A Survey of 5G Core Network User Identity Protections, Concerns, and Proposed Enhancements for Future 6G Technologies

Abstract

Fifth-Generation (5G) cellular networks extensively utilize subscriber identifiers throughout the protocol stack, thereby linking subscribers to their activities on the network. With the inherent use of linked identifiers comes the potential capability to track subscribers’ location and behavior, which poses critical challenges for user identity protections and privacy in sensitive applications like military or healthcare operating over public 5G infrastructure. The reliance on such personal identifiers threatens a user’s right to privacy and brings to light the importance of proper mechanisms to mitigate these risks for current and future cellular network technologies. In this paper, we explore the 5G specifications to understand the most important list of identifiers and their use across Virtual Network Functions (VNF), and points of exposure within the Core Network (CN). We also examine the existing literature regarding identity protections and efforts to mitigate privacy concerns targeted in the CN. Findings include the need for a trust relationship between users and their network providers to protect and safeguard their identity. While 5G technology has greater user identity protections compared to previous cellular generations, our analysis shows that several areas of concern remain, particularly in the exchange of subscriber metadata. This work also finds that new technologies adopted in 5G networks add further complexity to maintaining a strict posture for safeguarding user identity and privacy protections. This paper also reviews the scientific community’s proposed enhancements for future 6G networks’ user identity and privacy protections, with a focus on emerging Artificial Intelligence (AI) and Machine Learning (ML) applications. The ethical implications of private or anonymous communications are also carefully weighed and examined to understand the multifaceted nature of this topic. Our work is concluded by proposing important further research to reduce the prevalence and reliance on personal identifiers such as the SUPI (Subscription Permanent Identifier) within 5G Core operations to help better protect user identity. We also propose replacing the widespread use of the SUPI between VNFs with ephemeral identifiers, building upon efforts by 3GPP aiming for 5G to protect the SUPI from eavesdroppers.

1. Introduction

1.1. Technological Privacy in the Modern Day

Throughout everyday life, a person may expect a basic amount of privacy: locks on doors, shades on windows, fenced-in yards, lack of surveillance, etc. In our modern information society, however, there is also an increasing awareness that privacy expectations may be reduced in public environments and online activities. Categorizing these two philosophical systems could lead to an interpretation with two main privacy ‘spaces’: personal and public. The approach to one’s personal privacy space may be more commonly seen as influenced by current cultural norms along with individual preferences, thereby shaping expectations. The same applies to the public privacy space, where it has been agreed upon for societies to at least retain a basic amount of privacy per person. With the inclusion of technological devices, networks, and utilities in daily life, the problem of maintaining privacy and trust grows to large proportions.

In the context of 5G networks, users have a basic expectation that their communications are secured by the network of their choice. Network operators have an important role in safeguarding users’ data and privacy by properly deploying networks that strictly follow 3GPP standards while ensuring that all efforts are made to protect their end users. A user’s ‘data’ can have different definitions depending on the context. In one sense, ‘data’ means the packets that users send across the service, such as between websites, cloud services, or other users, as well as text messages and phone calls. In other definitions, ‘data’ may refer to metadata, which can include analytics around usage, conversations, location, personally identifiable data, connection and disconnections, IP addresses, hardware identifiers, etc. This paper focuses on how 5G networks handle users’ metadata, specifically their identity, and efforts underway aiming to achieve a more anonymous user experience for users connected to public or private 5G infrastructure. Anonymous connections in public infrastructure have many real-world applications in healthcare and secure military and government operations. However, they also give rise to potential abuse by malicious parties or for unlawful activities. As such, a balanced approach is needed that both protects regular users and helps to enforce applicable laws to prevent unlawful activity. As the standards for 5G networks are region agnostic, they require adherence to local laws and regulations, meaning user identity protections could vary around the world.

Basic concepts around secure and anonymous internet systems can be modeled after the Tor project [1]. Tor is a decentralized network of machines that route and encrypt user information while hiding the user’s true identity. Tor users who interact with internet systems while connected to the Tor network can maintain an anonymous profile through the many mechanisms implemented to protect user identity and ensure their privacy. While the usage of Tor brings multiple ethical and political implications, it has been proven over time to be an effective mechanism for maintaining anonymity while connecting to online services [2].

1.2. Focus of This Paper

Our study of the identifiers used in 5G networks and proposed methods for future 6G networks is focused on operations within the Core Network. Furthermore, our study looks at the specific implications of how these identifiers are used within the 5G standard to strengthen user identity protections while also raising discussions around vendor and network operator trust. Other works in the realm of 5G privacy and security give insight into the vast landscape of 5G technologies and may briefly touch on the topic of user identity protections [3,4,5,6,7,8,9,10]. These works give much needed background for many different avenues of current research on 5G networks and aspects of maintaining strict guidelines for user identity protections. We look to utilize the information in these surveys alongside more focused approaches around personal identifiers to strengthen the need for further protections as 6G networks anticipate massive heterogeneous connectivity of devices.

The remainder of our study will review user identity and privacy through the lens of 5G Standalone (SA) systems as 5G SA systems tend to resolve some concerns from previous generations [11], with a specific focus on the Core Network. We look into the identifiers used in 5G technology that could be traced back to users, followed by a review of the privacy impacts from new technologies adopted into 5G networks, a look at proposed schemes to heighten privacy, the impacts of lawful interception policies, and what these findings, challenges, and opportunities mean for future 6G networks. Our survey also presents our conclusions regarding the impact of 5G systems on user identity and privacy.

