Understanding 5G SUPI/SUCI Identity Concealment |…

What SUPI and SUCI Are

In the context of 5G networks, SUPI (Subscription Permanent Identifier) is a unique identifier assigned to each user's SIM card that remains constant throughout their subscription. To protect this sensitive information from eavesdroppers, operators use SUCI (Subscription Concealed Identifier), which is derived from the SUPI and concealed using cryptographic methods.

SUCI ensures that even if a rogue base station or IMSI-catcher manages to intercept network communications, they cannot directly identify the subscriber. This is crucial for maintaining user privacy and security in an increasingly connected world.

The Role of ECDH and AES-256-GCM

ECDH (Elliptic Curve Diffie-Hellman) is a key agreement protocol that allows two parties to establish a shared secret over an insecure channel. In the 5G network, this shared secret is used to encrypt the SUPI into SUCI.

AES-256-GCM (Advanced Encryption Standard with Galois/Counter Mode) is employed for both encryption and authentication of the data. GCM mode ensures that even if the ciphertext is modified by a potential attacker, the integrity check will fail, preventing any undetected tampering.

live demo · related simulation● LIVE

Why It Matters

The concealment of SUPI through SUCI is essential for protecting user privacy. By ensuring that only authorized network elements can decrypt and use the subscriber's identity, it significantly reduces the risk of unauthorized access to sensitive information.

Moreover, this technology helps in mitigating the risks associated with IMSI-catchers, which are devices used by criminals or malicious entities to intercept and record mobile phone numbers. By concealing the SUPI, 5G networks make such interception much more difficult.

Real-World Applications

The use of SUCI in 5G networks is not just theoretical; it has real-world implications for enhancing security and privacy. For instance, it can prevent identity theft, unauthorized tracking, and other forms of cybercrime.

Additionally, this technology supports the deployment of new services that rely on strong user authentication without compromising personal data.

Frequently asked questions

What is an IMSI-catcher?

An IMSI-catcher is a device used by law enforcement or malicious entities to intercept and record mobile phone numbers. It can be used to track the location of individuals or to gather information about their communications.

How does ECDH ensure security in 5G networks?

ECDH ensures that a shared secret is established between two parties over an insecure channel, which is then used for encryption. This prevents unauthorized entities from easily deriving the key and decrypting communications.

Why can't a rogue base station decrypt SUCI?

A rogue base station cannot decrypt SUCI because it lacks the necessary decryption keys generated through the ECDH process. The SUCI is encrypted using these keys, making it unreadable without proper authorization.

What happens if a network rekeys?

Rekeying in 5G networks involves generating new ephemeral key pairs with ECDH, which refreshes the encryption and authentication mechanisms. This enhances security by reducing the risk of key compromise over time.

Try it live

Everything above runs in your browser — open 5G SUPI/SUCI Identity Concealment and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.

▶ Open 5G SUPI/SUCI Identity Concealment simulation