Articles » 5G » 5G NR UE Identities: IMSI, IMEI, SUPI, SUCI, GUTI, S-TMSI, RNTI, I-RNTI

5G NR UE Identities: IMSI, IMEI, SUPI, SUCI, GUTI, S-TMSI, RNTI, I-RNTI

5g nr ue identity mobile communication protocol stack

This document describes the various User Equipment (UE) identities used in 5G New Radio (NR) networks, including IMSI, IMEI, SUPI, SUCI, GUTI, S-TMSI, RNTI, and I-RNTI.

5G NR IMSI

  • IMSI stands for “International Mobile Subscriber Identity”.
  • IMSI Structure: { MCC, MNC, MSIN }
    • MCC (Mobile Country Code): 3 digits
    • MNC (Mobile Network Code): 2 or 3 digits
    • MSIN (Mobile Subscriber Identification Number): Up to 10 digits

5G NR IMEI

  • IMEI stands for “International Mobile Equipment Identity”.
  • IMEI Structure: { TAC, SNR, CD }
    • TAC (Type Allocation Code): 8 digits
    • SNR (Serial Number): 6 digits
    • CD (Check Digit): 1 digit

5G NR SUPI

  • SUPI stands for “Subscription Permanent Identifier”.
  • It can be either an IMSI or an NAI (Network Access Identifier).
  • NAI is specified in RFC 7542 and represents a network-specific identity for a private network.

5G NR SUCI

  • SUCI stands for “Subscription Concealed Identifier”.
  • It allows the SUPI to be signaled without exposing the user’s identity.
  • Signaling procedures use SUCI instead of SUPI to provide privacy.
  • SUCI utilizes a ‘protection scheme’, which can be set to ‘Null’. In this case, the SUPI is visible within the message. Alternatively, the ‘protection scheme’ can be set to ‘ECIES Scheme Profile A’, ‘ECIES Scheme Profile B’, or any operator-specific scheme. These schemes are used to encrypt the SUPI before its inclusion in the message.

5G NR GUTI

  • GUTI stands for “Globally Unique Temporary Identifier” and is allocated by the Access and Mobility Management Function (AMF).
  • It’s a temporary identifier, not permanently associated with any specific subscriber or device.
  • The GUTI term in 5G NR is used for privacy improvement.
  • The AMF can change the allocated 5G GUTI at any time. The total size of the GUTI is 80 bits.
  • 5G NR GUTI Structure: { MCC, MNC, AMF Region Identity, AMF Set Identity, AMF Pointer, 5G-TMSI }
    • MCC: 12 bits
    • MNC: 12 bits
    • AMF Region Identity: 8 bits
    • AMF Set Identity: 10 bits
    • AMF Pointer: 6 bits
    • 5G-TMSI: 32 bits
  • GUTI is a concatenation of GUAMI and 5G-TMSI.
    • GUAMI consists of MCC, MNC, AMF Region Identity, AMF Set Identity, and AMF Pointer.

5G NR S-TMSI

  • S-TMSI is a short version of the 5G-GUTI, excluding the PLMN identity and AMF Region Identity.
  • It can be used to identify a UE within a specific AMF region but cannot be used to identify a UE across a set of AMF regions.
  • It is more efficient compared to GUTI due to its smaller size, which reduces signaling overhead during signaling procedures.
  • S-TMSI Structure: { AMF Set Identity (10 bits) , AMF Pointer (6 bits) , 5G-TMSI (32 bits) }
  • It is used within RRC signaling procedures.

5G NR RNTIs

  • RNTI stands for “Radio Network Temporary Identifiers” which are applicable within the RAN (Radio Access Network).
  • They are allocated by the base station (BS) and subsequently stored by both the BS and the UE.
  • These RNTIs are used to address either an individual UE, a group of UEs, or all UEs. All RNTIs have a length of 16 bits.
    • For example:
      • C-RNTI can be used to address an individual UE.
      • INT-RNTI can be used to address a group of UEs.
      • SI-RNTI can be used to address all UEs.

5G NR I-RNTI

  • I-RNTI stands for “Inactive RNTI” which is applicable to the RRC Inactive State.
  • There are two variants of I-RNTI: Full I-RNTI and short I-RNTI.
    • Full I-RNTI is 40 bits in length, whereas short I-RNTI is 24 bits in length.
  • In contrast to other RNTIs, the I-RNTI is not used to scramble CRC bits that belong to the PDCCH payload.
  • The I-RNTI is used to address the UE within RRC signaling messages.
  • The I-RNTI can be allocated to an individual UE device within the “RRCRelease message” while moving the UE from the “RRC Connected” state to the “RRC Inactive” state.
  • The I-RNTI is used to identify both the UE and the BS which hosts the UE context, which allows the UE context to be moved from one BS to another BS if the UE is mobile and the RRC is inactive.

References

  • 3GPP TS 38.202, TS 38.321 etc.