2. Concerns Related to User Identity and Privacy in 5G Core Networks

Fifth-Generation CNs are instrumental in creating a more extensible cellular communications system that provides its users with lower latency, higher performance, and more application use cases. Its modular software-driven architecture also allows vendor proliferation, where different vendors can be utilized together in a single 5G system to realize all the required functionalities within the 5G Core and other 5G aspects. Such diverse 5G CNs are the central points that manage all operations in a given 5G network, which is both beneficial to the operator and potentially problematic for ensuring user privacy. Specific mechanisms are put in place by the 3GPP to hinder the tracking of user devices in roaming situations on 5G networks, like the use of the 5G-GUTI (Globally Unique Temporary ID). However, 5G technology continues to embrace the central tenet inherited from prior cellular technology generations: the trustworthiness afforded to the Home Network (HN) to maintain a secure system and not violate the trust given to it by its own users. However, vendor proliferation brings with it a lack of oversight and the erosion of that trust premise. This was most recently seen in late 2024, where, even with extensive safeguards in place, multiple telecom systems in the US were breached, allowing threat actors to track high-ranking government officials’ phone activities and obtain information on where, when, and with whom communications took place [12]. In early 2024, there was a large breach of customer data within one of the largest US telecom companies, affecting over 50 million customers [13,14]. The cause of the breach was stated to be a mistake by a third-party cloud service provider. Similar occurrences were observed in late 2023 with another large US telecom company, where over 60,000 customers nationwide were impacted [15]. After an investigation, internal wrongdoing and inadvertent disclosure were deemed to be the cause for the extensive release of sensitive customer data, including Social Security Numbers (SSN).

The topic of trust is extensively explored by the authors of [16], and they also give an in-depth analysis of trust in cellular networks. They speak of how the concept of trust is complicated and used in various contexts, all of which also come with slightly different meanings. As a whole, the important point is ‘how much’ an entity ‘knows’ about another. They explain that trust models in cellular networks are often overlooked, while, at the same time, it is becoming ever more important for them to be well defined for the plethora of services in a 5G ecosystem. Figure 1 depicts a holistic view of the 5G system architecture, with an emphasis on the SBA and its large number of provided services and VNFs.

Table 1. List of 5G VNF abbreviations and names corresponding to Figure 1.

VNF Abbreviation Resolutions
5G DDNMF	Direct Discovery Name Management Function	NEF	Network Exposure Function
5G-EIR	Equipment Identity Register	NRF	Network Repository Function
AAnF	Authentication and Key Management for Applications (AKMA) Anchor Function	NSACF	Network Slice Admission Control Function
ADRF	Analytics Data Repository Function	NSSAAF	Network Slice Specific Authentication and Authorization Function
AF	Application Function	NSSF	Network Slice Selection Function
AMF	Access and Mobility Management Function	NSWOF	Non-Seamless WLAN Offload Function
AUSF	Authentication Server Function	NWDAF	Network Data Analytics Function
BSF	Binding Support Function	PCF	Policy Control Function
CHF	Charging Function	SBC	Session Border Controller
CSCF	Call Session Control Function	SCP	Service Communication Proxy
DCCF	Data Collection Configuration Function	SEPP	Security Edge Protection Proxy
DCMF	Distributed Control and Management Framework	SMF	Session Management Function
DCSF	Data Channel Signaling Function	SMSF	Short Message Service Function
EASDF	Edge Application Server Discovery Function	TNGF	Trusted Non-3GPP Gateway Function
GMLC	Gateway Mobile Location Centre	TSCTSF	Time-Sensitive Communication Time Synchronization Function
HSS	Home Subscriber Server	TSN AF	Time-Sensitive Network (TSN) Application Function
IBCF	Interconnection Border Control Function	TWIF	Trusted WLAN Interworking Function
LMF	Location Management Function	UCMF	User Equipment (UE) Capability Management Function
MB-SMF	Multicast/Broadcast Session Management Function	UDM	Unified Data Management
MB-UPF	Multicast/Broadcast User Plane Function	UDR	Unified Data Repository
MBSF	Multicast/Broadcast Service Function	UDSF	Unstructured Data Storage Function
MBSTF	Multicast/Broadcast Service Transport Function	UPF	User Plane Function
MFAF	Messaging Framework Adapter Function	VAS	Value-Added Services
MRF	Multimedia Resource Function	W-AGF	Wireline Access Gateway Function
N3IWF	Non-3GPP Interworking Function

lists the abbreviations and full names for all of the VNFs shown in Figure 1.

2.1. Fifth-Generation Service-Based Architecture and Personally Identifiable Information

One of the major innovations in 5G CNs compared to previous generations is the inclusion of SBA and Virtual Network Functions (VNFs). VNFs are specialized software programs, also known as micro-services, utilized to perform a specific and limited set of tasks. In 5G technology, many different VNFs come together within the CN, working together through well-defined interfaces to facilitate 5G operations. For example, the AMF (Access and Mobility Function) plays the important role of granting a user access to the 5G network. The SBA is the mechanism that allows all VNFs to communicate with each other. Communications between VNFs are carried out by way of RESTful APIs (Representational State Transfer Application Programming Interfaces), similar to how normal day-to-day internet communications with web services are handled. 3GPP standardizes the request schema, parameters, responses, etc., such as in TS 29.500 and 29.501 [17,18]. Many of these requests, however, contain important data elements that can be linked back to a specific user, also known as Personally Identifiable Information (PII). The HN is responsible for maintaining user privacy during authentication or operations together with a roaming network. This is achieved by way of the 5G-GUTI, a temporary identifier used to obfuscate the identity of a user in the Radio Access Network (RAN), as specified in 3GPP TS 33.501. The AMF holds a mapping table of UE (User Equipment) 5G-GUTIs that ultimately trace back to the SUPI. The 5G-GUTI is primarily used in NAS (Non-Access Stratum) layer signaling procedures from the AMF to the UE, instead of leaking the device’s permanent identifier over the air [19]. Interactions between the RAN and UE utilize dynamic identifiers for radio scheduling and resource control. Notably, the Radio Network Temporary Identifier (RNTI) is vital for these RAN operations at the MAC (Medium Access Control) layer of the 5G protocol stack. RNTI usage is related to the 5G-GUTI at higher protocol layers but is not directly associated with or mapped within the CN.

