SUPI — Subscription Permanent Identifier — the permanent name of a subscription
The device — identity, state, mobility
Where it sits
What it is
What it is. The Subscription Permanent Identifier — the globally unique, permanent name of a subscription. TS 23.501 §5.9.2: "A globally unique 5G Subscription Permanent Identifier (SUPI) shall be allocated to each subscriber in the 5G System and provisioned in the UDM/UDR."
What it may contain, per the clause:
an IMSI, as in every generation before · a network-specific identifier in NAI form (RFC 7542), used for private networks · a GLI or GCI plus an operator identifier, for fixed-network interworking.
Two requirements make it work, and both are stated outright:
It must carry its home network. "In order to enable roaming scenarios, the SUPI shall contain the address of the home network (e.g. the MCC and MNC in the case of an IMSI based SUPI)." Without that, a visited network would have no way to know whom to ask about a subscriber it has never seen. The identifier is also a routing instruction — which is exactly why SUCI cannot conceal all of it.
It is never sent as itself. "When UE needs to indicate its SUPI to the network (e.g. as part of the Registration procedure), the UE provides the SUPI in concealed form." The permanent identifier exists, is provisioned, is used inside the network — and does not cross the air interface.
And it must remain an IMSI if the device may fall back to LTE: "For interworking with the EPC, the SUPI allocated to the 3GPP UE shall always be based on an IMSI to enable the UE to present an IMSI to the EPC." The NAI form exists for private 5G networks that will never see an EPC.
Why the NAI form is more than a formatting option. It means a subscription identifier need not be issued from the global IMSI numbering space, which is administered and allocated to licensed operators. A factory can run a private 5G network with subscription identities of its own devising — and the identifier is not a small detail there, it is the difference between needing an operator's number block and not.
Where it lives: in the USIM, and in the UDM — which is also the only place a SUCI can be turned back into it.
Read on
This concept is read as part of one argument in ref-ue-identity, alongside the rest of its group.
Before this concept, the hierarchy says to learn the following — the full chain, in order: