Toward Self-Sovereign Management of Subscriber Identities in 5G/6G Core Networks

Abstract

5G systems have delivered on their promise of seamless connectivity and efficiency improvements since their global rollout began in 2020. However, maintaining subscriber identity privacy on the network remains a critical challenge. The 3GPP specifications define numerous identifiers associated with the subscriber and their activity, all of which are critical to the operations of cellular networks. While the introduction of the Subscription Concealed Identifier (SUCI) protects users across the air interface, the 5G Core Network (CN) continues to operate largely on the basis of the Subscription Permanent Identifier (SUPI)—the 5G-equivalent to the IMSI from prior generations—for functions such as authentication, billing, session management, emergency services, and lawful interception. Furthermore, the SUPI relies solely on the transport layer’s encryption for protection from malicious observation and tracking of the SUPI across activities. The crucial role of the largely unprotected SUPI and other closely related identifiers creates a high-value target for insider threats, malware campaigns, and data exfiltration, effectively rendering the Mobile Network Operator (MNO) a single point of failure for identity privacy. In this paper, we analyze the architectural vulnerabilities of identity persistence within the CN, challenging the legacy “honest-but-curious” trust model. To quantify the extent of subscriber identities being utilized and exchange within various API calls in the CN, we conducted a study of the occurrence of SUPI as a parameter throughout the collection of 5G SBI (Service-Based Interface) Core VNF (Virtual Network Function) API (Application Programming Interface) schemas. Our extensive analysis of the 3GPP specifications for 3GPP Release 18 revealed a total of 4284 distinct parameter names being used across all API calls, with a total of 171,466 occurrences across the API schema. More importantly, it revealed a highly skewed distribution in which subscriber identity plays a pivotal role. Specifically, the “supi” parameter ranks 57th with 397 occurrences. We found that SUPI occurs both as a direct parameter (“supi”) and within 72 other parameter names that contain subscriber identifiers as defined in 3GPP TS 23.003. For these 73 parameter names, we identified a total of 8757 occurrences. At over 5.11% of all parameter occurrences, this constitutes a disproportionately large share of total references. We also detail scenarios where subscriber privacy can be compromised by internal actors and review future privacy-preserving frameworks that aim to decouple subscriber identity from network operations. By suggesting a shift towards a zero-trust model for CN architecture and providing subscribers with greater control over their identity management, this work also offers a potential roadmap for mitigating insider threats in current deployments and influencing specific standardization and regulatory requirements for future 6G and Beyond-6G networks.

1. Introduction

Privacy in the digital world can be challenging to achieve within systems, due to concerns stemming from data leaks, the rise of de-anonymization techniques, the growing complexity of interfaces between communication stacks, side-channel attacks, and numerous other factors. Thus, the comprehensive mitigation of privacy-threatening attacks needs to play an increasingly important role when planning such systems and technologies. During the design of complex technological architectures, trade-offs must be considered to maintain the project’s feasibility. However, not all devices or protocols within an ecosystem are created equal. For example, resource-constrained devices, legacy equipment, low-latency & high-reliability emergency operations, and low-power edge devices all require significant tradeoffs for their design and operation. Thus, the reality is that the same level of identity protection cannot be achieved across all systems that we utilize, or even across all aspects of a system. However, the core tenet should always be to prioritize the protection of user identities, both for current systems and for the design of future technologies.

From studying recent publications, we can observe an increasing focus on and discussion of privacy protections within 5G cellular networks, as well as their integration into planning and standardization efforts for 6G [1,2]. When releasing the 5G specification, the 3GPP (3rd Generation Partnership Project) introduced solutions to address some of the privacy concerns that existed for decades, around how 4G and prior generations utilized a subscriber’s permanent identifiers, such as IMSI (which in 5G is referred to as SUPI), being sent over-the-air without protection. With the introduction of the SUCI into 5G cellular networks, users’ identities are sent to their Home Network (HN) encrypted, thereby thwarting attackers’ ability to intercept them and track users on the network. Although the SUCI protects users from threats on the air interface, privacy mechanisms within 5G Core Networks lack the ability to preserve the full anonymity of users due to the SUPI being utilized in databases, billing operations, internal network communications, and other applications. Current 5G cellular networks lack the framework to maintain full subscriber identity privacy, as current standardization instills trust within all CN operations to safeguard sensitive information. However, this philosophy, in general, is made under the assumption that all CN operations can be fully trusted and secured. Even as telcos protect their systems with state-of-the-art mechanisms and equipment, this still leaves unresolved the feasibility of insider threats, malware campaigns, and social engineering tactics. Threat actors have demonstrated that this approach can be exploited to gain unauthorized access to subscribers’ metadata, enabling eavesdropping and extraction of location information, text messages, phone calls, network activity, and more.

Recent attacks on prominent US telecom companies, which included attackers obtaining information detrimental to prominent individuals, prove the need for further protections for subscribers’ identities within 5G CNs [3]. During the unauthorized exfiltration of subscriber metadata, attackers obtained information on prominent government officials and their proceedings, which led to the theft of classified information. Due to the lack of robust measures to protect subscribers’ permanent identities on the network, there are currently no mechanisms that allow a user to privately connect to a cellular network, given the inherent nature of the protocols and the use of permanent identifiers within them. Consequently, information can be gathered, such as location, behavioral tendencies, website visits, SMS text messages, phone calls, and more, and can be linked back to a specific user based on the permanent identifiers stored within the HN’s database and the subscriber’s SIM content [4]. For instance, if a user, Alice, connects to a 5G network using a mobile phone and visits different websites, makes calls, and sends text messages, then an HN operator has the ability to link this information directly to Alice’s device. The collection of this information is directly linked to Alice’s identity, posing a risk if the HN operator is not inherently trusted or if insider threats are present. If Alice is also part of a critical organization or government, this data collection and misuse could be especially detrimental if leaked or stolen, similar to the attacks that occurred in late 2024. The implementation of any privacy mechanism in 5G/6G CNs to prevent information from being directly tied back to Alice’s identity, however, must be carefully weighed against their potential impact on the standard specifications and several core services, such as lawful interception, security, billing, fraud detection, roaming support, and more. Figure 1 is a graphical representation showing how SUCI is used during initial connection to a 5G network, but then becomes decrypted into SUPI after the initial stages of authentication of the subscriber.

