Who the device is — identity, concealment and proof

The RAN notes identify a device by an RNTI — a number valid in one cell, for a while. This note is about the identities underneath that: the permanent name of a subscription, the encrypted form that is actually sent, the identity of the hardware, the temporary name that does most of the work, and the procedure by which any of it is believed.

In one line. Every generation up to LTE sent a permanent, globally unique identifier in the clear whenever it had no valid temporary one — which is exactly what an IMSI catcher asks for. 5G fixes this with two changes that only work together: SUCI, which encrypts the identity to the home network's public key, and mutual authentication, which stops a false base station from being able to ask in the first place. The fix depends on the USIM having been provisioned, not on the phone or the network being new.

The concepts this note covers

Each concept has a page of its own. This note is the narrative — the group read as one argument, with the connective tissue that a page-per-concept cannot carry. The pages are the definitions, and each one shows what to learn before it.

The four identities, side by side

The permanent identifier is provisioned, is used inside the network, and does not cross the air. That one sentence is the whole design.

The card

USIM — TS 33.501 §6.12.2 and Annex C. It holds the long-term key K, which never leaves it; the SUPI; and — new in 5G — the Home Network Public Key used to compute a SUCI.

Authentication works by the card computing inside itself. The phone's operating system never sees K, so compromising the phone does not yield the subscription. Every security property below rests on that boundary.

And the fallback is spelled out, which is where the honesty is. §6.12.2: "The ME shall support the null-scheme. If the home network has not provisioned the Home Network Public Key in USIM, the SUPI protection in initial registration procedure is not provided. In this case, the null-scheme shall be used."

An old card in a new phone gets no identity protection at all. The privacy improvement is a property of the card.

The permanent name

SUPI — TS 23.501 §5.9.2. May contain an IMSI, or a network-specific identifier in NAI form for private networks.

Two requirements, both stated outright. "In order to enable roaming scenarios, the SUPI shall contain the address of the home network" — the identifier is also a routing instruction, which is exactly why concealment cannot cover all of it. And "the UE provides the SUPI in concealed form" whenever it must indicate it.

The NAI form is more than a formatting option: it means a subscription identity need not come from the globally administered IMSI numbering space. A factory can run a private 5G network with identities of its own devising.

The concealed name

SUCI — TS 23.501 §5.9.2a, TS 33.501 §6.12.2. The most consequential privacy change in the generation, and the part worth getting exactly right is what is not concealed:

The scheme is ECIES (TS 33.501 Annex C), and it is probabilistic: a fresh ephemeral key each time, so the same SUPI produces a different SUCI on every registration. A constant would be as trackable as the IMSI it replaced — freshness is what makes concealment worth anything.

Only the home network can reverse it, through the SIDF in the UDM (§6.12.5). The private key never leaves, so a visited network relays an identifier it genuinely cannot read.

The equipment

PEI — TS 23.501 §5.9.3. An IMEI or IMEISV for any device supporting a 3GPP access technology. The network wants it for three reasons: blocking stolen equipment regardless of the SIM in it, knowing what the device is (and therefore which quirks to expect), and regulatory identification.

One binding rule, written for multi-SIM devices: a device "shall keep the PEI to be used with the network subscription and shall not use that PEI with another network subscription while the UE is in registered state". That is why multi-SIM handsets carry more than one IMEI.

The temporary name, and the ten bits

5G-GUTI — TS 23.501 §5.9.4, structured as <GUAMI><5G-TMSI>, with <GUAMI> := <MCC><MNC><AMF Region ID><AMF Set ID><AMF Pointer>.

It is an identifier that is also an address. The GUAMI half names the AMF; the 5G-TMSI half names the device within it. The 5G-S-TMSI is the shortened form "to enable more efficient radio signalling procedures (e.g. during Paging and Service Request)".

The seam. §5.9.4: "the NG-RAN uses the 10 Least Significant Bits of the 5G-TMSI in the determination of the time at which different UEs are paged. Hence, the AMF shall ensure that the 10 Least Significant Bits of the 5G-TMSI are evenly distributed."

A core-network function's choice of identifier is being constrained by a radio-layer timing requirement, and paging shows the arithmetic that closes it — TS 38.304 §7.1 computes UE_ID = 5G-S-TMSI mod 1024, which is those ten bits exactly.

A second constraint comes from the other direction: contention resolution "assumes that there is a low probability of the same 5G-TMSI being allocated by different AMFs to different UEs". Evenly spread and effectively unpredictable — both imposed by procedures the core never performs.

There is no paging by permanent identity. TS 23.501 §5.3.3.2.2 notes flatly: "In 5GS there is no need for paging using the SUPI/SUCI of the UE."

Proof

5G AKA — TS 33.501 §6.1.3.2. The device sends a SUCI; the AMF, acting as SEAF, asks the AUSF; the AUSF asks the UDM, which de-conceals the SUCI and generates a vector; a challenge reaches the USIM, which computes the response and checks the network's token; an anchor key lands at the AMF, which derives everything below.

Mutual authentication is what kills the false base station. A device that only proved itself could be lured onto any transmitter claiming to be a network. Because the network must produce something only the home network could compute, an attacker without the long-term key cannot complete the exchange. Combined with SUCI — which denies the attacker the identity in the first place — this is the pair of changes that closed the IMSI-catcher attack. Neither alone would have.

The hierarchy is rooted where the signalling is. Authentication terminates at the AUSF in the home network, but the anchor key lands at the AMF, because that is where the device's NAS connection lives and where the RAN's keys must come from. In roaming, the home network authenticates and the visited network gets a key — never the long-term secret.

Sources

cd ~/Documents/md-engine/"Courses (RAW)/5G Topics"
pdftotext -layout ts_123501v190700p.pdf - | grep -n -A28 "^5.9.4 *5G Globally Unique"
pdftotext -layout ts_133501v190700p.pdf - | grep -n -A20 "^6.12.2 *Subscription concealed"
pdftotext -layout ts_138304v190300p.pdf - | grep -n -B2 -A6 "5G-S-TMSI mod 1024"