5G Identities full session

5G Identities
Each subscriber in the 5G System is allocated one 5G Subscription Permanent Identifier (SUPI) for use within the 3GPP system. The 5G System supports identification of subscriptions independently of identification of the user equipment. Each UE accessing the 5G System shall be assigned a Permanent Equipment Identifier (PEI).
The 5G System supports allocation of a temporary identifier (5G-GUTI) in order to support user confidentiality protection.
Subscription Permanent Identifier
A globally unique 5G Subscription Permanent Identifier (SUPI) is allocated to each subscriber in the 5G System and provisioned in the UDM/UDR. The SUPI is used only inside 3GPP system
The SUPI may contain:
- an IMSI
- a network-specific identifier, used for private networks as defined in TS 22.261 [2].
- a GLI and an operator identifier of the 5GC operator, used for supporting FN-BRGs
- a GCI and an operator identifier of the 5GC operator, used for supporting FN-CRGs and 5G-CRG
A SUPI containing a network-specific identifier shall take the form of a Network Access Identifier (NAI)
When UE needs to indicate its SUPI to the network (e.g. as part of the Registration procedure), the UE provides the SUPI in concealed form
In order to enable roaming scenarios, the SUPI shall contain the address of the home network (e.g. the MCC and MNC in the case of an IMSI based SUPI).
For interworking with the EPC, the SUPI allocated to the 3GPP UE shall always be based on an IMSI to enable the UE to present an IMSI to the EPC.
Subscription Concealed Identifier
The Subscription Concealed Identifier (SUCI) is a privacy preserving identifier containing the concealed SUPI.
Permanent Equipment Identifier
A Permanent Equipment Identifier (PEI) can assume different formats for different UE types and use cases. The UE shall present the PEI to the network together with an indication of the PEI format being used.
If the UE supports at least one 3GPP access technology (i.e. NG-RAN, E-UTRAN, UTRAN or GERAN), the UE must be allocated a PEI in the IMEI or IMEISV format.
PEI may be one of the following:
- for UEs that support at least one 3GPP access technology, an IMEI or IMEISV
- PEI used in the case of W-5GAN access
- for UEs not supporting any 3GPP access technologies, the IEEE Extended Unique Identifier EUI-64 [113] of the access technology the UE uses to connect to the 5GC.
5G Globally Unique Temporary Identifier
The AMF allocates a 5G Globally Unique Temporary Identifier (5G-GUTI) to the UE that is common to both 3GPP and non-3GPP access. It shall be possible to use the same 5G-GUTI for accessing 3GPP access and non-3GPP access security context within the AMF for the given UE. An AMF may re-assign a new 5G-GUTI to the UE at any time. The AMF provides a new 5G-GUTI to the UE under the specific conditions When the UE is in CM-IDLE, the AMF may delay providing the UE with a new 5G-GUTI until the next NAS transaction.
When the GUAMI identifies only one AMF, the 5G-TMSI identifies the UE uniquely within the AMF. However, when AMF assigns a 5G-GUTI to the UE with a GUAMI value used by more than one AMF, the AMF shall ensure that the 5G-TMSI value used within the assigned 5G-GUTI is not already in use by the other AMF(s) sharing that GUAMI value.
AMF Name
An AMF is identified by an AMF Name. AMF Name is a globally unique FQDN. An AMF can be configured with one or more GUAMIs. At a given time, GUAMI with distinct AMF Pointer value is associated to one AMF name only.
UE Radio Capability ID
The UE Radio Capability ID is is used to uniquely identify a set of UE radio capabilities (i.e. UE Radio Capability information). The UE Radio Capability ID is assigned either by the serving PLMN or by the UE manufacturer

[@SharpKnife523]

Thanks for this presentation and very simple explanation. It was very helpful.

[@5Gand6G]

Thanks

[@rajeevanand5731]

Very informative

[@techdyan8500]

Thank you so much for putting this on youtube sir .

