Subscriber Identity: IMSI, TMSI, SUPI, and SUCI

Introduction

In our last lesson, we charted the evolution of cellular networks from 2G to 5G. A key takeaway was how each generation tried to improve security, with a recurring vulnerability being the exposure of a subscriber's permanent identity, especially during the initial network connection. We briefly mentioned that 4G was vulnerable to IMSI catchers and that 5G introduced a fix called SUCI.

Today, we'll dive deep into those concepts. This lesson addresses the learning outcome: Explain subscriber identity concepts: IMSI, TMSI, and their 5G counterparts SUPI/SUCI. We will dissect what these identifiers are, how they work, and why their evolution is central to the cat-and-mouse game of cellular security.

For someone with your goal of understanding telecommunication hacking, this is a cornerstone lesson. Mastering these concepts is fundamental to comprehending major attack vectors like subscriber tracking, identity spoofing, and denial-of-service, and for appreciating the security mechanisms designed to stop them.

Part 1: The Permanent Identifier (IMSI and SUPI)

Every subscription on a cellular network needs a unique, permanent identifier. Think of it as the primary key for a subscriber in the global cellular database.

The IMSI: A Legacy of Insecurity

In 2G, 3G, and 4G networks, this identifier is the IMSI (International Mobile Subscriber Identity). It is stored on the SIM card and is used by the network to identify and authenticate you.

The IMSI is typically a 15-digit number with three parts:

• MCC (Mobile Country Code): 3 digits, identifies the country (e.g., 310 for the USA).
• MNC (Mobile Network Code): 2 or 3 digits, identifies the home network operator (e.g., 260 for T-Mobile USA).
• MSIN (Mobile Subscription Identification Number): The remaining digits, which uniquely identify the subscriber within their home network.

The critical security issue with the IMSI is that in 2G, 3G, and even during the initial connection phase of 4G, it is transmitted "in the clear" (unencrypted) over the radio interface. This allows anyone with a suitable radio receiver to capture it, which is the operating principle of an IMSI Catcher.

The SUPI: 5G's Modern Identifier

5G introduces the SUPI (Subscription Permanent Identifier). The SUPI serves the same purpose as the IMSI but is a more flexible concept. While a SUPI can be an IMSI (for interoperability with 4G), it can also take other forms, like a Network Access Identifier (NAI), which looks more like an email address (e.g., username@realm).

The following video provides an excellent explanation of the SUPI and its relationship to the IMSI.

The key point, as the video highlights, is that regardless of its format, the SUPI is considered sensitive information and is never supposed to be transmitted unencrypted over the 5G air interface. This is a fundamental design principle of 5G security.

Part 2: The Temporary Identifier (TMSI and GUTI)

Network operators realized early on that broadcasting a permanent ID like the IMSI was a privacy risk. To mitigate this, they introduced temporary identifiers.

After a device successfully registers with the network for the first time (by sending its IMSI), the network assigns it a temporary ID. This temporary ID is then used for all subsequent communication within that local area.

• TMSI (Temporary Mobile Subscriber Identity): Used in 2G and 3G. It's a short, random number that is only unique within the area of a specific visitor location register (VLR). If you move to a new city, you might be assigned a new TMSI.
• GUTI (Globally Unique Temporary Identifier): Used in 4G and 5G. As the name implies, it is globally unique and more complex than the TMSI. It contains information that helps the network identify the specific core network node (MME in 4G, AMF in 5G) that is handling the subscriber's session.

The use of temporary identifiers is a significant privacy enhancement. Because the GUTI changes periodically, it makes passive tracking of a device much more difficult. However, it doesn't solve the original problem: to get a GUTI in the first place, the device must first identify itself using its permanent, sensitive IMSI. The vulnerability window remains open.

Part 3: The 5G Solution (SUCI)

This is where 5G truly changes the game. It solves the initial identification problem with the SUCI (Subscription Concealed Identifier).

The SUCI is not a new type of ID; it is simply an encrypted SUPI.

The process works using asymmetric cryptography, a concept you'll be familiar with from web security (e.g., TLS).

1. The operator provisions the SIM card (a modern SIM is called a USIM) with the home network's public key.
2. When the device needs to register, instead of sending the SUPI, the USIM uses this public key to encrypt the sensitive part of the SUPI (the MSIN).
3. The result of this encryption is the SUCI, which is then sent over the air. The non-sensitive parts (MCC and MNC) are left in the clear for routing purposes.
4. Only the subscriber's home network, which possesses the corresponding private key, can decrypt the SUCI to recover the original SUPI.

The practical effect is a major security upgrade, as shown on the right side of the "4G IMSI vs 5G SUCI" image. An IMSI catcher is defeated because it cannot decrypt the SUCI to reveal the permanent identity.

To see this process explained in detail, let's return to the video.

The Attacker's Perspective: The "Null Scheme"

The introduction of SUCI is a fantastic security improvement, but it has a crucial weakness that is relevant to your goals: its use is not always mandatory, and the encryption can be deliberately turned off.

The 5G standards define a "Protection Scheme" field within the SUCI. While this can specify strong encryption like ECIES (Elliptic Curve Integrated Encryption Scheme), it can also be set to 0, which signifies the "Null Scheme". When the Null Scheme is used, the SUPI is sent completely unencrypted, just as it was in 4G.

Why would this exist? It might be for testing, for certain emergency situations, or due to misconfiguration or a lack of support on the device or network side. For an attacker, a network or device that allows the Null Scheme is an immediate target. It completely negates 5G's biggest privacy enhancement over 4G.

You can actually see what this looks like in a real network log.

This is a perfect example of the gap between security on paper and security in practice—the exact territory where security researchers and hackers operate.

Conclusion

You have now explored the fundamental identifiers that manage subscriber identity in cellular networks. Understanding their purpose and weaknesses is the first step toward exploiting them.

Key Takeaways:

• IMSI & SUPI: These are the permanent, globally unique identifiers for a subscription, stored on the SIM card. The SUPI is the 5G successor to the IMSI.
• TMSI & GUTI: These are temporary identifiers assigned by the network to protect a subscriber's privacy during day-to-day operations. They are frequently changed to prevent tracking.
• The 4G Vulnerability: The IMSI must be sent unencrypted during initial registration, making it vulnerable to interception by IMSI Catchers.
• The 5G Solution (SUCI): The SUPI is encrypted using the network's public key before being transmitted. This is called the SUCI and is designed to defeat IMSI Catchers.
• The 5G Weakness: The encryption used to create the SUCI is not mandatory. The "Null Scheme" allows the SUPI to be sent in the clear, re-opening the very security hole that 5G was designed to close.

In our next lesson, we will look more closely at the small but powerful chip at the heart of this process. The topic will be: Describe the role of the SIM/USIM card in authentication and key storage. We've seen that the USIM stores the SUPI and the network's public key; next, we'll examine its full role as the root of trust in your mobile device.