE supports at least one 3GPP access technology, its PEI must use the IMEI or IMEISV format.

5G Globally Unique Temporary Identifier (5G-GUTI)

The 5G-GUTI is a non-permanent identifier, temporarily allocated to the UE by the AMF (during the registration procedure), used to identify that UE.
The same 5G-GUTI is used for different access methods (3GPP, non-3GPP).

  • Structure of the 5G-GUTI:

    1
    2
    3
    <5G-GUTI>:=<GUAMI><5G-TMSI> (:= is the symbol for "defined as")
    <GUAMI>: used to identify one or more AMFs
    <5G-TMSI>: used to uniquely identify the UE

  • Structure of the GUAMI:

    1
    2
    3
    4
    5
    <GUAMI>:= <MCC><MNC><AMF Region ID><AMF Set ID><AMF Pointer>

    <AMF Region ID>: used to identify a region
    <AMF Set ID>: uniquely identifies a set of AMFs within an AMF region
    <AMF Pointer>: uniquely identifies an AMF within an AMF set

  • The 5G-S-TMSI is a shortened form of the GUTI, used in radio signaling (paging or service-request procedures) to improve transmission efficiency.

  • Structure of the 5G-S-TMSI:

    1
    <5G-S-TMSI>:= <AMF Set ID><AMF Pointer><5G-TMSI>

  • The 10 least-significant bits of the 5G-TMSI are used by the NG-RAN to determine the UE’s paging occasion

    • so these 10 least-significant bits should be evenly distributed, making different UEs’ paging occasions evenly distributed
MCC MNC AMF Region ID AMF Set ID AMF Pointer 5G-TMSI
12bit 8/12bit 16bit 4bit 4bit 32bit
PLMN PLMN AMF ID AMF ID AMF ID
GUAMI GUAMI GUAMI GUAMI GUAMI
5G-S-TMSI 5G-S-TMSI 5G-S-TMSI
5G-GUTI 5G-GUTI 5G-GUTI 5G-GUTI 5G-GUTI 5G-GUTI

SUCI

The SUCI is a non-permanent identifier, a privacy-protecting identifier formed from an encrypted form of the SUPI (Subscription Permanent Identifier).
Since each subscriber’s SUPI is permanent and unique, transmitting it directly poses a privacy risk.

The UE (USIM or ME) can generate the SUCI based on ECIES, or even the Null-Scheme.
When the AMF receives the SUCI, it triggers the authentication procedure, after which a decryption algorithm (SIDF) in the UDM/SIDF decodes the received SUCI into the SUPI to complete subsequent authentication.

TAI & TAC

Both are location identifiers.
TAI: Tracking Area Identity
TAC: Tracking Area Code

  • Format:
    MCC MNC TAC
    12bit 8/12bit 20bit
    PLMN ID PLMN ID TAC
    TAI TAI TAI

Security architecture and procedures

When a UE moves within the RAN or between different networks, it needs to mutually authenticate with the network to ensure both sides are trustworthy.
Mutual authentication between the UE and network needs the support of the 5G security architecture.
The 5G security architecture should include:

1
2
3
- mitigating and reducing attacks
- supporting authentication and authorization mechanisms
- supporting key-related functions

Features of the security architecture

  • A security architecture independent of the access method (3GPP, non-3GPP), using a unified authentication method and key architecture
  • Enhanced security (4G → IMSI → insecure | 5G → SUCI/SUPI → secure)
  • Differentiated authentication: 5G supports USIM, certificates, username/password, and other authentication methods
  • Service-based architecture and open-interface security

The NFs involved in the security architecture include: ARPF, AUSF, SEAF, SIDF

  • ARPF:
    • deployed together with UDM
    • responsible for storing the root key $Ki$ and related subscription data
    • computes 5G authentication vectors
  • AUSF:
    • provides the EAP authentication server function, performing EAP authentication to derive the anchor key
  • SEAF:
    • deployed together with AMF
    • responsible for deriving the lower-layer NAS and AS keys from the anchor key, and completing the 5G AKA authentication-result comparison function
  • SIDF:
    • deployed together with UDM
    • responsible for decoding the SUCI into the SUPI

Security procedures

  • The UE initiates a request, sending a SUCI or 5G-GUTI message to the SEAF
  • The SEAF sends the SUCI or SUPI (if the 5G-GUTI is valid) to the AUSF of the home network
  • After the AUSF completes authentication, it sends a message to the home network’s UDM
  • The UDM receives the SUCI, decodes it into the SUPI, selects the corresponding authentication algorithm based on the subscriber data, and completes identity authentication through the subsequent procedure

The authentication algorithms 5G currently supports: EAP-AKA’ and 5G AKA - 3GPP TS 33.501

References

https://cat.chriz.hk/2019/12/5g-security-architecture.html