To protect against eavesdropping or the capture of the SUPI when transmitting over the air, 5G technology implements an encrypted version of the SUPI called the SUCI (Subscription Concealed Identifier). The SUCI is mainly utilized in the initial connection of a UE to the network. The SUPI, however, is widely used within the CN to enable normal network operations for connected devices. Some of these operations include Authentication, Roaming Support, Billing, Subscriber Data Management, Quality of Service (QoS), and PDU (Protocol Data Unit) Session Management. Figure 2 represents the elements and VNFs that the SUCI and SUPI are associated with, according to our extensive analysis of the 3GPP Release 18 VNF API specifications. This analysis clearly shows that the SUPI is used extensively throughout many VNFs along the SBA, which causes concerns for user identity exposure through CN metadata tracking and analysis by Core Network elements.

In Table 2, we present an overview of the various identifiers used throughout 5G activities, along with the standards that define them and a description of how and where they are predominantly used. While a user is roaming, the 5G-GUTI makes it much more difficult for a threat actor to identify this user and track their movements through the RAN. The user must maintain trust with the HN, however, to safeguard its privacy, as the HN is responsible for maintaining the logical information required to trace a 5G-GUTI back to a SUPI for identification purposes. It is thus a potential weak point in identity protection within 5G networks. Figure 3 illustrates how the 5G-GUTI is used and mapped back to the SUPI in the CN.

2.2. Newly Adopted Technologies

The authors of [20] provide a breakdown of the identity and privacy risks in 5G networks introduced by newly adopted technologies. A unique perspective presented in this article focuses on the subscribers’ viewpoint, although this is subjective. They state that there is a gap in users’ attention to privacy implications, while there are tools and techniques to assist organizations in performing privacy impact assessments. The authors argue that, even though service providers perform these assessments to fulfill legal, regulatory, and policy requirements, the user may not be aware of the potential privacy risks that come along with using 5G systems. The privacy risks due to new technologies identified by the authors within 5G networks are listed in

Table 3. Description of new technologies adopted in 5G CNs that could affect user identity protections.

New Adopted Technologies in 5G and Potential Threats They Pose to User Identity Protections [20]
Technology	Summarized Description
Cross-Border Data Flows	As nations’ data networks are interconnected, data must be transmitted and shared securely while also maintaining user privacy. Different countries around the world may have different standards for protecting user privacy.
Virtualization and Cloudification	The use of Software-Defined Networking (SDN) and VNFs allow for virtual connections between cloud services, compared to previous generations where all interfaces and network connections were closely coupled physically. If these cloud services or resources are shared, there is a possibility for unauthorized user data access.
SDN	SDN is a vital enabler of 5G networks, enhancing flexibility and performance by separating the control, data, and application layers through standard interfaces. The control layer, managed by the SDN controller, oversees data flow, while the application layer supports functions like load balancing and quality assurance. Despite its advantages, SDN introduces privacy risks, such as attacks on the controller or application layer that can lead to unauthorized access and manipulation of data flows [31]. To mitigate these risks, robust authentication, together with authorization mechanisms and privacy impact assessments, is essential in SDN-based 5G deployments.
Insider Threats	It is vital that a user of a network can afford a high degree of trust towards the operators. The complexity of a 5G environment increases the opportunity for intentional or unintentional user privacy compromises. Similarly, it is possible for insiders to misuse critical network elements, resulting in a lack of integrity of the user’s privacy [32]. As this was a threat in previous generations of cellular networks, the threat model has only grown and become more complex due to the deployment of the extensible technologies listed earlier. The increased dependence on cloud services and Software-Defined Networking has provided more areas for misuse. The additions to 5G infrastructure thus require strict access and monitoring procedures.

, with an emphasis on privacy issues within CNs.

Table 2. List of identifiers in 5G communications with a focus on the CN.

Identifiers in 5G Communications
Identifier	Applicable Standards	Description
Subscription Permanent Identifier (SUPI)	TS 33.501 [21], TS 23.003 [22], TS 22.261 [23], TS 23.316 [24]	A globally unique SUPI is allocated to each subscriber and provisioned in the UDM (Unified Data Management)/UDR (Unified Data Repository). The SUPI may contain an IMSI (International Mobile Subscriber Identity), a network-specific identifier, or other identifiers for specific use cases. It is concealed for privacy and supports roaming and interoperability with (Long-Term Evolution) networks.
Subscription Concealed Identifier (SUCI)	TS 33.501, TS 23.316	The SUCI is a privacy-preserving identifier containing the concealed SUPI. It is used for secure identification in the 5G system. The usage of SUCI for non-3GPP network access is also specified within TS 23.316.
Permanent Equipment Identifier (PEI)	TS 23.003, TS 23.316	The PEI identifies the UE in the 5G system. In 3GPP access modes, the PEI must be either the IMEI (International Mobile Equipment Identity) or IMEISV (International Mobile Equipment Identity Software Version). For non-3GPP access scenarios, the UE sends the IEEE Extended Unique Identifier EUI-64 [25].
5G-GUTI	TS 33.501, TS 23.003, TS 38.304 [26], TS 36.304 [27], TS 38.331 [28], TS 36.331 [29]	The 5G-GUTI is a temporary identifier assigned by the AMF to the UE. It is structured as [<GUAMI> <5G-TMSI>] (Globally Unique AMF ID) and supports both 3GPP and non-3GPP access. The AMF ensures the uniqueness of the 5G-TMSI within the GUAMI.
AMF Name	TS 23.003	The AMF is identified by a globally unique Fully Qualified Domain Name (FQDN). Each AMF can be associated with one or more GUAMI(s).
Data Network Name (DNN)	TS 23.003, TS 23.502 [30]	The DNN is equivalent to an APN (Access Point Name) and is used to select SMF (Session Management Function), UPF (User Plane Function), and N6 (5G Internet Connectivity Interface) interfaces for a PDU Session.
Internal-Group Identifier	TS 23.502	The Internal-Group Identifier associates a UE with groups in the subscription data. It is used for applying group-specific policies in the SMF and AMF.
Generic Public Subscription Identifier (GPSI)	TS 23.003	The GPSI is a public identifier (Phone Number or External Identifier) used to address a 3GPP subscription outside the 3GPP system. It is stored in the subscription data and associated with the SUPI.
AMF UE NGAP (Next-Generation Application Protocol) ID	TS 38.413	The AMF UE NGAP ID is used to identify the UE on the N2 reference point. It is unique per AMF set and may be updated without changing the AMF.
UE Radio Capability ID	TS 23.003	The UE Radio Capability ID uniquely identifies a set of UE radio capabilities. It can be assigned by the UE manufacturer or the serving PLMN. The PLMN-assigned ID includes a Version ID to ensure its validity.

Table 2. List of identifiers in 5G communications with a focus on the CN.

Identifiers in 5G Communications
Identifier	Applicable Standards	Description
Subscription Permanent Identifier (SUPI)	TS 33.501 [21], TS 23.003 [22], TS 22.261 [23], TS 23.316 [24]	A globally unique SUPI is allocated to each subscriber and provisioned in the UDM (Unified Data Management)/UDR (Unified Data Repository). The SUPI may contain an IMSI (International Mobile Subscriber Identity), a network-specific identifier, or other identifiers for specific use cases. It is concealed for privacy and supports roaming and interoperability with (Long-Term Evolution) networks.
Subscription Concealed Identifier (SUCI)	TS 33.501, TS 23.316	The SUCI is a privacy-preserving identifier containing the concealed SUPI. It is used for secure identification in the 5G system. The usage of SUCI for non-3GPP network access is also specified within TS 23.316.
Permanent Equipment Identifier (PEI)	TS 23.003, TS 23.316	The PEI identifies the UE in the 5G system. In 3GPP access modes, the PEI must be either the IMEI (International Mobile Equipment Identity) or IMEISV (International Mobile Equipment Identity Software Version). For non-3GPP access scenarios, the UE sends the IEEE Extended Unique Identifier EUI-64 [25].
5G-GUTI	TS 33.501, TS 23.003, TS 38.304 [26], TS 36.304 [27], TS 38.331 [28], TS 36.331 [29]	The 5G-GUTI is a temporary identifier assigned by the AMF to the UE. It is structured as [<GUAMI> <5G-TMSI>] (Globally Unique AMF ID) and supports both 3GPP and non-3GPP access. The AMF ensures the uniqueness of the 5G-TMSI within the GUAMI.
AMF Name	TS 23.003	The AMF is identified by a globally unique Fully Qualified Domain Name (FQDN). Each AMF can be associated with one or more GUAMI(s).
Data Network Name (DNN)	TS 23.003, TS 23.502 [30]	The DNN is equivalent to an APN (Access Point Name) and is used to select SMF (Session Management Function), UPF (User Plane Function), and N6 (5G Internet Connectivity Interface) interfaces for a PDU Session.
Internal-Group Identifier	TS 23.502	The Internal-Group Identifier associates a UE with groups in the subscription data. It is used for applying group-specific policies in the SMF and AMF.
Generic Public Subscription Identifier (GPSI)	TS 23.003	The GPSI is a public identifier (Phone Number or External Identifier) used to address a 3GPP subscription outside the 3GPP system. It is stored in the subscription data and associated with the SUPI.
AMF UE NGAP (Next-Generation Application Protocol) ID	TS 38.413	The AMF UE NGAP ID is used to identify the UE on the N2 reference point. It is unique per AMF set and may be updated without changing the AMF.
UE Radio Capability ID	TS 23.003	The UE Radio Capability ID uniquely identifies a set of UE radio capabilities. It can be assigned by the UE manufacturer or the serving PLMN. The PLMN-assigned ID includes a Version ID to ensure its validity.

2.3. Linkability

The use of data, in particular in connection with cloud services and internet activities, has grown dramatically in recent years. With this increase in data consumption and production comes an inherent increase in concerns regarding identity protections on the internet. The NIST (National Institute of Science and Technology) defines linkable data as “information about or related to an individual for which there is a possibility of logical association with other information about the individual” [33]. Such attacks, where data can be linked back to the person of origin if not handled properly, can be seen in healthcare scenarios [34]. Data linkability concerns cover many different domains and are also highly relevant in 5G networks. A survey conducted on 5G privacy scenarios underscores the importance of keeping the personal or hardware identifiers of a user within a 5G network private [35]. Constant connectivity to a 5G network can facilitate an environment for the unauthorized tracking of individuals using these identifiers. The authors state that it is important for 5G networks to adopt privacy-by-design principles to help mitigate user identity threats. The conclusions from this study state that a complete solution to achieve these privacy objectives goes beyond technology and ultimately also requires legal and regulatory actions. The work shown in [36] mentions that the large number of devices connected to a 5G network and the increasing number of IoT devices only further complicate the management of maintaining user privacy and ensuring non-linkability between device hardware identifiers and personal identity. The researchers in [11] mention the fact that, after a UE has been authenticated on the network, the CN is responsible for creating and periodically updating an associated new temporary identifier: the 5G-GUTI for Standalone networks or the 4G-GUTI for Non-Standalone (NSA) networks. The authors point out that there are no mechanisms put in place for the CN to avoid tracking its users, as all temporary identifiers are also linked back directly to the SUPI. This leaves a possible vulnerability for misuse by untrusted network operators, as end-to-end privacy and the anonymity of the user are not inherently built into the system and thus cannot be guaranteed. Takeaways from [37] cover implementations of the 5G CN stack in open-source repositories. The authors uncovered two novel attacks that potentially allow for attacks against UE privacy with vulnerabilities in the 5G-GUTI update mechanism.

3. Privacy Enhancement Proposals for 5G Core Networks

With the understanding that 5G technology comprises a powerful and complex system, and the goal of maintaining user identity and privacy protections within these systems is an increasingly important and complex issue, researchers have made strides in suggesting mechanisms to create a more private experience for users of 5G networks. For example, the study shown in [38] presents different proposed solutions to conceal the long-term identity of a user across network operations, especially communications between the UE Roaming Network and the HN. The work reviews the schemes using various technologies: pseudonyms [39,40,41,42], Certificate-Based Public-Key Cryptography, Root-Key-Based Encryption, and Identity-Based Encryption. Privacy Enhanced Fast Mutual Authentication (PEFMA) is introduced as a way to conceal the user’s identity over time in normal and roaming scenarios. This approach is similar to how the SUPI is encrypted over the air but differs in that it uses different cryptographic principles. However, both solutions still require trust in the HN. The authors in [43] present mechanisms to protect privacy in Vehicular Networks, giving users conditional anonymity. Traceability to identities is possible via threshold cryptography, requiring collaboration between authorities only for misbehavior or legal abuses. In this mechanism, the HN is considered to be the Trusted Authority, which is responsible for generating and managing the cryptographic secrets. In [44], a pseudonym approach is presented that enhances the 5G-AKA (Authentication and Key Agreement) protocol to never utilize the subscriber’s personal identifier, even during the first attachment. Research conducted in [45] breaks down the vulnerabilities to user privacy in the 5G-AKA protocol. This occurs when a UE has initial authentication communications with the CN. The authors state that the AKA protocol is vulnerable to ‘guess’ and ‘replay’ attacks. An attacker that successfully completes these attacks could generate SUCIs using the HN’s public key, testing these against the network’s response of success or failure, thus leading to the possibility of an attacker tracking a user. The authors of [45] propose three methods to strengthen the 5G-AKA protocol, with the recommended solution relying on the user’s secret key stored in the SIM card, along with using the UE’s ephemeral public key that is generated during the creation of the SUCI. In their approach, the SUPI guess attack is thwarted by including a hash of the user’s secret key into the HMAC (Hash-Based Message Authentication Code), which stops hackers from replicating the HMAC process for guessed SUPIs. The replay attack is patched by storing the user’s ephemeral public key in the CN’s database, allowing for replayed SUCIs to be rejected if their public key already exists. Research in [46,47] covers aspects of anonymous IoT data in a cloud network environment. The devices are associated into groups, and each group’s elected leader is responsible for aggregating the collected data and abstracting individual identities. However, all of the 5G-specific studies still rely on the existence of a trust relationship with the 5G Core Network. No research has yet addressed the scenarios arising when the trust between users and the 5G CN is eroded.

Lawful Interception

Lawful interception (LI) refers to the standardized approaches and technical mechanisms that allow law enforcement agencies to legally monitor a user’s voice, data, and metadata on public 5G infrastructures specified in 3GPP TS 33.106 [48]. These mechanisms are designed specifically and solely for these agencies to collect information on users for high-stakes scenarios: warrants, national security, public safety, etc. These standards, while useful for lawful surveillance, require strict policy enforcement to prevent misuse against innocent and law-abiding users. These policies could lead an individual to lose trust in 5G infrastructure as their implementations and usage are not always public knowledge. In a more technical sense, as these mechanisms are built into the system, they leave potential backdoor access for attackers who are looking to gather data on specific users. Having mechanisms in place to collect user data makes these attacks more realistic and attainable compared to in the scenarios where this type of technology access is not already implemented. Research carried out in [49] shows how 5G roaming security, built to prevent billing fraud, results in unprotected attack surfaces for state-sponsored attackers. The authors argue that there is no way for a user’s smartphone to verify roaming decisions around the underlying trust assumptions in specific CNs. They tested their theories on an open-source 5G repository, Open5GS [50], which could not prevent these attacks.

4. A Look Toward Privacy in 6G Core Networks

The next generation of 6G cellular networks will inherit technologies from 5G technology, as well as multiple new additions to create even more services for users, including ultra-low-latency communications and extreme throughput in mobile applications. Advances across the protocol stack, and through further proliferation and integration with cloud infrastructure for 6G operations, will yet again revolutionize the experience for consumers and will allow for more widespread coverage and connection. A comprehensive survey covering expected 6G technologies is shown in [51]. The authors of this research condense their findings and juxtapose current 5G technologies with emerging 6G advancements. An illustration of the authors’ proposed application sectors from their findings in 6G research is presented beside the three current 5G application sectors, URLLC (Ultra-Reliable Low-Latency Communications), eMBB (Enhanced Mobile Broadband), and mMTC (Massive Machine Type Communications), in Figure 4. Further comprehensive studies of the proposed Key Performance Indicators (KPI), such as the massive increase in connected devices with network heterogeneity, and open research questions for 6G technology are outlined in [52,53]. Furthermore, notable open research areas in terms of identity protection and privacy are listed below:

