5G SUPI/SUCI Identity Concealment: Securing 5G Subscribers…

What is SUPI and SUCI?

SUPI (Subscription Permanent Identifier) is the unique identifier assigned to each 5G subscriber by their network operator. SUCI (Subscription Concealed Identifier) is a masked version of the SUPI used in the initial attachment process to prevent eavesdropping and unauthorized access.

The transformation from SUPI to SUCI involves cryptographic operations that ensure only authorized parties can decrypt it, thereby concealing the subscriber's true identity.

How Does ECDH + AES-256-GCM Work?

ECDH (Elliptic Curve Diffie-Hellman) is used to establish a shared secret between the user equipment and the network. This shared secret, combined with AES-256-GCM (Advanced Encryption Standard in Galois/Counter Mode), ensures both confidentiality and integrity of the communication.

During an attachment process, ECDH generates ephemeral keys that are discarded after each session, making it extremely difficult for a rogue base station to intercept or decrypt sensitive information.

live demo · related simulation● LIVE

Why Does This Matter?

The use of SUPI and SUCI in 5G networks significantly enhances privacy by preventing unauthorized access and reducing the risk of identity theft.

By implementing these advanced cryptographic techniques, 5G networks provide a robust security framework that is essential for protecting user data and maintaining trust in mobile communications.

Real-World Examples

In practice, SUPI and SUCI are used to protect the identities of millions of 5G users worldwide. For instance, during a large-scale deployment of 5G networks in major cities, these mechanisms ensure that individual user data remains secure even when network traffic is high.

Additionally, they play a crucial role in preventing IMSI-catchers from intercepting sensitive information, which is particularly important for public safety and emergency services.

Frequently asked questions

What is the difference between SUPI and SUCI?

SUPI is a permanent identifier assigned to 5G subscribers by their network operator, while SUCI is a masked version of the SUPI used during initial attachment processes to conceal the subscriber's true identity.

How does ECDH contribute to security in 5G networks?

ECDH establishes a shared secret between user equipment and the network, which is then used with AES-256-GCM for secure communication. This ensures both confidentiality and integrity of the data exchanged during each session.

Why can't rogue base stations decrypt SUCI?

Rogue base stations cannot decrypt SUCI because it is protected by cryptographic techniques such as ECDH and AES-256-GCM. These methods generate ephemeral keys that are discarded after each session, making it impossible for unauthorized parties to intercept or decrypt the data.

Is SUPI/SUCI only used in 5G networks?

While SUPI and SUCI are specifically designed for 5G networks, similar concepts of identity concealment exist in other communication standards. However, the level of security provided by 5G's implementation is more advanced due to its use of modern cryptographic techniques.

Try it live

Everything above runs in your browser — open 5G SUPI/SUCI Identity Concealment and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.

▶ Open 5G SUPI/SUCI Identity Concealment simulation