SUPI / SUCI / 5G-GUTI — How the 5GC Identifies a UE¶

Learning objectives¶

After reading this chapter, you will be able to:

• Explain SUPI / SUCI / 5G-GUTI by their different purposes: permanent ID, concealed ID and temporary ID
• Explain the internal structure of the SUCI (SUPI Type / Home Network Identifier / Routing Indicator / Protection Scheme Identifier / Home Network Public Key Identifier / Scheme Output) and which parts remain in clear text
• Explain why SUCI→SUPI de-concealment is performed by the SIDF on the UDM side, not by the AMF
• Draw the containment relationship and bit lengths of 5G-GUTI / 5G-S-TMSI / 5G-TMSI
• Check the type of 5GS mobile identity (SUCI / 5G-GUTI, etc.) in Wireshark and troubleshoot cases such as "the UE sent a 5G-GUTI but received an Identity Request"

Prerequisites¶

• Registration (Initial Registration) — the procedure in which the identifiers actually flow
• Authentication — how the SUCI is passed to the AUSF/UDM
• Security — basics of NAS security and SUCI concealment
• Supplementary: Identifier Dictionary (quick lookup) / AMF / UDM

Why — why does a UE need three kinds of "names"?¶

Open a 5GC trace and you will find many names that refer to a UE.

SUPI / SUCI / 5G-GUTI / 5G-S-TMSI / 5G-TMSI / PEI / RAN UE NGAP ID / AMF UE NGAP ID

If the subscriber's permanent ID (SUPI) were sent as-is over the radio every time, a third party could track "the same subscriber is here again" just by eavesdropping on the radio. This is the subscriber privacy problem, which IMSI catchers (fake base stations) have exploited in 4G and earlier.

On the other hand, the network must reliably identify the subscriber, or it cannot authenticate, charge or deliver incoming calls. To satisfy both "hide it" and "identify it," the 5GC uses three identifiers with different purposes.

Analogy: Think of a hospital. The SUPI is "the real name on your insurance card," the SUCI is "your insurance card inside an envelope that only the hospital headquarters can open," and the 5G-GUTI is "the numbered ticket you get at reception (the counter number + your number)." In the waiting room you are called by your ticket number, and your real name is never called out loud.

What — what the three identifiers really are¶

The overall relationship¶

flowchart LR
    SUPI["SUPI
permanent ID (real name)"]
    SUCI["SUCI
concealed ID (sealed)"]
    GUTI["5G-GUTI
temporary ID (ticket)"]
    SUPI -- "UE (USIM/ME) conceals with the HN public key" --> SUCI
    SUCI -- "only the SIDF in the UDM de-conceals" --> SUPI
    SUPI -. "allocated by the AMF after successful registration (mathematically unrelated to the SUPI)" .-> GUTI

The key point is that the 5G-GUTI is not computed from the SUPI. The SUCI is an encryption of the SUPI (and can be restored to the SUPI), but the 5G-GUTI is a number allocated by the AMF, and its mapping to the SUPI exists only in the AMF's UE context (or, in deployments where AMFs in the same AMF Set share context via a UDSF or similar, in that shared context).

SUPI (Subscription Permanent Identifier)¶

The SUPI is the permanent identifier of a subscription in the 5GS (TS 23.501 §5.9.2, TS 23.003 §2.2A). Note that it refers to the subscription, not the "device." The device (equipment) has a separate identifier, the PEI (Permanent Equipment Identifier, e.g. IMEI) (TS 23.501 §5.9.3).

The SUPI mainly takes one of two forms (TS 23.003 §2.2A).

SUCI (Subscription Concealed Identifier)¶

The SUCI is the concealed form of the SUPI (TS 23.501 §5.9.2a, TS 23.003 §2.2B, TS 33.501 §6.12). However, the SUCI is not entirely ciphertext. The parts needed for routing remain in clear text so that the home network can receive and process it.

flowchart LR
    subgraph Clear["Parts left in clear text (clues for routing and de-concealment)"]
        T["SUPI Type"]
        H["Home Network Identifier
(MCC+MNC for IMSI)"]
        R["Routing Indicator"]
        P["Protection Scheme Identifier"]
        K["Home Network Public Key Identifier"]
    end
    subgraph Enc["Concealed part"]
        S["Scheme Output
(conceals the MSIN for IMSI)"]
    end
    T --- H --- R --- P --- K --- S
    classDef clr fill:#e8f0fe,stroke:#3b5bdb;
    classDef enc fill:#fde2e1,stroke:#c92a2a;
    class T,H,R,P,K clr;
    class S enc;

The protection schemes are specified in TS 33.501 Annex C.

With ECIES the UE generates an ephemeral key pair every time, so the SUCI has a different value every time even for the same SUPI. This is the basis for unlinkability (an eavesdropper cannot link two SUCIs to the same subscriber). The null-scheme does not have this property.

Who turns the SUCI back into the SUPI? — the SIDF¶

The AMF does not de-conceal the SUCI. The home network's SIDF (Subscription Identifier De-concealing Function) does, and the SIDF is positioned as a service provided by the UDM (TS 33.501 §6.12.2).

sequenceDiagram
    participant UE
    participant AMF as AMF (SEAF)
    participant AUSF
    participant UDM as UDM (SIDF / ARPF)
    UE->>AMF: Registration Request (5GS mobile identity = SUCI)
    AMF->>AUSF: Nausf_UEAuthentication_Authenticate (SUCI, SN name)
    AUSF->>UDM: Nudm_UEAuthentication_Get (SUCI, SN name)
    UDM->>UDM: SIDF: restores SUCI → SUPI with the private key
    UDM-->>AUSF: authentication vector + SUPI
    Note over AUSF,AMF: The SUPI reaches the AMF
only after successful authentication
    AUSF-->>AMF: authentication result + SUPI (after confirmation in 5G AKA)

• Why the AMF does not de-conceal — Distributing the HN private key to AMFs in visited networks (the VPLMN when roaming) would widen the key's exposure too much. Keeping the private key inside the HPLMN's UDM/SIDF means that, when the UE registers with a SUCI, the SUPI is not given even to the visited network until authentication succeeds.
• When the SUPI reaches the AMF — When the UE registers with a SUCI, the AUSF provides the SUPI to the SEAF (AMF) after successful authentication (5G AKA: TS 33.501 §6.1.3.2 / EAP-AKA': §6.1.3.1). When the UE registers with a 5G-GUTI and the new AMF can retrieve the context from the old AMF, the new AMF receives it via the old AMF (TS 23.502 §4.2.2.2.2).

5G-GUTI (5G Globally Unique Temporary Identifier)¶

The 5G-GUTI is a temporary identifier that the AMF allocates to the UE (TS 23.501 §5.9.4, TS 23.003 §2.10.1). Its structure is as follows.

<5G-GUTI>    = <GUAMI><5G-TMSI>
<GUAMI>      = <MCC><MNC><AMF Identifier>
<AMF Identifier> = <AMF Region ID><AMF Set ID><AMF Pointer>
<5G-S-TMSI>  = <AMF Set ID><AMF Pointer><5G-TMSI>

The bit lengths are specified in TS 23.003 §2.10.1. The first half, the GUAMI, says "which AMF," and the second half, the 5G-TMSI, says "which UE in that AMF." The GUAMI is covered in detail in the next chapter.

5G-S-TMSI — the "short form" for the radio interface¶

The 5G-S-TMSI (48 bits) is a shortened form of the 5G-GUTI without the PLMN and the AMF Region ID (TS 23.501 §5.9.4, TS 23.003 §2.10.1; to be confirmed). It is used when the UE must be identified efficiently over the radio interface, such as in Paging and Service Request. In RRC it is split into ng-5G-S-TMSI-Part1 (39 bits) and Part2 (9 bits) so that it fits into the RRCSetupRequest (TS 38.331 §6.2.2).

flowchart TD
    GUTI["5G-GUTI"] --> GUAMI["GUAMI
MCC+MNC+Region(8)+Set(10)+Pointer(6)"]
    GUTI --> TMSI["5G-TMSI (32)"]
    STMSI["5G-S-TMSI (48)
= Set(10)+Pointer(6)+5G-TMSI(32)"]
    GUAMI -. "take Set ID / Pointer" .-> STMSI
    TMSI -. "as-is" .-> STMSI