• Network Anomaly Detection: With the anticipated massive number of connected devices in 6G networks, there will a significant rise in the need for sophisticated network monitoring. A big contender for addressing this challenge is the use of FL for real-time, automated anomaly detection. However, evaluating and ensuring the accuracy, precision, and recall of these automated threat detection systems are important research questions.
• Regulatory Compliance: Sixth-Generation networks will be connected across geographical borders. This brings with it the need to address differing approaches, laws, and viewpoints regarding privacy and data handling between different countries.
• Security and Privacy in Edge Computing: With the diversity of 6G technology’s targeted use cases, there will be an inherent risk from edge computing to privacy and security. Since edge nodes may serve numerous devices at once, using shared resources, isolation of tasks will be vital for user privacy.
• Risk Assessment Frameworks for 6G Technology: A formal risk assessment framework must be created for 6G technology, as previous models may not fully capture the expansiveness and novel network capabilities of 6G technology. This model must also serve to explain privacy threats and their impact, as well as potential mitigation strategies.
• Privacy Concerns in Smart City and Health Services: Sixth-Generation networks will be handling a variety of potentially sensitive data, across domains such as healthcare, public services, self-driving cars, distributed energy resources, etc. Thus, in order to maintain privacy, there is a critical need for standards on data de-identification.
• Secure IoT Protocols and Energy Efficiency: Sixth-Generation technology aims to become even more efficient in terms of energy use compared to 5G technology and also improve cryptographic security. IoT devices are considered to be resource constrained, however, which means these devices need the ability to be energy efficient without jeopardizing their security by using less secure cryptographic schemes to save power.

Regarding data collection and analytics, a comprehensive survey on utilizing the data analytics functionality within 5G technology, and expanding on this service with ML in 6G technology, is discussed in [54]. In their study, the authors reveal some open research questions around privacy and how this specific core service gathers user data. One concern raised is that O-RAN (Open-RAN) specifications currently do not outline privacy-by-design architectures, which can cause significant issues regarding untrusted cloud operators. Such considerations are seemingly left up to system designers, which is a cause for concern. This mirrors our concerns about the assumptive trustworthiness of activities within the 5G core environment with regard to user privacy protections and data handling.

The authors in [51] bring to light three new sectors that could be introduced in 6G technology that are the intersections of the current 5G applications: mULC (Massive Ultra-Reliable Low-Latency Communication), ULBC (Ultra-Reliable Low-Latency Broadband Communication), and uMBB (Ubiquitous Mobile Broadband). One of the driving factors in the innovations sought by 6G technology is the amalgamation of intelligent systems in cellular networks.

4.1. Sixth-Generation Identity Protections

Sixth-Generation technology will incorporate many new technologies into the cellular ecosystem, all while inheriting methods from the 5G. User identity protections must be a major focus in shaping 6G protocols and architectures. Ref. [55] covers comprehensive topics regarding expected technologies within 6G technology, such as visible light communications, physical layer security, healthcare AI, homomorphic encryption, etc. Specific to identity protections, it states that improvements to AKA are imperative, along with improved management of subscriber identities. End-to-end encryption in 6G networks, on the user and control plane, is needed to resist eavesdropping and tracing attacks. While adding these technologies is vital, the authors do mention the technical issues and limitations that could arise due to heightened latencies, which goes against the goal of ultra-low-latency 6G networks. Various 6G use cases are also outlined in [56,57] which show the necessity for there to be a clear definition of de-identified datasets. The lack of a standard for the architecture of these user datasets may cause privacy leaks, jeopardizing user identity protections. Federated blockchain usage is proposed in [58] as a way to manage the identities of the expected billions of connected devices. The authors present a lightweight Hardware Security Module (HSM) to store cryptographic secrets, instilling trust in devices at a fraction of the cost of traditional HSMs and enhancing security, scalability, and privacy. The presented HSMs allow for end-to-end encryption on the 6G network, and fortified security in the instance of a threat actor inside the serving network, as the HSMs exclusively control the creation and storage of the private keys. This decentralized approach to key storage elevates user identity protections and aims to ensure tamper-proof operations.

4.2. Implications of AI for Identity Protections in 6G Technology

Artificial Intelligence (AI) and Machine Learning (ML) are tools that will be integrated ubiquitously into 6G networks and operations. As these tools require large numbers of data to be trained and will operate in monitoring and system management, there are concerns about how this could affect user identity privacy protections. The researchers who conducted a large study on the effects of ML on privacy in 6G technology present multiple points on how AI and ML could be used by an adversary to erode privacy protections within 6G networks, most notably through Inference of Private Information, Large-Scale Data Collection, and Stenographic Data Generation [59]. The authors mention a core aspect of AI and ML: that it can be a double-edged sword. Takeaways from this observation are that the inclusion of these systems will require the correct people along with strict guidelines in order to protect user privacy. On the other hand, work carried out in [60] brings a positive outlook to privacy protections in 6G networks, revealing how AI systems can be used to help conceal and anonymize user data. A major concern with AI in 6G networks is its possible ability to categorize users by gathering personal and non-personal information. Researchers in [61] bring together their findings in a study on the applicability of privacy solutions discovered against the found issues.

Table 4. The privacy solutions and applicability addressing concerns in personal and non-personal data [61]. The privacy solution is labeled in the far-left column, and the abbreviated privacy issues are presented in the columns on the right.

Privacy Solution	P1	P2	P3	P4	P5	P6	N1	N2	N3	N4	N5
Non-centralized ML	✓	✓	✓	✓	✓	X	X	✓	✓	✓	✓
Differential privacy and data perturbation	✓	✓	✓	X	✓	✓	✓	✓	X	✓	✓
Homomorphic encryption	✓	✓	✓	X	✓	X	X	✓	✓	✓	✓
Lightweight cryptography for IoT and edge	✓	✓	X	✓	✓	X	X	X	✓	✓	✓
Fog computing privacy preservation	✓	X	✓	✓	✓	X	X	X	✓	✓	✓
Blockchain-based consensus and storage	✓	✓	✓	✓	✓	X	X	✓	✓	✓	✓
Privacy level definitions and quantification	X	X	✓	✓	✓	✓	✓	✓	✓	X	✓

illustrates their discoveries and conclusions, which bring to light the most important privacy concerns in 6G networks. Table 4 shows the two major issues, similar to those discussed above for 5G technology, with understanding what a private system truly means: it is difficult to resolve defining levels and indicators for privacy and to determine the border between personal and non-personal data.

Table 5. Comparison of the current literature regarding AI, user identity protections, and privacy in 6G technology.

Current 6G AI Privacy Literature
Paper Title and Citation	Focus	Description
‘Privacy-Preserving AI Framework for 6G-Enabled Consumer Electronics’ [62]	Differential privacy, federated learning	Covers user data privacy concerns in 6G technology and presents a differential privacy and federated learning (FL) framework, offering a solution to safeguard sensitive user data during transmission. Blockchain is utilized to support the FL model in a decentralized manner, reducing vulnerabilities.
‘AI and 6G Security: Opportunities and Challenges’ [63]	Intelligent security privacy provisions	Discusses the use of AI to catch and deter threats in 6G networks. Mentions the use of AI as a double-edged sword, and the importance of maintaining user privacy given the huge influx of data consumed or produced by models. Underscores the importance of the “Ethics by Design” of AI systems.
‘Personal Data Protection in AI-Native 6G Systems’ [64]	AI privacy compliance, privacy by design	Identifies privacy risks with AI-enabled 6G systems, such as privacy breaches, data misuse, lack of transparency, and bias. Solutions to these issues include regulatory compliance, bias audits, and explainable AI-deployed systems.
‘Artificial Intelligence Applications and Self-Learning 6G Networks for Smart Cities Digital Ecosystems: Taxonomy, Challenges, and Future Directions’ [65]	Cellular network evolution, self-learning AI systems	Details how 6G technology can be used to create smart cities with interconnected services and applications. Stresses the importance of data privacy in the use of self-learning edge AI systems and data caching.
‘Trustworthy AI-Generative Content in Intelligent 6G Network: Adversarial, Privacy, and Fairness’ [66]	Safe, fair, and private AI	An operational framework is presented named TrustGAIN, which aims to protect against AI poising or prompt attacks, ensuring fair and unbiased output and maintaining user privacy with encryption. The authors also share how differential privacy can be used to limit privacy leaks but note that it cannot eliminate them. Homomorphic encryption on user datasets is also mentioned, adding identity protections and processing encrypted data without the need for decryption.
‘On Security Strategies for Addressing Potential Vulnerabilities in 6G Technologies Deployable in Healthcare’ [67]	Healthcare privacy	Reviews current and past privacy and security concerns in cellular networks, such as unauthorized access and data breaches. Proposes Zero-Trust Architectures (ZTA) with the use of AI to enforce strict privacy measures for medical data.
‘When large language model agents meet 6G networks: Perception, grounding, and alignment’ [68]	Large Language Models (LLM), Agentic AI, edge computing	The authors cover the expected aspects of agentic LLMs in 6G networks with a split approach for on-device capabilities and the use of edge computing. User privacy is discussed as a split approach with associated pros and cons: high anonymity when using on-device model inference with concerns arising from the reliance on edge computing for complex tasks. The authors note that privacy in edge computing poses a risk in the case of malicious edge nodes.
‘Explainable AI for 6G use cases: Technical aspects and research challenges’ [69]	Explainable AI (XAI) in 6G technology	This research covers an exhaustive list of XAI use cases in 6G technology, ranging from self-driving vehicles to medicine. Important privacy focuses include leveraging XAI to catch user privacy ‘leakages’, understand re-identification attacks on user datasets, and retain user expectations in terms of service capabilities and performance. It is prominent that XAI is still a bleeding-edge field with open research questions, notably, Can privacy threats be posed by the increased transparency of AI decision-making?

provides a select compilation of recent research publications related to 6G AI applications, with descriptions of each paper and their respective privacy focus areas.

• P1—Privacy attacks on AI models and private data
• P2—IoT (Internet of Things) edge network and edge AI privacy attacks
• P3—Privacy limitations in cloud computing and storage environments
• P4—Cost of privacy enhancements
• P5—Privacy differences based on location
• P6—Difficulty in defining levels and indicators for privacy
• N1—Difficulty determining the border between personal and non-personal data
• N2—Mixing personal data with non-personal data
• N3—Utility vs. privacy of anonymized data
• N4—Privacy attacks on anonymized and synthetic data
• N5—Data Localization Laws vs. free flow of data.

4.3. Trustworthiness in 6G Networks

As discussed previously, trust in the serving cellular network is a major factor that must be considered by consumers and operators alike. Trustworthiness in 6G technology ranges across many different topics regarding AI, along with user privacy and identity ramifications. The work carried out in [70] shares how trustworthiness is a multidisciplinary topic covering technology, regulation, techno-economics, politics, and ethics. Pertaining to privacy, the authors state that blockchain technologies can aid in 6G technologies while offering immutability, transparency, verifiability, anonymity, and pseudonyms in data sharing mechanisms, authentication, and network access control. FL is also noted as a privacy-focused method for training larger 6G ML models. Ethical aspects are also presented as a vital focus for a user’s trust in the network as 6G technology plans to bring more cyber–physical systems into the cellular ecosystem [71]. The ethics of data privacy is noted as an ever more important topic around the world, as standards creators and vendors must consider how data are processed and protected to uphold the rights of users. The authors raise open questions regarding automated or AI systems and where liability will be placed during malfunctions that could directly affect customers. Figure 5 outlines the core aspects of network trustworthiness in 6G technology, and the need for further privacy and identity protections.

Other aspects of 6G communications that add to the trustworthiness and performance of the network are discussed in [72]. The main topic included in this work is trustworthy Task-Oriented Semantic Communication (ToSC), which advocates for only sending pertinent information within the network. This technique potentially increases user identity protection and privacy and also increases the efficiency of the network if less information is being processed. In mMTC, this strategy could be incorporated to relieve stress on the interfaces between devices, freeing up resources while still maintaining privacy. Deep learning (DL) is discussed as the foundation of their approach to ToSC, extracting only the pertinent information in a query, and the inclusion of differential privacy to the communication contents. It is also mentioned that a balance between utility, efficiency, and privacy is important in 6G networks to maintain extremely high bandwidth and ultra-low latency. Sensors are another area where 6G network interfaces will be impacted by new types of data and strict performance requirements, especially within the context of self-driving vehicles, autonomous robotics, etc. The authors in [73] address how sensor data integration into 6G technology causes many more attack vectors, along with furthering privacy concerns. They bring forward the idea of adding a Sensing Policy, Consent, and Transparency Management (SPCTM) function. The SPCTM function would manage privacy policies, user consent, and transparency, ensuring compliance and awareness. An approach that adds a network function is usually an accepted method for additional functionality and extensibility, but it can also act as a double-edged sword by increasing the size of the attack surface. A survey on trust anchor technologies [74] addresses the importance of the terms and visions of trust as a resource in 6G systems alongside the usage of AI technologies and cooperation with third-party vendors. The concept of “trust anchors” as a foundational service in 6G networks has the following functional and architectural requirements, such as are brought forward to ensure a trustworthy network ecosystem:

• Non-Repudiation;
• Immutability;
• Transparency;
• Programmability;
• Modularity;
• Integration.

In the example of Core-to-Core communications in 6G networks, where multiple independent network providers require the establishment of a trusted platform, a third party needs to provide a trust anchor to all parties. In similar approaches where a network provider utilizes a third party for enhancements in a specific VNF, the network itself provides the trust foundation to all application providers and consumers. This creates a two-way agreement for unified trust management in 6G interfaces. The authors believe their work can be a starting point for creating Trusted Infrastructure architectures for trust anchors in 6G communications.

5. Conclusions

Fifth-Generation technology has enabled numerous new applications and advanced end user experiences. It also advanced use cases for consumers due to its new approaches in connectivity, scalability, and operability. Finally, 5G technology also provides the foundation upon which future generations of cellular networks will be built. With new opportunities, however, come new risks. User identity privacy in 5G and future 6G networks must be a core consideration for the operators of networks, standards organizations, and the research community. We have reviewed the most important aspects of user identity within 5G CNs, ranging from anonymous network technology, SBA, PII in 5G technology, and the impacts of newly adopted technology to privacy enhancement proposals and lawful interception, concluding in a roadmap for privacy in 6G networks. It was found that user identity and privacy are complex topics within 5G systems due to the newly adopted software-defined solutions that this technology deploys.

Privacy is also a topic that is not always well defined, which creates difficulties in creating models that can be standardized in complex systems. Furthermore, with its political implications and the wide variety of privacy laws around the world, it makes it more difficult for standards to be created that ensure that a user’s connections are private.

Trust in the system is inherently the most important factor for a user to consider while connecting to any 5G network, as the HN ultimately controls all of the encryption processes and thus the ability to gather data on users if protections are not in place. Truly anonymous communications within 5G applications could have real-world benefits for areas such as the healthcare sector, along with government and military operations.

Our final insights and key takeaways for further research in this realm are listed below:

• There exists a strong need to reduce the prevalence and reliance on personal identifiers such as the SUPI (Subscription Permanent Identifier) within 5G/6G Core operations to help better protect user identity. This has the potential to be achieved by replacing the widespread usage of the SUPI between VNFs with decentralized ephemeral identifiers, thereby maintaining 3GPP standard operations, billing and fraud prevention capabilities, and customer service expectations. This would add a layer of identity abstraction for the user on the network to better protect the SUPI and other identifiers from eavesdroppers and unauthorized behavioral tracking and metadata collection.
• Systems can also be designed to leverage the powerful nature of AI to bring enhanced services, experiences, and threat deterrence for users. User datasets must be de-identified to prevent privacy leaks. Continual training methods such as FL preserve user identity protections, as PII is not transmitted to central servers. Concerns may arise from metadata exposure, which may facilitate linkage attacks.
• The creation of a standardized trust architecture between users, providers, and third-party vendors would provide visibility and transparency to 5G/6G operations with regard to the data shared or collected by different network elements. Furthermore, adherence to a strict privacy-by-design rationale for newly developed specifications would help to alleviate issues resulting from untrusted third-party vendors or cloud providers.
• The incorporation of HSMs into 5G/6G infrastructure to enhance the physical-layer security of cryptographic secrets and to enable end-to-end encryption is a further recommendation for enhancing the privacy and data protection capabilities of these systems.

As efforts in 6G conceptualization and technology development continue, it is vital that user identity protections, such as limiting PII metadata within CNs, and privacy considerations are prioritized throughout these efforts in designing future mobile cellular protocols and architectures.