7 Every name the system uses

7.1 Why a network needs this many names

Before a device may send one useful packet, six things have to happen: network selection, identification and authentication, authorisation, access control and barring, policy control, and lawful interception §5.2.1.

Each asks a different question. Which network? Who is this subscriber? What may they do? Is this hardware stolen? Which slice, which data network? Different questions need different names, and a name good for one is dangerous for another.

Authorisation is settled once, during registration §5.2.4, and access control and barring works on categories broadcast by the radio network rather than on any name at all §5.2.5.

The first split is the one people miss. The 5G system identifies the subscription separately from the equipment: one SUPI per subscriber, one PEI per device §5.9.1. A SIM moved to another handset keeps its SUPI and picks up a different PEI.

The second split is privacy. The permanent subscriber name is never the one on the air interface — a temporary identifier exists so the permanent one does not have to travel.

7.2 The whole cast, one line each

Some names in the table are functions, not identifiers: the AMF tracks where a device is, the SMF runs its sessions, the PCF hands out policy rules, the UDM/UDR pair holds subscription data, the UCMF stores radio capability sets.

The 5G-AN is the access network the device came in through, N2 is the link from there to the AMF, a PLMN is one operator's public network, and UE is the specification's word for the device itself.

Name	What it names	Assigned by	Where it travels	Lifetime
SUPI	The subscription	Home operator, held in UDM/UDR	Inside the 3GPP system only	Permanent
SUCI	The subscription, concealed	Computed by the UE	Over the air; undone by the home UDM	Only when a SUPI must be sent
PEI	The equipment	Comes with the equipment	UE to network, checked with 5G-EIR	Permanent
GPSI	The subscription, seen from outside	Operator	Data networks outside 3GPP	While in subscription data
5G-GUTI	The registered UE	Serving AMF	Over the air, both access types	Until the AMF re-assigns it
5G-S-TMSI	The registered UE, short form	Cut from the 5G-GUTI	Radio signalling: paging, Service Request	Follows the 5G-GUTI
GUAMI	One or more AMFs	Operator configuration	Inside the 5G-GUTI; also given to the 5G-AN	Set by configuration
AMF Name	One AMF	Operator, as an FQDN	Inside the core network	Set by configuration
AMF UE NGAP ID	One UE, as the AMF sees it	The AMF	N2 only, between 5G-AN and AMF	Until the AMF updates it
DNN	A data network	Operator, in subscription data	UE to core, at session setup	Set by configuration
S-NSSAI	A network slice	Standardised SST, or operator values	UE to core; access stratum only if allowed	Set by configuration
Internal-Group Identifier	A group of subscribers	Home operator, in the UDR	UDM to AMF and SMF, SMF to PCF	While it is in the UDR
UE Radio Capability ID	A set of radio capabilities	UE manufacturer, or the serving PLMN's UCMF	UE, RAN and core	One per capability set

7.3 The subscriber: SUPI, SUCI and GPSI

A SUPI is globally unique, one per subscriber, held in the UDM/UDR §5.9.2. It may be an IMSI (the subscriber number a SIM carries), a network-specific identifier in NAI form for private networks, or a GLI or GCI with an operator identifier for fixed-line devices §5.9.2.

Whatever the form, it carries the address of the home network — the MCC and MNC, country code and network code, in the IMSI case — because a visited network has to know where to ask. A UE that may ever fall back to 4G gets an IMSI-based SUPI, because the 4G core has to be shown an IMSI §5.9.2.

When the UE does have to name its SUPI — during registration, for instance — it provides it in concealed form §5.9.2. That concealed form is the SUCI, defined properly in TS 33.501 §5.9.2a.

Only one function in the whole system can undo it: the UDM, whose job list includes de-concealment of the privacy-protected subscription identifier §6.2.7. The UDM sits in the home network, so a visited network never learns the SUPI by unwrapping a SUCI itself.

