5G UE IDENTITIES - UPDATED IN 2024
5G UE Identities like IMSI, IMEI, SUPI & SUCI, GUTI, TMSI and RNTI. Learn about their structures, functions, and roles in the 5G network to ensure privacy, security, and efficient communication within 5G technology. This comprehensive guide delves into how these identities enhance user experience and network management in the 5G era.
IMSI
5G UE Identities (IMSI) - The International Mobile Subscriber Identity(IMSI) is a globally unique permanent subscriber which is one of the 5G UE identity associated within the USIM. An IMSI can be moved between UE by moving the USIM. The ITU-T specifics the structure of an IMSI within recommendation.
An IMSI is stored on the USIM and by the User Data Management (UDM) Network Function within the 5G Core Network.
The structure of an (IMSI) the 'home' Public Land Mobile Network (PLMN) is identified using a combination of the Mobile Country Code (MCC) and Mobile Network Code (MNC). The ITU is responsible for allocating the MCC, whereas the national administrator is responsible for allocating the MNC. A lJE uses the 'home' PLMN Identity when searching for a network, e.g. when completing a band scan, a UE will search for a cell which is broadcasting the 'home' PLMN Identity within SIB 1.
The subscriber is identified within the home PLMN using the Mobile Subscriber Identification Number (MSJN). The MSIN is allocated by the service provider.
The IMSI can be used as the 'SGS Mobile Identity' within NAS signalling procedures. For security reasons, the IMSI is included within NAS messages using a 'concealed' format which can hide the actual value. The 'Protection Scheme' indicated as part of the 'SGS Mobile Identity' field can be set to 'null' in which case the fMSI is visible within the message. Alternatively, the 'Protection Scheme' can be set to "ECIES Scheme Profile A', 'ECIES Scheme Profile B' or an operator specific scheme. These protection schemes are used to encrypt the IMSI prior to including within the message.
In the case of 5G, the IMSI is not used for paging procedures
IMEI
5G UE Identities (IMEI) - The International Mobile Equipment Identity (IMEI) is a permanent identity belonging to a device. It is stored within the device hardware and by the User Data Management (UDM) Network Function within the 5G Core Network.
The structure o1ran IMEI is illustrated in the figure below:
The Type Allocation Code (TAC) is an 8 digit number which identifies the UE model. It can also identify a specific version of a UE model, i.e. different versions of the same UE model can be allocated different TAC. The TAC is allocated by the GSM Association (GSMA)
The Serial Number (SNR) uniquely identifies a device with a specific TAC. All UE which have the same TAC should be allocated different Serial Numbers. The Serial Number is allocated by the device manufacturer
The Check Digit (CD) is calculated from a combination of the TAC and Serial Number. It provides a mechanism for detecting data entry errors, e.g. when the IMEI is manually entered into a system
The IMEI can be used within NAS signalling procedures as the 'SGSMobileIdentity'. In contrast to the IMSI, the IMEI does not use a 'Protection Scheme' to provide encryption. Instead, the IMEI can be included directly within NAS signalling messages.
SUPI & SUCI
5G UE Identities ( SUPI& SUCI) - A 5G Subscription Permanent Identifier(SUPI) can be either
An International Mobile Subscriber Identity {IMS!)
A Network Access Identifier (NAI)
An NAI has the following structure: username@realm. It represents a network specific identity for a private network and is specified by IETF RFC 7542.
A Subscription Concealed Identifier (SUCI) allows the SUPI to be signalled without exposing the identity of the user. Signalling procedures use the SUCI rather than the SUPI to provide privacy. For example, the 'SGS Mobile Identity' within NAS signalling procedures can be based upon a SUCl (alternatively, the 'SGS Mobile Identity' can be an IMEI, IMEISY, 5G-GUTI or 5G-S-TMSI).
The SUCl uses a 'ProtectionScheme' which can be set to 'null' in which case the SUPI is visible within the message. Alternatively, the 'Protection Scheme' can be set to 'EClES Scheme Profile A', 'ECIES Scheme Profile B' or an operator specific scheme. These protection schemes arc used to encrypt the SUPI prior to including within the message.
5G-GUTI
5G UE Identities (GUTI) - The 5G Globally Unique Temporary Identifier (5G-GUTI) is allocated by the AMF. It is a temporary identity so it does not have a fixed association with a specific subscriber nor device. The use of a temporary identity helps to improve privacy. The AMF can change the allocated 5G-GUTI at any time.
The structure of the 5G-GUTI is illustrated in the below figure. It is a concatenation of the Globally Unique AMF Identifier (GUAMI) and 5G-TMSI. The GUAMI is a concatenation of the PLMN Identity and the AMF Identifier. Inclusion of the GUAMI allows identification of the AMF which allocated the 5G-GUTI. The 5G-TMSI identifies the UE within that AMF.
3GPP has specified a mapping between the 5G GUTI and the 4G GUTI. This mapping is used when a UE moves between technologies. For example, when a UE moves from 5G to 4G and is required to send a GUTI to the MME, then the UE maps the 5G- GUTI onto the 4G GUTI and forwards it to the MME. The MME can then complete the reverse mapping to identify the AMF that it needs to contact in order to retrieve the UE context. Similarly, when a UE moves from 4G to 5G then the 4G GUTI can be mapped onto the 5G-GUTI and sent to the AMF. The AMF can then extract the MME Identity and subsequently request the UE context.
5G - S - TMSI
5G UE Identities (S-TMSI) - The 5G-S-TMSI is a shortened version of the 5G-GUTI, i.e. it excludes the PLMN Identity and the AMF Region Identity. This means that it can be used to identify a UE within a specific AMF Region but it cannot be used to identify a UE across a set of AMF Regions.
It is more efficient to use the 5G-S-TMSI rather than the 5G-GUTI when completing signalling procedures because the smaller size helps to reduce the signalling overhead.
The structure of the 5G-S-TMSl is illustrated in the figure below. It is a concatenation of the AMF Set Identity, the AMF Pointer and the 5G-TMSI
The 5G-S-TMSI is used within RRC signalling procedures. For example, the first 39 bits of the 5G-S-TMSI can be included within an RRCSetupRequest message, while the last 9 bits can be included within an RRCSetupComplete message. The 5G-S-TMSI can also be included within a Paging message.
RNTI
5G UE Identities (RNTI) - Radio Network Temporary Identifiers (RNTl) are applicable within the Radio Access Network. They are allocated by the Base Station and are subsequently stored by both the Base Station and UE. They are used to address either an individual UE, a group of VE or all VE. For example, the C-RNTI can be used to address an individual UE, whereas an INT-RNTI can be used to address a group of UE and the SI-RNTI can be used to address all UE.
A UE is addressed by using the RNTI to scramble the CRC bits which are attached to the PDCCH DCI payload, i.e. an RNTI is used to address the UE on the PDCCH. The PDCCH can then be used to provide uplink and downlink resource allocations, power control commands, pre-emption indications, Slot Format changes and System Information update indications.
All RNTI have a length of I6 bits.
The Sl-RNTI is used to scramble the CRC bits belonging to DCI Format 1_0 when allocating PDSCH resources for the transmission of System Information. 3GPP has standardised a single SI-RNTI value which is used by all UE.
The P-RNTI is used to scramble the CRC bits belonging to DCI Format I_0 when allocating PDSCH resources for the transmission of Paging messages, or when using the PDCCH to encapsulate a 'Short Message'. A 'Short Message' can be used to indicate that System Information content has changed and needs to be re-acquired. lit can also be used to indicate an Earthquake and Tsunami Warning System (ETWS) primary notification on SIB6, or an ETWS secondary notification on SIB7, or a Commercial Mobile Alert System (CMAS) notification on SIB8. 3GPP has standardised a single IP-RNTI value which is used by all UE.
The RA-RNTI is used during the Random Access procedure when allocating PDSCH resources for the Random Access Response (MSG2). There is a one-to-one mapping between the RA-RNTI and the time-frequency resource used by the UE when transmitting the Random Access Preamble. This means that all UE using the same Random Access occasion will share the same RA-RNTI and the same PDCCH transmission. The content of the PDSCH differentiates between the set of UE using the Random Access Preamble Identity (RAPID) within the MAC sub-header.
The Temporary C-RNTl (TC-RNTI) is allocated during tbc Random Access procedure within the Random Access Response (MSG2). It is subsequently used to address the UE when allocating PUSCH resources for MSG3 re-transmissions. It is not necessary to use the TC-RNTI when allocating resources for the initial MSG3 transmission because that resource allocation is included within MSG2 (rather than within a PDCCH transmission). The TC-RNTI is also used when allocating PDSCH resources for MSG4.