The remainder of this paper is as follows. Section 2 covers a background on 5G authentication, along with the different threat models necessary to understand the current landscape within 5G CNs. Section 3 presents a review of related works in current and proposed privacy protections in 5G and future 6G networks. Section 4 discusses relevant 3GPP standards and explains why further identity privacy measures are necessary for future cellular network implementations. Section 5 then quantifies the prevalence of the SUPI parameter within 3GPP API schema, further showcasing the widespread usage and dependence on permanent identifiers within 5G systems. Conclusions follow in Section 6, where future research areas are identified and discussed in light of the results presented in this work. The methodology in our work is analytical and exploratory, based upon 3GPP specifications and schema-level analysis, and any simulation or network testing is considered out of scope.

2. Background

To understand the necessity of decoupling subscriber identity from network operations, it is essential to review the current authentication standards, the prevailing trust models within the 3rd Generation Partnership Project (3GPP) specifications, and the specific vectors through which insider threats exploit these architectures.

2.1. Standard 5G Authentication and Data Exposure

The 5G system utilizes the 5G Authentication and Key Agreement (5G-AKA) or EAP-AKA protocols to mutually authenticate the User Equipment (UE) and the network. A significant enhancement in 5G, as noted in 3GPP Release 15, was the introduction of the Subscription Concealed Identifier (SUCI). The SUCI prevents 4G’s International Mobile Subscriber Identity (IMSI) catching attacks over the air interface by encrypting 5G’s Subscription Permanent Identifier (SUPI) using the Home Network’s public key before transmission [5]. However, the privacy protection offered by SUCI is terminated once the packet reaches the Authentication Server Function (AUSF) and the Unified Data Management (UDM) function within the Core Network (CN). Upon decryption, the SUPI is stored and processed in plaintext to facilitate essential network functions, including lawful interception, billing, and session management. Consequently, while the air interface is secured, the critical backend infrastructure maintains a centralized repository of user identities, namely the UDM, effectively creating a high-value target for adversaries once they penetrate the network perimeter [6]. Figure 2 provides a simplified view of a 5G CN, highlighting where SUCI is protected on the air interface versus where the decrypted SUPI is exposed across other VNFs.

2.2. Insider Threats and Architectural Vulnerabilities

Insider threats represent one of the most difficult challenges in cellular network security since they operate within the “trust boundary” of the Mobile Network Operator (MNO). Insider threats are generally categorized into two types: malicious insiders (disgruntled employees or spies) and unintentional insiders (staff whose credentials have been compromised via social engineering or malware) [7]. In the context of 5G Core Networks, the Service-Based Architecture (SBA) relies heavily on APIs for communication between network functions (NFs). If an attacker gains access to the Core Network through compromised credentials or supply chain vulnerabilities, they effectively possess the privileges of an insider. Research in [8] highlights that traditional perimeter defenses are insufficient against such threats because the internal traffic between the UDM, AUSF, and other NFs often lacks granular access controls or secondary identity verification layers. Furthermore, recent high-profile breaches in telecommunications have demonstrated that attackers specifically target Lawful Interception (LI) interfaces and Customer Relationship Management (CRM) databases. These systems require access to the unencrypted SUPI to function. Once an insider adversary creates a lateral movement path to these specific nodes, they can passively monitor subscriber metadata, location, and communications without triggering standard intrusion detection systems, as the queries appear to be legitimate administrative actions.

2.3. MNO Threat Modeling

For robust privacy-preserving 5G/6G architectures, it is necessary to formally define the adversary. The trust relationship between the subscriber and the MNO has evolved from implicit trust to a “zero-trust” necessity.

Table 1. Classification of MNO Threat Models in Cellular Networks.

Threat Model	Adversary Behavior & Privacy Implications
The Trusted Model	Assumes the Home Network (HN) is a benevolent custodian. Security focuses solely on attacks outside of the cellular infrastructure ecosystem. This model is considered obsolete due to the complexity of modern supply chains and the software-based nature of current 5G networks, which opens the door to third-party vendor or insider attacks [9].
Honest-but-Curious (HbC)	The MNO faithfully executes network protocols (no service disruption or packet dropping) but analyzes all accessible traffic to profile users. Privacy schemes like AAKA [10] generally target this adversary, who leverages user trust to passively mine behavioral data for advertising purposes [11].
Malicious-but-Cautious	An active adversary that may deviate from protocol (e.g., selling real-time location data, injecting headers) but only when the risk of detection is low. This model reflects an MNO balancing aggressive monetization against the risk of regulatory penalties or reputational damage [12,13].
Coerced Model	An MNO compelled by legal jurisdiction or Lawful Interception (LI) mandates to break user privacy, or an MNO that has been attacked and these interfaces seized by adversaries. This renders user identity privacy assumptions void, regardless of the MNO’s internal integrity [3].

categorizes the four distinct threat models defined in recent literature, ranging from legacy assumptions to state-level coercion.