When does the 5G-GUTI change?¶

Because the 5G-GUTI is a temporary ID, using the same value for a long time gives trackers a clue. TS 33.501 therefore requires that a new 5G-GUTI be allocated on occasions such as a registration accepted after NAS security is established and a Service Request in response to Paging (TS 33.501 §6.12.3; clause number to be confirmed). Allocation can be done in the Registration Accept and also with the Generic UE Configuration Update procedure (TS 24.501 §5.4.4).

How — how the identifiers change during Registration¶

Call Flow (initial registration: no 5G-GUTI → SUCI)¶

sequenceDiagram
    participant UE
    participant gNB
    participant AMF
    participant AUSF
    participant UDM as UDM (SIDF)
    Note over UE: no valid 5G-GUTI
    UE->>gNB: RRCSetupRequest (ue-Identity = random value)
    UE->>gNB: RRCSetupComplete (NAS: Registration Request)
    gNB->>AMF: Initial UE Message (NAS-PDU)
    Note over AMF: 5GS mobile identity = SUCI
    AMF->>AUSF: Nausf_UEAuthentication_Authenticate (SUCI)
    AUSF->>UDM: Nudm_UEAuthentication_Get (SUCI)
    UDM->>UDM: SIDF: SUCI → SUPI
    UDM-->>AUSF: AV + SUPI
    AUSF-->>AMF: authentication challenge
    AMF->>UE: Authentication Request / Response
    AMF->>AUSF: authentication confirmation
    AUSF-->>AMF: authentication success + SUPI
    AMF->>UE: Security Mode Command / Complete
    Note over AMF: UDM registration and subscription data retrieval with the SUPI
    AMF->>UE: Registration Accept (5G-GUTI) — start T3550
    UE-->>AMF: Registration Complete — stop T3550
    Note over UE,AMF: from now on the UE uses the 5G-GUTI / 5G-S-TMSI

Call Flow (re-registration: existing 5G-GUTI → context retrieval from the old AMF)¶

When the UE moves to an area managed by a different AMF, the new AMF identifies the old AMF from the GUAMI in the 5G-GUTI and retrieves the UE context (TS 23.502 §4.2.2.2.2).

sequenceDiagram
    participant UE
    participant NewAMF as New AMF
    participant OldAMF as Old AMF
    UE->>NewAMF: Registration Request (5GS mobile identity = 5G-GUTI)
    NewAMF->>NewAMF: identify the old AMF from the GUAMI in the 5G-GUTI
    NewAMF->>OldAMF: Namf_Communication_UEContextTransfer (N14)
    alt context retrieved
        OldAMF-->>NewAMF: UE Context (SUPI, security context, etc.)
        Note over NewAMF: may re-run UE authentication even after retrieval
(TS 23.502 §4.2.2.2.2, operator policy dependent)
    else old AMF cannot be identified / no context / integrity check failure
        NewAMF->>UE: Identity Request (SUCI)
        UE-->>NewAMF: Identity Response (SUCI)
        Note over NewAMF: then proceeds to authentication as in initial registration
    end

Signal Flow (main messages involving identifiers)¶

Types of the 5GS mobile identity IE¶

The Type of identity in TS 24.501 §9.11.3.4 determines what the IE contains.

See the table in the same clause for the coded values (this page does not assert them).

Packet Analysis (Wireshark)¶

Display filters¶

Decode example (conceptual)¶

The following is a conceptual representation of the display structure. Actual label names differ by Wireshark version (capture needed).

NGAP InitialUEMessage
 └─ NAS-PDU
     └─ Registration Request
         └─ 5GS mobile identity
             ├─ Type of identity: SUCI
             ├─ SUPI format: IMSI
             ├─ MCC / MNC               ← Home Network Identifier (clear text)
             ├─ Routing indicator       ← clear text
             ├─ Protection scheme Id    ← null-scheme / Profile A / Profile B
             ├─ Home network public key identifier
             └─ Scheme output           ← encrypted value for Profile A/B

Registration Request
 └─ 5GS mobile identity
     ├─ Type of identity: 5G-GUTI
     ├─ MCC / MNC
     ├─ AMF Region ID
     ├─ AMF Set ID
     ├─ AMF Pointer
     └─ 5G-TMSI

What to look at¶

1. Type of identity — SUCI or 5G-GUTI. A clue as to whether this is "effectively initial" or "trying to reuse an existing context" (also check whether the 5G-GUTI is mapped)
2. Protection scheme Id — with the null-scheme the MSIN is visible. If the null-scheme appears in a production network, suspect the USIM/UDM key configuration
3. Home network public key identifier — whether the UDM has the private key with the same ID (watch for mismatches right after key rotation)
4. Routing indicator — used for AUSF/UDM selection. Selection uses either NRF discovery (routingIndicators in the NF profile, TS 29.510; clause to be confirmed) or local configuration, and which one is used is implementation and operation dependent (TS 23.501 §6.3.4 / §6.3.8, to be confirmed). If the value is unexpected, compare it with the NRF registrations or the local configuration in the AMF/AUSF
5. The 5G-GUTI in the Registration Accept and whether the Registration Complete follows

Trouble Shooting¶

Do not follow a trace by the SUPI alone¶

In a commercial AMF, following a single identifier will make you lose track partway. Think of the identifiers as two families.

flowchart LR
    subgraph Sub["Subscriber identification (NAS / SBI)"]
        A["SUCI"] --> B["SUPI"]
        B --> C["5G-GUTI / 5G-S-TMSI"]
    end
    subgraph N2["N2 signaling identification (NGAP)"]
        D["RAN UE NGAP ID"]
        E["AMF UE NGAP ID"]
    end
    C -. "correlate within the same NGAP message" .-> D
    C -. "correlate within the same NGAP message" .-> E

The RAN UE NGAP ID / AMF UE NGAP ID are not subscription identities. They identify UE-associated signalling on N2 (AMF UE NGAP ID: TS 38.413 §9.3.3.1 / RAN UE NGAP ID: §9.3.3.2; to be confirmed) and change with every connection. The standard technique is to start correlating from the moment an identifier in NAS and an NGAP ID appear in the same message (Initial UE Message, etc.).

Failures and how to isolate them¶

Boundary between 3GPP specifications and vendor implementations¶

When analyzing a commercial AMF, it is important to be able to map 3GPP identity ⇔ the vendor's internal UE context ⇔ NGAP UE IDs.

Comparison with EPC (4G)¶

3GPP Specification¶

Summary¶

• SUPI = permanent ID of the subscription, SUCI = radio-concealed form of the SUPI, 5G-GUTI = temporary ID after registration. Each has a different purpose
• The SUCI is not entirely ciphertext: the Home Network Identifier / Routing Indicator / Scheme ID / PKI are in clear text, and only the Scheme Output is concealed
• Only the SIDF in the UDM de-conceals SUCI→SUPI. When the UE registers with a SUCI, the serving AMF receives the SUPI after the AUSF confirms successful authentication (TS 33.501 §6.1.3.2 / §6.1.3.1). When it registers with a 5G-GUTI and the context is retrieved from the old AMF, it is received via the old AMF (TS 23.502 §4.2.2.2.2)
• 5G-GUTI = GUAMI + 5G-TMSI. The 5G-GUTI is not computed from the SUPI; the mapping exists only in the AMF's context (or the UE context shared within the AMF Set)
• Whether the 5GS mobile identity in the Registration Request is a SUCI or a 5G-GUTI tells you the UE's state and the subsequent flow (context transfer / Identity Request)

Comprehension check¶

Next Step¶

• Break down the first half of the 5G-GUTI, the GUAMI, and learn about AMF Region / AMF Set / AMF Pointer and AMF selection → GUAMI / AMF Region / Set / Pointer
• Go back to the whole procedure in which the identifiers flow → Registration
• Context transfer between old and new AMFs → N14 / Mobility Registration Update
• Quick lookup of terms → Identifier Dictionary