SUPI & SUCI
Subscription Permanent Identifier & Subscription Concealed Identifier
The 5G privacy mechanism that encrypts the user's permanent identity on the device to prevent IMSI catching and eavesdropping.
Technical Explanation
In legacy 2G/3G/4G systems, the IMSI was transmitted in plaintext during initial attach, exposing users to IMSI Catcher ("stingray") eavesdropping. 5G eliminates this vulnerability: • SUPI: The global permanent subscriber identifier (equivalent to IMSI). • SUCI: The privacy-preserving concealed identifier. The UE generates SUCI by encrypting the SUPI using the Home Network Public Key stored securely in the USIM/eSIM (via ECIES asymmetric cryptography). The SUCI is transmitted over the air to the AMF, and only the UDM/SIDF in the home network possesses the private key to de-conceal it back to the SUPI.
Key Functions
- Prevention of over-the-air IMSI catching and subscriber tracking
- Elliptic Curve Integrated Encryption Scheme (ECIES) public key encryption in the SIM/UE
- De-concealment restricted to the secure home network UDM/SIDF
- Zero-trust identity protection from initial registration