The existence of the Coerced and Malicious-but-Cautious models necessitates architectures where the MNO is cryptographically blinded to the user’s true identity, as reliance on policy-based trust, such as in the HbC model, is insufficient for high-risk use cases such as healthcare, government & military operations, or critical infrastructure control. The most aggressive threat model should assume an adversary with privileged access to Core Network interfaces. This premise is validated by the 2024 Salt Typhoon intrusions [3], in which state-sponsored threat actors penetrated U.S. telecommunications infrastructure to access subscriber metadata. Consequently, our analysis accounts for adversaries with state-level capabilities, specifically the ability to maintain long-term persistence and intercept and analyze Service-Based Interface communications between Network Functions. In this case, we assume an adversary with insider-level visibility achieved via compromised credentials or a breached Network Function, capable of accessing SBI traces, logs, and state stores. This position allows the attacker to aggregate stable identifiers, such as the SUPI, with timestamps and service metadata across critical VNFs like the AMF, UDM, and SMF. By linking the SUPI obtained during initial authentication to subsequent policy and charging interactions, the adversary can construct a time-ordered profile. This effectively escalates the privacy risk from static device identification to the detailed inference of user activity patterns and service habits.

3. Related Works

3.1. Current 5G Subscriber Identity Protection Proposals

Current research supports a trend toward stronger identity privacy mechanisms within 5G and also for future 3GPP CNs, as shown in [14]. The author of this paper outlines and proposes new solutions for two major identity privacy concerns within 5G networks: defeating the sophisticated SUCI catchers [15] and addressing the “Bring Your Own Identity” issue for 5G. Reviews of previously stated works on SUCI catching within the authors’ research deem the suggested approaches thwarting SUCI-catching largely inadequate in practice due to either tackling only one variant (e.g., hidden HN public key, MAC-in-SUCI, & timestamps/replay lists [16]) or requiring disruptive changes (linking registration to authentication or authenticating base stations [17,18]), thus motivating research into a backward-compatible solution. The author proposes a new approach to addressing this issue, which involves utilizing a new ephemeral identity based on SUPI between the UE and the HN, referred to as “hSUPI” (a hashed SUPI). In this case, the SUPI is hashed prior to being encrypted by the UE to form the hSUPI, which replaces the direct use of the SUPI when forming the SUCI. The HN then includes the “next” hSUPI in the Authentication Token (AUTN) MAC, and after a valid RES* (extended user authentication response), both the UE and HN advance their stored hSUPI values, so that any captured SUCI becomes useless after at most the next one or two authentications. This approach is claimed to thwart SUCI-catching attacks where a rogue base station is able to infer the identity of an individual, thus protecting the subscriber’s identity privacy on initial attachments to the network. Following this proposal, the author also introduces a scheme that allows users to “bring their own identity” to a 5G network. In practice, this scheme introduces an external identity provider that works in conjunction with the CN to authenticate users to the network, enabling organizations to control subscriber access and identities. Although this scheme allows an external organization to control access to certain subscribers, it does not fully decouple the true identity of a subscriber connected to the network, as stated in the work, which notes that a subscriber’s identity can be read by the HN. Future work outlooks, such as “more radical proposals that eliminate the HN entirely to decouple the roles of account management and network operation,” also support this claim.

Similar proposals from 2024 for enhanced subscriber identity privacy are presented in [10] and revisited in [19], where the authors propose a model aimed at eliminating “cellular subscriber tracking” to prevent data linkage attacks from identifying subscriber behavior on the network. The authors introduce the “Anonymous Authentication and Key Agreement (AAKA)” protocol, which allows legitimate subscribers to connect to a 5G network without revealing their true identity. In theory, this approach fills a gap that currently exists in cellular networks: the ability for network operators to infer users’ behaviors and metadata across different network connections or sessions. One major assumption in their model is that this scheme only applies to HbC network operators. This HbC network operator model implies that the administrators of a network adhere to proper privacy rules regarding their customers’ data, yet may still inspect or analyze that data to the extent allowed by the rules and technical capabilities. This assumes that the network plans to follow all rules, such as not bypassing the scheme by adding silent back-doors into their AAKA protocol, which would ultimately render the scheme entirely ineffective. This also still leaves the possibility for an insider threat, whether that is authorized personnel acting in bad faith or an intruder to the network looking to nullify privacy schemes, as it does not fully decouple the subscriber’s privacy protections from the domain of the MNO. The authors in [20] discuss different subscriber identity attacks within both standalone (SA) and non-standalone (NSA) 5G network architectures. Their experiments are based upon three tenets, which shall be upheld with respect to the radio access link: UE Identity Privacy, UE Location Privacy, and UE Untraceability. The aforementioned tenets are to be upheld in the case of an active eavesdropper on the radio access link, whereas insider threats are not considered. Through their experiments, the researchers found two new privacy vulnerabilities. The first is a GUTI Reallocation Command attack, which exploits the lack of integrity protection and ciphering during the transmission of the Configuration Update Command, potentially leading to Denial of Service (DoS) or location tracking. The second is a Security Capabilities Bidding-Down attack, which exploits the omission of the Message Authentication Code (MAC) in the NAS Security Mode Command, enabling adversaries to downgrade the security protocols used by the device. Crucially, these exploits operate under the assumption of an external adversary acting as a Man-in-the-Middle or eavesdropper on the air interface, rather than a compromised element within the Core Network. Consequently, the vulnerabilities highlight risks arising specifically from the lack of integrity and confidentiality protections on the radio link, allowing unauthorized third parties to manipulate signaling traffic without requiring insider access.