The Cell RNTI (C-RNTI) is set equal to the TC-RNTI after successful Random Access contention resolution. The C-RNTI is changed whenever a UE completes a handover towards a new cell. The C-RNTI is used to address the UE when allocating PDSCH or PUSCH resources to that UE. It can also be used to initiate a PDCCH Order with DCI Format 1_0.
The MCS-C-RNTI, CS-RNTI, TPC-PUSCH-RNTI, TPC-PUCCH-RNTI, TPC-SRS-RNTI, SP-CSI-RNTI can be allocated to a UE using the PhysicalCellGroupConfig parameter structure. e.g. within an RRCSetup, RRCReconfiguration or RRCResume message
The MCS-C-RNTI can be used to dynamically switch between the MCS tables applied to the PUSCH or PDSCH. In the case of dynamic scheduling, a UE applies the low spectral efficiency MCS table if it receives a resource allocation using the MCS-C-RNTI.
The Configured Scheduling RNTI (CS-RNTl) can be used to activate and deactivate 'Configured Grant' transmissions in the uplink and 'Semi-Persistent Scheduling' (SPS) in the downlink. It is also used when allocating dynamic resources for re-transmissions.
The TPC-PUSCH-RNTI, TPC-PUCCl-1-RNTI and TPC-SRS-RNTI are used to provide Transmit Power Control(TPC) commands for the PUSCH, PUCCH and SRS respectively. DCI Formats 2_2 and 2_3 arc able to provide TPC commands for a group ofUE rather than only a single UE. This means that multiple UE can be allocated the same RNTI and all those UE decode the same PDCCH payload. Each UE is able to extract its TPC commands from the appropriate position within the payload.
The Interruption RNTI(INT-RNTI) is used to provide a Preemption Indication within DCI Format2_1. A UE can be configured with an INT-RNTl using the DownlinkPreemption parameter structure that belongs to the PDCCH-Config. DCI Format 2_1 is able to provide Pre-emption Indications to a group of UE rather than only a single UE. This means that multiple UE can be allocated the same RNTI and all those UE decode the same PDCCH payload. Each UE is able to extract its Pre-emption Indication from the appropriate position within the payload.
The Slot Format Indicator RNTI (SFI-RNTI) can be used to dynamically change the Slot Format using DCI Format 2_0. The Slot Format can be changed by reconfiguring 'flexible' symbols to either uplink or downlink symbols. A UE can be allocated an SFl-RNTI within the SlotFormatIndicator parameter structure. DCI Format 2_0 is able to provide Slot Format Indicators to a group of lTE rather than only a single UE. This means that multiple UE can be alloca1ted the same RNTI and all those UE decode the same PDCCH payload. Each UE is able to extract its Slot Format Indicator from the appropriate position within the payload.
The Semi-Persistent CSI RNTI(SP-CSl-RNTI) can be used to trigger the activation or deactivation of semi-persistent CSI reporting on the PUSCH. This is done using the 'CSI Request' field within DCI Format 0_1 when the CRC bits have been scrambled using the SP CSI-RNTI
I - RNTI
The Inactive RNTI(1-RNTI) is applicable to the RRC Inactive State. In contrast to other RNTI, the I-RNTI is not used to scramble the CRC bits belonging to the PDCCH payload. Instead, the 1-RNTI is used to address the UE within RRC signalling messages.
I-RNTI can be allocated to a UE within an RRC Release message when moving the UE from RRC Connected to RRC Inactive.The I-RNTI is used to identify both the UE and the Base Station which hosts the UE context. This allows the UE context to be moved from one Base Station to another Base Station if the UE is mobile while RRC Inactive
There are two variants of the I-RNTI:
A full I-RNTI which has a length of40 bits. This variant can be included within an RRCResumeRequest I message which has a size of 64 bits. This is relatively large for a MSG3 transmission so there is a risk that uplink coverage may be compromised.
A short I-RNTI which has a length of24 bits. This variant can be included within an RRCResumeRequest message which has a size of48 bits. This is the normal size for MSG3 when transferring a CCCH message.
The useFuLLResumeID flag within SIBI instructs the UE to use either the full or short I-RNTI when resuming a connection ,i.e. this flag instructs the UE to send either an RRCResumeRequest message or an RRCResumeRequest1 message.
3GPP does not specify the number of bits within the I-RNTI which should be used to identify the Base Station, and the number of bits which should be used to identify the UE. The division of the total number of bits is left to the network implementation.
Comments
Post a Comment