Identifier Dictionary (Identifier)¶
A dictionary for looking up the key identifiers of 5GC that identify UEs, subscribers, NFs, and slices, by meaning, structure, and usage.
Related: NF Dictionary / Security Dictionary / Registration chapter
Identifier list¶
| Identifier | Full name | What it identifies | Structure/Characteristics | Main use | Spec |
|---|---|---|---|---|---|
| SUPI | Subscription Permanent Identifier | Permanently identifies the subscriber (subscription) | IMSI format or NAI format. Not sent in cleartext over the air because it is a permanent identifier | Identifying the subscriber within the core | TS 23.003 / TS 23.501 |
| SUCI | Subscription Concealed Identifier | A concealed SUPI (temporary form) | A form in which SUPI is concealed with public-key encryption. What is sent over the air at initial registration is the SUCI; the SIDF within the UDM de-conceals it to obtain the SUPI | Privacy protection of the subscriber ID | TS 33.501 / TS 23.003 |
| 5G-GUTI | 5G Globally Unique Temporary Identity | Temporarily identifies the UE | Composed of GUAMI + 5G-TMSI. Avoids exposing the IMSI/SUPI and is used for subsequent identification | UE identification after registration and paging | TS 23.003 |
| GUAMI | Globally Unique AMF Identifier | Uniquely identifies the serving AMF | PLMN ID + AMF Region ID / AMF Set ID / AMF Pointer | Identifying the AMF; part of the 5G-GUTI | TS 23.003 |
| 5G-TMSI | 5G Temporary Mobile Subscription Identifier | The UE-temporary-identification portion within the 5G-GUTI | The trailing part of the 5G-GUTI. Temporarily points to the UE | Temporary UE identification | TS 23.003 |
| PEI | Permanent Equipment Identifier | Permanently identifies the terminal (ME) | Usually IMEI or IMEISV | Identifying the individual terminal | TS 23.003 |
| GPSI | Generic Public Subscription Identifier | Subscriber identifier for external exposure | An external identifier format such as MSISDN | Referencing the subscriber in external exposure such as NEF/AF interworking | TS 23.003 |
| S-NSSAI | Single Network Slice Selection Assistance Information | Identifies a single network slice | Composed of SST (mandatory) + SD (optional) | Slice selection and identification | TS 23.003 / TS 23.501 |
| NSSAI | Network Slice Selection Assistance Information | A set of slice selection information | A set of S-NSSAIs. There are types such as Requested/Allowed/Configured | Slice selection (for details see Network Slicing) | TS 23.501 |
| DNN | Data Network Name | Identifies the destination data network | A name equivalent to the APN in 4G | Specifying the destination network of a PDU session | TS 23.003 |
| NF Instance ID | NF Instance ID | Uniquely identifies an NF instance | A unique identifier for each NF instance | Registration to the NRF and NF Discovery | TS 29.510 (to be confirmed: section number) |
| AMF UE NGAP ID / RAN UE NGAP ID | AMF/RAN UE NGAP ID | An ID pair that identifies the UE over N2 | The NGAP IDs assigned by the AMF side and the RAN side respectively | UE-associated signalling over N2 (NGAP) | TS 38.413 |
(Details that are hard to state definitively, such as bit length and number of digits, are kept as conceptual descriptions, and marked "to be confirmed" as needed)
SUPI/SUCI and privacy
Because the permanent identifier SUPI is not sent in cleartext over the air, the SUCI, concealed with a public key, is used initially, and the network side (the SIDF within the UDM) de-conceals it to obtain the SUPI. Thereafter, using the temporary identifier 5G-GUTI minimizes exposure of the permanent ID. For details see the Security Dictionary / Authentication chapter.
Diagram 1: the nested structure of 5G-GUTI¶
The 5G-GUTI is composed of multiple identifiers nested together. Turning the "Structure/Characteristics" column of the table above (5G-GUTI = GUAMI + 5G-TMSI, GUAMI = PLMN ID + AMF Region ID + AMF Set ID + AMF Pointer) into a diagram makes it clear at a glance which part "points to the network/AMF" and which "points to the UE".
flowchart TB
GUTI["5G-GUTI
(temporary UE identifier after registration)"]
subgraph L1[" "]
direction LR
GUAMI["GUAMI
Uniquely identifies the serving AMF"]
TMSI["5G-TMSI
Temporarily identifies the UE under that AMF"]
end
subgraph L2["Breakdown of GUAMI"]
direction LR
PLMN["PLMN ID
(operator network)"]
REG["AMF Region ID
(region)"]
SET["AMF Set ID
(AMF group)"]
PTR["AMF Pointer
(individual AMF)"]
end
GUTI --> GUAMI
GUTI --> TMSI
GUAMI --> PLMN
GUAMI --> REG
GUAMI --> SET
GUAMI --> PTR
classDef net fill:#eef,stroke:#66a;
classDef ue fill:#efe,stroke:#3a3;
class GUAMI,PLMN,REG,SET,PTR net;
class TMSI ue;
How to read the diagram
The blue-toned parts (GUAMI and its breakdown) point to "which network, which AMF," while the green-toned part (5G-TMSI) points to "which UE under that AMF." In other words, the 5G-GUTI has the structure "the AMF's address (GUAMI) + the UE's number within it (5G-TMSI)," and this design lets the UE be correctly identified for paging and subsequent identification without exposing the permanent identifier (SUPI). For the bit length of each field, refer to TS 23.003 (this diagram is a conceptual representation of the structure).
Diagram 2: the SUPI → SUCI → 5G-GUTI transformation flow¶
This is the flow in which the identifiers pointing to the same UE change their form for each situation in order to protect privacy. The aim is to minimize exposure of the permanent ID (SUPI).
sequenceDiagram
autonumber
participant UE
participant AMF as AMF/SEAF
participant UDM as UDM (SIDF)
Note over UE: Permanent ID = SUPI (never sent in cleartext over the air)
UE->>UE: Conceal SUPI with the public key → generate SUCI
UE->>AMF: Initial registration: send SUCI (over the air)
AMF->>UDM: Pass the SUCI
UDM->>UDM: SIDF decrypts with the private key → recover SUPI
UDM-->>AMF: SUPI (used only inside the core)
Note over AMF: After registration succeeds, the AMF assigns a 5G-GUTI
AMF-->>UE: Issue the 5G-GUTI
Note over UE,AMF: Subsequent identification and paging use the 5G-GUTI
(the SUPI is never exposed over the air)
How to read the diagram
SUPI (the permanent ID) is not put on the air; on the UE side it is converted to SUCI (the concealed form) with a public key and sent. In the network, only the SIDF within the UDM de-conceals it with the private key to obtain the SUPI. Once registration is complete, the AMF issues the temporary ID 5G-GUTI, and subsequent identification and paging use this. This minimizes exposure of the permanent ID (SUPI). For details see the Authentication chapter / Security Dictionary.