3.2. Self-Sovereign Identity Proposals for 6G

Research in [21] discusses the need for decentralized subscriber identities due to the proposed nature of cross-domain interoperability in 6G networks. The authors propose decentralized identifiers and self-sovereign identity as the basis for identity management in 6G, which transforms subscribers’ personal data into verifiable credentials under the customer’s control. Decentralized Identifiers (DID) are stated to enable a more homogeneous network landscape, as the subscriber identity is no longer controlled by a single PLMN inside the UDM. However, even though the proposed distributed ledger shared between MNOs does not share personal data of the subscriber, the authors do mention that the home network is responsible for issuing the necessary verifiable credentials used in creating the SSI. This implies that the HN still has the ability, in some scenarios, to know the identity of an individual connected to the network. On the contrary, the authors do mention that identity and behavior tracking are greatly or totally diminished in roaming and edge access scenarios due to the nature of the SSI architecture, and no longer needing to signal to the HN in these cases. In a supplementary technical analysis written by the same authors [22], they explicitly define the MNO’s responsibility as the ’issuer’ of identity within the trust layer, which confirms the link in their previous work stating that a subscriber’s identity remains tethered to the HN even when verifications are decentralized. This is built on the foundation of the commonly used “Know-Your-Customer” (KYC) principles. 6G privacy schemes in [23] follow a similar path: to separate the digital identity from MNOs and place the management of identity into the subscribers’ hands. This is achieved through a blockchain and zero-knowledge proofs, assuming that the necessary identity infrastructure elements are HbC. The authors state that the use of zero-knowledge proofs drastically reduces the chances that an MNO could track user behaviors and metadata on a network, thereby supporting their claims of unlinkability. The authors in [24] present a unified self-sovereign identifier (U-SSI) architecture that stresses how the U-SSI is not owned by any one organization, similar to the SUPI in 5G. This, like similar architectures, enables the sharing of a user’s identity between cellular operators. The authors do not mention the strategy or protocols behind the onboarding of a customer, or whether the network operator has a mapping between the U-SSI and true PII. Figure 3 illustrates the comparison between the current 5G architecture, in which the SUPI is managed by the subscriber’s MNO, with the proposed method that decouples subscriber identity via a blockchain and zero-knowledge proofs in 6G.

In summary, existing research mitigates identity exposure mainly by improving air-interface concealment or using decentralized credentials to decouple identity management from the MNO.

Table 2. Summary of related works on subscriber identity privacy in 5G and 6G networks.

Paper	Ref.	Research Findings	Proposed Approach
Parkin (2024)	[14]	Existing SUCI-catching defenses are inadequate. Each addresses only one attack variant or requires disruptive changes	RAN-focused. hSUPI (hashed SUPI) for forward-unlinkable SUCI. “Bring Your Own Identity” scheme with external identity provider.
Yu et al. (2024)	[10]	Cellular networks lack mechanisms to prevent subscriber behavior linkage across sessions	AAKA protocol enabling anonymous authentication without revealing true identity. Assumes HbC operator. Focused on authentication flow.
Zhao et al. (2025)	[19]	Revisits cellular subscriber tracking and data linkage attacks	Extends AAKA analysis. Does not fully decouple privacy protections from MNO domain.
Eleftherakis et al. (2024)	[20]	Two new vulnerabilities: GUTI Reallocation Command attack and Security Capabilities Bidding-Down attack in SA/NSA 5G	N/A (experimental analysis of air-interface vulnerabilities. Insider threats not considered.)
Garzón Bolívar et al. (2022)	[21,22]	PLMN-centric identity management limits cross-domain interoperability. HN retains identity mapping as credential issuer	Decentralized Identifiers (DID) and Self-Sovereign Identity (SSI) for 6G. Reduces tracking in roaming and edge scenarios.
Zhang et al. (2025)	[23]	MNOs can track user behaviors and metadata through centralized identity management	Blockchain with zero-knowledge proofs to separate digital identity from MNOs. Assumes HbC infrastructure. Insider threats not considered.
Li et al. (2025)	[24]	Subscriber identity should not be owned by any single organization	Unified Self-Sovereign Identifier (U-SSI) shared across operators. Onboarding and PII mapping not addressed
This work		SUPI-related identifiers are central to SBI Core NF APIs (5.11% of occurrences). Insider/state-level threats exploit persistent identifiers within the CN	Scoped across all 5G CN activities and identity exposure problem. Characterizes SBI identifier propagation. Advocates Zero-Trust CN architecture and subscriber-controlled identity management

outlines the research findings and proposed approaches in the related works previously covered. However, most approaches assume an “honest-but-curious” operator and still rely on residual identifier mappings within the core. Prior work also does not explicitly characterize how persistent identifiers propagate across Service-Based Interface interactions, leaving gaps under the insider and coerced threat models considered here.

4. The Need for Subscriber Identity Privacy in 5G/6G Core Networks

Current methods for subscriber identity within 5G CNs focus on protecting the SUPI over the air interface with the introduction of the SUCI. The SUCI conceals the subscriber identity via encryption and is designed for only the CN to be able to decrypt the SUCI to obtain the SUPI. This protects the user from passive air-interface eavesdroppers, as seen in previous generations of cellular networks, via IMSI catchers [25]. Although the SUCI protects the user over the air interface from profiling or linkage attacks, it immediately becomes decrypted once the concealed identifier enters the CN during 5G-AKA. Clear-text storage and mapping of the SUPI to subsequent identifiers, as studied in our previous work [26], open the door to possible attacks such as metadata exfiltration, where attackers can link network activities to specific users, potentially revealing high-profile individuals. In this section, we will detail the processes within the CN that link SUPI to residual encryption keys and identifiers, such as $K_{AMF}$ and GUTI, describing the vectors in which attackers could exploit in order to track subscriber behaviors on the network.