The GPSI is the opposite kind of name: the one the world outside is allowed to use. It exists so a 3GPP subscription can be addressed from data networks outside the 3GPP system, and it is an MSISDN (a phone number) or an External Identifier §5.9.8.

7.4 The equipment: PEI

Every UE gets a PEI, and it is about hardware, not about who is paying §5.9.1. A UE supporting any 3GPP access technology — NG-RAN, E-UTRAN, UTRAN or GERAN, the radio networks of 5G, 4G, 3G and 2G — must have one in IMEI or IMEISV format §5.9.3.

A UE supporting none of them uses instead the IEEE Extended Unique Identifier EUI-64 of whatever access technology it connects with. Because the format varies, the UE always presents the PEI together with an indication of which format it is using §5.9.3.

Once a UE has registered with a subscription and a PEI, it must keep that PEI for that subscription and use it with no other while it stays registered §5.9.3.

The network may check it. During identification and authentication the network may optionally perform a PEI check with the 5G-EIR §5.2.3, an optional function whose only job is checking the status of a PEI, for example that it has not been prohibited §6.2.15.

7.5 The temporary name: 5G-GUTI and its short form

The AMF (the function that tracks where a device is and whether it can be reached) allocates a 5G-GUTI, and the same one covers both 3GPP and non-3GPP access for that UE §5.9.4. This is the identifier that exists for user confidentiality protection §5.9.1.

Its structure is two fields:

<5G-GUTI> := <GUAMI> <5G-TMSI>

The GUAMI is where the routing lives, and it breaks down further:

<GUAMI> := <MCC> <MNC> <AMF Region ID> <AMF Set ID> <AMF Pointer>

The AMF Region ID names the region, the AMF Set ID names the AMF Set inside it, and the AMF Pointer names one or more AMFs inside that set. The region field lets an operator re-use the same Set IDs and Pointers elsewhere when a network holds more AMFs than those two fields address §5.9.4.

The 5G-TMSI is the part that identifies the UE. When a GUAMI belongs to only one AMF, the 5G-TMSI is unique within that AMF; when several AMFs share a GUAMI value, the assigning AMF has to make sure the 5G-TMSI is not already in use by the others §5.9.4.

The 5G-S-TMSI is the shortened form, for radio procedures where every bit costs — paging and Service Request:

<5G-S-TMSI> := <AMF Set ID> <AMF Pointer> <5G-TMSI>

Two allocation rules follow from how the radio uses it. The NG-RAN works out when to page a UE from the 10 least significant bits of the 5G-TMSI, so the AMF has to keep those 10 bits evenly spread.

And when two devices answer at once, the radio-level signalling sorts them out assuming two AMFs are unlikely to have handed out the same 5G-TMSI. Allocation should be random enough to keep that true §5.9.4.

How often does it change? The AMF may re-assign a new 5G-GUTI at any time, and the conditions under which it must are in TS 33.501, not here.

If the UE is CM-IDLE — no signalling connection open — the AMF may hold the new value back until the next NAS transaction, NAS being the signalling between device and core §5.9.4. The states are Registration, reachability and paging.

7.6 Names for the nodes and the connection

7.6.1 AMF Name and AMF UE NGAP ID

An AMF is identified by an AMF Name, a globally unique FQDN. One AMF can be configured with several GUAMIs, but at any moment a GUAMI with a distinct AMF Pointer value belongs to one AMF Name only §5.9.5.

The AMF UE NGAP ID identifies a UE at the AMF on N2, the link between the access network and the AMF. The AMF allocates it and hands it to the 5G-AN, which uses it on every following N2 message about that UE.

It is unique per AMF Set, and it may be updated either without an AMF change or with one §5.9.9, §5.21.2.2.

7.6.2 DNN, the name of a data network

The DNN is the same thing as the APN of earlier generations — equivalent meaning, same information §5.9.6. It picks the SMF and the UPF (the node that forwards the user's packets) for a session, picks the N6 interfaces out to the data network, and decides which policies apply §5.9.6.

A wildcard DNN in the subscribed DNN list lets a subscriber reach any data network supported inside the slice that the accompanying S-NSSAI names §5.9.6. Sessions themselves are The connection to a data network.

7.6.3 S-NSSAI, the name of a slice

An S-NSSAI is an SST (the expected slice behaviour) plus an optional SD that separates several slices of the same type §5.15.2.1. Seven SST values are standardised: 1 eMBB, 2 URLLC, 3 MIoT, 4 V2X, 5 HMTC, 6 HDLLC, 7 GBRSS §5.15.2.2.

A standard-value S-NSSAI is an SST alone with no SD. A non-standard one means something only inside the PLMN it belongs to, and the UE must not use it in any other PLMN's access stratum — the radio-level part of the signalling §5.15.2.1.

Collections of them are NSSAIs — at most eight in an Allowed or a Requested NSSAI §5.15.2.1, while the UDM sends the AMF at most 16 Subscribed S-NSSAIs §5.15.3. The rest is One network, many networks.

7.6.4 Internal-Group Identifier, the name of a set of subscribers

The Internal-Group Identifier names a group in the UDR. The UDM passes it to the SMF in session management subscription data and to the AMF in access and mobility subscription data; the SMF may pass it on to the PCF §5.9.7.

It drives local policy, charging records, enforcement of application requests §5.6.7 and group-specific NAS congestion control §5.19.7.5. Groups are defined only for the non-roaming case in this release, and a UE belongs to a limited number of them §5.9.7.

7.6.5 UE Radio Capability ID, the name of a capability set

Radio capability lists have grown large enough that sending them over the air again and again is wasteful, so a short pointer stands in for a whole set §5.4.4.1a. Two kinds exist, and which kind an ID is can be told when it is signalled.

A manufacturer-assigned one carries a Vendor ID and holds good in any PLMN. A PLMN-assigned one comes from that network's UCMF, holds good only there, and carries a Version ID so an outdated pointer can be spotted §5.9.10.

7.7 Which of these are privacy-sensitive

Three of them are, and the specification does something about each:

• SUPI. It is used only inside the 3GPP system, and the UE sends it concealed as a SUCI when it has to send it at all §5.9.2. Only the home network's UDM can de-conceal it §6.2.7.

• The name used on the air interface. The 5G-GUTI exists to support user confidentiality protection §5.9.1, and the AMF may replace it at any time §5.9.4, so a listener following one temporary name loses the thread.

• S-NSSAI in the access stratum. Slice names in radio signalling say what a subscriber is doing. So on 3GPP access the UE by default does not put NSSAI in the access stratum at all, and the serving AMF may not tell it otherwise unless the home network has explicitly allowed it §5.15.9.

The PEI is not concealed, only pinned to one subscription while a registration lasts §5.9.3, and the GPSI is public by design §5.9.8. Security as a whole is Who you are and who may listen.

7.8 Crossing into 4G

When interworking with N26 is in use and a UE moves in idle mode from the 5G core to the 4G core, the 5G-GUTI is not thrown away. It is mapped field by field onto an EPS GUTI, 4G's equivalent identifier §Annex B:

• 5G MCC and MNC map straight to EPS MCC and MNC.

• 5G AMF Region ID and AMF Set ID map to EPS MMEGI and part of the MMEC.

• 5G AMF Pointer maps to the rest of the MMEC.

• 5G-TMSI maps to EPS M-TMSI.

The mapping does not imply the fields are the same size; the sizes and the details are in TS 23.003 §Annex B.

Where the 4G side has not been updated to know about 5G, the AMF Region ID and MMEGI value spaces are assumed to be partitioned, so a source node can be found without ambiguity. Once every MME (4G's counterpart of the AMF) in the PLMN understands 5GS, the full AMF Region ID space is free again §Annex B.

N26 is the interface between MME and AMF that makes this possible:

The rest of living next to 4G is Living next to 4G. How one function finds another by name is How one function finds another, and what each function does is What each network function does.