[@5Gand6G]

Thanks

[@unnikrishnanvh5251]

Thank you for the Nice Presentation and clear explanation!! Assuming the IMSI 234150999999999, where MCC=234, MNC=15 and MSISN=0999999999, the Routing Indicator 678, and a Home Network Public Key Identifier of 27, the NAI format for the SUCI takes the form: - for the null-scheme: type0.rid678.schid0.userid0999999999 - for the Profile protection scheme: type0.rid678.schid1.hnkey27.ecckey.cip< encryption of 0999999999>.mac My Question: why the home network identifier is not mentioned in the Format for the SUCI? without home network identifier the MCC and MNC information will be missed out in SUCI is it not?

[@mukundachlerkar8021]

Nice perception.

[@5Gand6G]

Thanks for listening

[@ankitgoud8597]

This music is irradiated. Don't add these music 🎵🎶 in execution video. Plz remove it from your videos

[@shaasvatbharat]

Thank You Ashok Sir for this thorough presentation! May you please clarify why the example SUCI values at 39:02 do not contain MNC+MCC values for Home Network Identifier, as required at 31:48?

[@5Gand6G]

please read following from 3GPP 23.003 28.7.3  NAI format for SUCI When the SUPI is defined as a Network Specific Identifier, the SUCI shall take the form of a Network Access Identifier (NAI). In this case, the NAI format of the SUCI shall have the form username@realm as specified in clause 2.2 of IETF RFC 7542, where the realm part shall be identical to the realm part of the Network Specific Identifier. When the SUPI is defined as an IMSI, the SUCI in NAI format shall have the form username without a realm part as specified in clause 2.2 of IETF RFC 7542. The username part of the NAI shall take one of the following forms: for the null-scheme: type.rid.schid.userid for the Scheme Output for Elliptic Curve Integrated Encryption Scheme Profile A and Profile B: type.rid.schid.hnkey.ecckey.cip.mac for HPLMN proprietary protection schemes: type.rid.schid.hnkey. out See clause 2.2B for the definition and format of the different fields of the SUCI. Examples: Assuming the IMSI 234150999999999, where MCC=234, MNC=15 and MSISN=0999999999, the Routing Indicator 678, and a Home Network Public Key Identifier of 27, the NAI format for the SUCI takes the form: for the null-scheme: type0.rid678.schid0.userid0999999999 for the Profile protection scheme: type0.rid678.schid1.hnkey27.ecckey.cip< encryption of 0999999999>.mac Assuming the Network Specific Identifier [e-mail], the Routing Indicator 678, and a Home Network Public Key Identifier of 27, the NAI format for the SUCI takes the form: for the null-scheme: [e-mail] for the Profile protection scheme: type1.rid678.schid1.hnkey27.ecckey.cip< encryption of user17>[e-mail]

[@shaasvatbharat]

@@5Gand6G Thank You Sir for your response! By going through the reference (TS 23.003 section 28.7.3) that you pointed to, I understand that the examples were for NAI format. The MCC/MNC are included in SUCI for "IMSI type SUPI", as mentioned in TS 23.003 section 2.2B: "When the SUPI Type is an IMSI, the Home Network Identifier is composed of two parts: - Mobile Country Code (MCC), consisting of three decimal digits. The MCC identifies uniquely the country of domicile of the mobile subscription; - Mobile Network Code (MNC), consisting of two or three decimal digits. The MNC identifies the home PLMN or SNPN of the mobile subscription." Ref: www.tech-invite.com/3m23/toc/tinv-3gpp-23-003_b.html#e-2-2B

[@mangaldeepchatterjee6866]

Hello Sir , during identity exchange slide , it shows that UDM decrypt the SUCI using stored key . But i believe it is done by AUSF which stores the authentication keys . Can you please clarify this doubt.

[@5Gand6G]

The private key to decript SUCI and convert back as SUPI is stored with UDM. AUSF role for authentication is ofcourse there.

[@biswajeetmishra1507]

According to my knowledge AUSF has 2 parts SIDF and ARPF.ARPF provides authentication vector and SIDF decrypts SUCI gives the SUPI to AMF in HTTP 201 Created response while replying for Nausf_UE-authentication request. After this only AMF does discovery of UDM by contacting NRF

[@jeevanasaiirukumati94]

SIDF is part of udm not ausf

[@AshishPrajapati009]

Hi sir , can u please make small video on NGAP module. Thanks

[@5Gand6G]

Sure