Table 3. 5G Key Derivations (3GPP access) and KDF Signatures.

Derived Key	Input KEY to KDF	FC	${\mathit{P}}_0$	${\mathit{L}}_0$	${\mathit{P}}_1$	${\mathit{L}}_1$	Signature
$K_{\mathrm{AUSF}}$	$CK\Vert IK$	0x6A	SNN (serving network name)	len(SNN)	SQN ⊕ AK	len(SQN ⊕ AK)	$\mathrm{KDF}(CK\Vert IK,S)$
$K_{\mathrm{SEAF}}$	$K_{\mathrm{AUSF}}$	0x6C	SNN	len(SNN)	–	–	$\mathrm{KDF}(K_{\mathrm{AUSF}},S)$
$K_{\mathrm{AMF}}$	$K_{\mathrm{SEAF}}$	0x6D	SUPI	len(SUPI)	ABBA	len(ABBA)	$\mathrm{KDF}(K_{\mathrm{SEAF}},S)$
$K_{\mathrm{NASenc}}$	$K_{\mathrm{AMF}}$	0x69	type=0x01 (NAS-enc)	len(0x01)	NAS alg id (1 octet)	0x0001	$\mathrm{KDF}(K_{\mathrm{AMF}},S)$
$K_{\mathrm{NASint}}$	$K_{\mathrm{AMF}}$	0x69	type=0x02 (NAS-int)	0x0001	NAS alg id (1 octet)	0x0001	$\mathrm{KDF}(K_{\mathrm{AMF}},S)$
$K_{\mathrm{gNB}}$ (initial)	$K_{\mathrm{AMF}}$	0x6E	UL NAS COUNT (4 octets)	0x0004	Access type: 0x01 (3GPP) / 0x02 (non-3GPP)	0x0001	$\mathrm{KDF}(K_{\mathrm{AMF}},S)$
NH (Next Hop)	$K_{\mathrm{AMF}}$	0x6F	SYNC-input (new $K_{\mathrm{gNB}}$ or previous NH)	0x0020	–	–	$\mathrm{KDF}(K_{\mathrm{AMF}},S)$
$K_{\mathrm{NG}-\mathrm{RAN}}$	$K_{\mathrm{gNB}}$ or NH	0x70	Target PCI	0x0002	Target ARFCN-DL	len(ARFCN-DL)	$\mathrm{KDF}(\mathrm{KEY},S)$
$K_{\mathrm{RRCenc}}$	$K_{\mathrm{gNB}}$ or $K_{\mathrm{NG}-\mathrm{RAN}}$	0x69	type=0x03 (RRC-enc)	0x0001	AS alg id (1 octet)	0x0001	$\mathrm{KDF}(\mathrm{KEY},S)$
$K_{\mathrm{RRCint}}$	$K_{\mathrm{gNB}}$ or $K_{\mathrm{NG}-\mathrm{RAN}}$	0x69	type=0x04 (RRC-int)	0x0001	AS alg id (1 octet)	0x0001	$\mathrm{KDF}(\mathrm{KEY},S)$
$K_{\mathrm{UPenc}}$	$K_{\mathrm{gNB}}$ or $K_{\mathrm{NG}-\mathrm{RAN}}$	0x69	type=0x05 (UP-enc)	0x0001	AS alg id (1 octet)	0x0001	$\mathrm{KDF}(\mathrm{KEY},S)$
$K_{\mathrm{UPint}}$	$K_{\mathrm{gNB}}$ or $K_{\mathrm{NG}-\mathrm{RAN}}$	0x69	type=0x06 (UP-int)	0x0001	AS alg id (1 octet)	0x0001	$\mathrm{KDF}(\mathrm{KEY},S)$

All KDFs are HMAC-SHA-256 with S = FC ‖ P₀ ‖ L₀ ‖ P₁ ‖ L₁ (omit P₁, L₁ if “–”).

outlines the cryptographic “chain-of-custody” used within 5G CNs during a UE’s attachment to the network as defined in 3GPP standards [5]. The keys listed in the table follow a chronological order, from $K_{AUSF}$ used as the initial anchor in the CN to $K_{gNB}$ and beyond for the encryption of air interface traffic. Of particular significance to subscriber identity privacy is the derivation of $K_{AMF}$. As shown in the 3rd row of Table 3, the generation of this key explicitly requires the clear-text SUPI as an input to the key-derivation function (KDF). This confirms the usage of SUPI to link subscriber actions on the network in the current architecture of 5G systems. Since $K_{AMF}$ serves as an anchor for subsequent derivations, a cryptographic lineage is established that permanently binds session keys to the subscriber’s permanent identity. Thus, any exfiltration of stored environment operations in the generation of $K_{AMF}$ could allow an attacker to de-anonymize subscriber traffic on the network, rendering the encryption pointless.

Algorithm 1, shown below, illustrates in greater detail how the SUPI is used in the generation of $K_{AMF}$ and its inclusion within the UE’s security context (ctx) within the CN, as defined in [5]. In phase one, $K_{AMF}$ is generated within the AMF via the inputs $K_{SEAF}$ and S into the KDF. S is a string that contains the SUPI, thereby anchoring all services in the current connection to that specific user. Phase two initializes the security context data structure that is necessary to hold cryptographic keys and state information for each user connected to the network. Finally, in phase three, keys are generated for communication with the gNB using the $K_{AMF}$ as an input to the KDF. A corresponding key derivation process also takes place on the UE side to maintain cryptographic continuity, ensuring both endpoints have identical keys, while the context structure itself remains internal to the AMF.

Algorithm 1 Derivation of $K_{\mathrm{AMF}}$ and Network Context Setup

Input:   $K_{\mathrm{SEAF}}$: Anchor key received from AUSF (via Nausf_UEAuthentication)

Input: $SUPI$: Subscription Permanent Identifier

Input: $ABBA$: Anti-Bidding Down Between Architectures parameter

Output: $ctx$: Initialized AMF Security Context with NAS keys

1: Phase 1: Derivation of Serving AMF Key   2: ▹Construct input string S (per TS 33.501, Annex A.7)   3:        $FC\leftarrow 0\mathrm{x}6\mathrm{D}▹\mathrm{Function}\mathrm{Code}\mathrm{for}{K}_{\mathrm{AMF}}$   4:        $S\leftarrow FC\parallel SUPI\parallel$ Len$\left(SUPI\right)\parallel ABBA\parallel$ Len$\left(ABBA\right)$   5: ▹Derive $K_{\mathrm{AMF}}$ using KDF (HMAC-SHA-256)   6:        $K_{\mathrm{AMF}}\leftarrow \mathrm{KDF}(K_{\mathrm{SEAF}},S)$   7: ▹Allocate new Key Set Identifier (ngKSI)   8:        $ngKSI\leftarrow$ AllocateNewNgKSI()   9: Phase 2: Context Initialization 10: ▹Retrieve or create Security Context structure 11:        ctx ← GetOrCreateContext(SUPI) 12: ▹Update context state (SEAF retains $K_{\mathrm{SEAF}}$ for re-auth) 13:        $ctx.ngKSI\leftarrow ngKSI$ 14:        $ctx.K_{\mathrm{AMF}}\leftarrow K_{\mathrm{AMF}}$ 15:        $ctx.\mathrm{Type}\leftarrow \mathrm{NATIVE}\_5G$ 16:        $ctx.\mathrm{State}\leftarrow \mathrm{PARTIAL}▹\mathrm{Keys}\mathrm{derived},\mathrm{not}\mathrm{yet}\mathrm{activated}$ 17: Phase 3: NAS Key Derivation and Activation 18: ▹Derive NAS Integrity and Encryption keys 19:        $ctx.K_{\mathrm{NASint}}\leftarrow$ DeriveNasIntegrity $(K_{\mathrm{AMF}},{\mathrm{Alg}}_{\mathrm{INT}})$ 20:        $ctx.K_{\mathrm{NASenc}}\leftarrow$ DeriveNasCipher $(K_{\mathrm{AMF}},{\mathrm{Alg}}_{\mathrm{ENC}})$ 21: ▹Initiate Security Mode Control (SMC) to activate keys 22:        SendNasSecurityModeCommand $\left(ctx\right)$ 23: return  $ctx$

Algorithm 2, shown below, details the process defined by 3GPP for the creation of 5G-GUTI [5,27]. The GUTI is utilized as a temporary identifier for communications between the UE and the CN. The National Institute of Standards and Technology (NIST) details how the use of GUTI helps protect a subscriber’s identity privacy when an attacker is present between the UE and the CN [28]. However, the GUTI remains tied to the SUPI within the UE security context, thus allowing the CN to complete normal functions such as billing.

The creation and binding of the GUTI begins with a UE signaling its intention to connect to the network. In the case that a GUTI has not been assigned, SUPI is resolved from SUCI during the 5G-AKA process. Phase two of Algorithm 2 is then used to determine if a new GUTI is required. This process is known as GUTI Reallocation, which NIST emphasizes MNOs to practice frequently in order to make it more difficult for potential attackers between the UE and CN to track an individual. If a GUTI needs to be reallocated, a new identifier is created by concatenating specific identifiers within the UE’s security context. Consequently, in the final step of Phase 3, the UDM network function is notified of the AMF serving the UE by receiving the SUPI and GUAMI (Global Unique AMF Identifier). The process of GUTI creation or reallocation is completed in Phase 4, where the new identifier is securely sent to the UE and acknowledged.

Algorithm 2 5G-GUTI Allocation and Context Storage at AMF

Input: $ctx$ (UE context containing SUPI, PLMN, AMF ID)

Input: $regType$ (Registration Type: Initial, Mobility, or Periodic)

Input: $oldGUTI$ (Provided by UE in Registration Request)

Output: Updated UE Context and potentially a new 5G-GUTI sent to UE

1: Phase 1: Context Resolution and Signalling   2: ▹UE initiates registration via N1 NAS signalling   3:        $ms{g}_{req}\leftarrow$RegistrationRequest$(\mathrm{ID}=\mathrm{SUCI}\mathrm{or}oldGUTI,regType)$   4:        ReceiveFromUE$\left(ms{g}_{req}\right)$   5: ▹Resolve UE context based on provided identity   6: if $oldGUTI$ is present then   7:    if ServingAmfChanged$\left(oldGUTI\right)$ then   8:        ▹ Retrieve context from previous AMF via Namf interface   9:                 $ct{x}_{old}\leftarrow$ ContextTransfer(oldGUTI) 10:                 $ctx\leftarrow$ Import(ctx, ctxold) 11:    end if 12: else 13:    ▹ Perform 5G-AKA authentication to resolve SUPI from SUCI 14:           $ctx.\mathrm{SUPI}\leftarrow$ ResolveSupiViaAuth() 15: end if 16: Phase 2: Allocation Decision 17: ▹Determine if a new 5G-GUTI is required (Privacy/Policy) 18:        $reallocate\leftarrow (regType=\mathrm{INITIAL})\vee (regType=\mathrm{MOBILITY})$ 19:        $reallocate\leftarrow reallocate\vee$ CheckPeriodicPolicy(ctx) 20: Phase 3: Construction and Storage 21: if $reallocate$ then 22:    ▹ Construct globally unique identifier (GUAMI) 23:            $guami\leftarrow$ BuildGUAMI(ctx.PLMN, ctx.AMF_ID) 24:    ▹ Generate temporary identifier (TMSI) 25:            $tmsi\leftarrow$ Random32() 26:    ▹ Concatenate and store 5G-GUTI in context 27:            $gut{i}_{new}\leftarrow$ Concat$(guami,tmsi)$ 28:            $ctx.\mathrm{GUTI}\leftarrow gut{i}_{new}$ 29:    ▹ Update AMF Context Database (Key mapping) 30:            ${\mathrm{DB}}_{\mathrm{UE}}\left[gut{i}_{new}\right]\leftarrow ctx$ 31:            ${\mathrm{DB}}_{\mathrm{UE}}[ctx.\mathrm{SUPI}]\leftarrow ctx$ 32:    ▹ Update UDM serving node registration 33:            Nudm$\_\mathrm{UECM}\_$Registration(ctx.SUPI, guami) 34: end if 35: Phase 4: Transmission and Acknowledgment 36: ▹Prepare and send acceptance message 37:        $ms{g}_{acc}\leftarrow$ RegistrationAccept() 38: if  $reallocate$  then 39:           $ms{g}_{acc}.5\mathrm{G}-\mathrm{GUTI}\leftarrow gut{i}_{new}$ 40: end if 41:        SendToUE$\left(ms{g}_{acc}\right)$ 42: ▹Wait for UE acknowledgment (Required for new GUTI) 43:        $ms{g}_{comp}\leftarrow$ WaitFor(RegistrationComplete) 44:        ProcessAck$\left(ms{g}_{comp}\right)$

5. Analysis of 5G VNF API Parameter Prevalence and Risks

With the previous section detailing how the SUPI is handled within 5G CNs during subscriber authentication, and the linkage between it and the temporary identifier GUTI, it is also important to cover the widespread use and pervasiveness of SUPI in 5G NF API calls. Contrary to the creation of GUTI, which mainly occurs within the AMF, there are multiple instances in which the subscriber’s permanent identity is exchanged among multiple NFs [5]. 5G NFs are networks of services that complete specific functions such as billing, authentication, location awareness, SMS messaging, etc. NFs open the door to a more extensible and accessible 5G network architecture, such as using third-party cloud providers to host servers on which these NFs run. This brings with it the need for serious consideration of how best to protect subscriber identity privacy within the NFs and in their communications with each other. In this section, we present a study examining the frequency with which the SUPI is included in 3GPP NF API schemas. We then discuss the significance of this prevalence for the design and behavior of 3GPP network functions, and how the current architecture leaves the door open to malicious privacy attacks. Figure 4 outlines the high-level methodology for determining the statistical data outlined in this section, which will be discussed in more detail further below.

Our study aims to identify the magnitude of SUPI occurrences across the vast array of API calls between 5G SBI Core NFs. Our initial hypothesis is that the SUPI is used throughout these API calls, due to its foundational nature in linking actions such as authentication, session management, and billing. The API schema dataset used for this study is a part of the collection of all 3GPP Release 18 schema standards, compiled in an exhaustive GitHub repository [29]. Within this corpus of standards, we restrict our analysis to Service-Based Interface (SBI) Core Network Function APIs, specifically those OpenAPI files corresponding to the 14 NFs that expose SBIs as defined in 3GPP TS 23.501 §4.2.6 [27]: AMF, SMF, NEF, PCF, UDM, NRF, NSSAAF, NSSF, AUSF, UDR, UDSF, NWDAF, CHF, and UCMF. We explicitly exclude Application Function (AF) APIs as AF is external to the 5G Core. We treat all remaining interfaces as application or exposure functions, which are considered out of scope for this study [30]. To categorize and capture all parameter data within each schema standard, the standards are first dereferenced to resolve all local and external $ref pointer references, then processed through a parser that groups all possible parameters included in the URI or JSON body payload. A few examples of this are shown in

Table 4. 5G Core Network Interfaces: Examples of SUPI usage within Network Calls between VNFs.

Interaction & Standard	Resource URI	Identity Inclusion (Schema)
Authentication (AUSF → UDM) TS 29.503 [31]	…/nudm-ueau/v1/{supi}/security-information/generate-auth-data	URI Path Parameter
Registration (AMF → UDM) TS 29.503 [31]	…/nudm-uecm/v1/{supi}/registrations/amf-3gpp-access	URI Path Parameter
Session Creation (AMF → SMF) TS 29.502 [32]	…/nsmf-pdusession/v1/sm-contexts	JSON Body: { “supi”: “imsi-001…”, … }
Policy Control (SMF → PCF) TS 29.512 [33]	…/npcf-smpolicycontrol/v1/sm-policies	JSON Body: { “supi”: “imsi-001…”, … }
Charging & Billing (SMF → CHF) TS 32.291 [34]	…/nchf-convergedcharging/v3/chargingdata	JSON Body: { “subscriberIdentifier”: “imsi-001…”, … }

with focus on the “supi” and “subscriberIdentifier” parameters. These are the parameter names used in the API documentation of the 3GPP standards releases. Though they have different names, they refer to the same SUPI parameter. Across the API specifications, SUPI and its related identifiers appear in various locations as path parameters in the URI, as query parameters, within request body payloads, and in response schemas. This distribution across multiple locations within each API call required comprehensive extraction and aggregation for this study.

Once all SBI Core NF standards were parsed, they were then aggregated and counted across all files. For further clarity of the prevalence of SUPI-related parameters in API calls, we classify parameters according to 3GPP TS 23.003 [35], which defines the subscriber identifiers that may contain or represent the SUPI: SUPI, IMSI (International Mobile Subscriber Identity), NSI (Network Specific Identifier), GLI (Global Line Identifier), and GCI (Global Cable Identifier). Word-boundary matching is applied to minimize false positives (e.g., avoiding matching “transition” when searching for “NSI”). This approach captures parameters that do not explicitly state “SUPI” by name but reference subscriber identifiers defined in the 3GPP specification, such as parameters whose descriptions mention: “Contains the UE id (i.e., SUCI or SUPI) and the Serving Network Name.”

In order to formally present the distinction between the different sets considered in this experiment, let $\mathcal{P}$ represent the set of all distinct SBI Core NF API parameters located across the 3GPP OpenAPI standards, and let $f\left(p\right)$ denote the frequency of occurrence for any parameter $p\in \mathcal{P}$. Thus, the total parameter usage, $N_{total}$, is detailed as such:

$$\left|\mathcal{P}\right|=4284\mathrm{and}{N}_{total}=\sum _{p\in \mathcal{P}}f\left(p\right)=171,466$$

(1)

To quantify the prevalence of SUPI-related identifiers within API calls, we define a subset ${\mathcal{P}}_{sid}\subset \mathcal{P}$, which consists of API parameters that contain SUPI-related identifiers as defined in 3GPP TS 23.003 [35]. Let $I=\{\mathrm{SUPI},\mathrm{IMSI},\mathrm{NSI},\mathrm{GLI},\mathrm{GCI}\}$ represent the set of subscriber identifiers, and let $N\left(p\right)$ and $D\left(p\right)$ denote the parameter name and description respectively:

$${\mathcal{P}}_{sid}=\{p\in \mathcal{P}\mid \exists i\in I:i\in N\left(p\right)\vee i\in D\left(p\right)\}$$

(2)

Thus, the cumulative prevalence of the SUPI-related subset is calculated as:

$$|{\mathcal{P}}_{sid}|=73\mathrm{and}\sum _{p\in {\mathcal{P}}_{sid}}f\left(p\right)=8757$$

(3)

This represents 1.70% of distinct parameters and 5.11% of total parameter occurrences. For the target API parameter “supi”, we see a significant number of occurrences:

$$f\left(p_{supi}\right)=397\mathrm{with}\mathrm{rank}\left(p_{supi}\right)=57$$

(4)

Under this methodology, the aggregation of all SBI Core NF OpenAPI files for 3GPP Release 18 is described as a universal set of parameters $\mathcal{P}$, which yields a total of 4284 distinct parameters, denoted as $\beta$, with 171,466 occurrences across all SBI Core NF OpenAPI files, denoted as $\psi$. The “supi” API parameter name shown in Equation (4) comes in at rank 57, with 397 total occurrences, which can be denoted as $ϵ$. The parameters in the subset ${\mathcal{P}}_{sid}$ that contain SUPI-related identifiers per TS 23.003 total 73, with 8757 total occurrences across all files, where the total parameters with this distinction can be denoted as $\kappa$, and the sum of all occurrences can be denoted as $\gamma$.

To further understand the prevalence of the “supi” API parameter name and the distribution by rank of the other parameters, Figure 5 details this stark distinction. It can be observed that the 3GPP OpenAPI SBI Core NF standards use a small set of parameters frequently, while the majority are used much less frequently. This distribution fits a Power Law that drastically decays with a “heavy” long tail beginning around parameters ranked in the 400–500 range. This provides further evidence that the SUPI, in its various parameter naming variations, is a significant factor in 5G NF API communications.

The general definition of the Power Law function describing the relationship between frequency (or prevalence) $f\left(x\right)$ and rank x is given by:

$$f\left(x\right)=C{x}^{-\alpha }$$

(5)

where $\alpha$ is the scaling exponent, or more generally the slope. C is described as a normalization constant. In the analysis of Zipfian distributions and scale-free networks [36], the constant C can be omitted, allowing for a strict focus on the intrinsic behavior of the system at hand. With this being said, the relationship can be expressed as proportionality:

$$f\left(x\right)\propto x^{-\alpha }$$

(6)

Generally, the exponent $\alpha$ characterizes the fundamental topology of the network, independent of its scale, whereas C is merely a normalization constant contingent on dataset-specific attributes [37]. In comparative network analyses, such as this study, the proportionality definition of the Power Law function where C is dropped is favored to emphasize the scale-free property [38]. In the case of Figure 5, the Power Law curve is fit by way of a linear least-squares regression on the log-transformed rank frequency data. This, in turn, estimates the exponent $\alpha \approx 1.39$, with a coefficient of determination $R^2=0.936$, indicating a fit to the Power Law distribution. Comparison with lognormal distributions per Clauset et al. [39] shows marginal difference ($p=0.02$), with both reflecting equivalent heavy-tailed behavior. Figure 6 shows the same Power Law distribution, but this time on a log-log scale and with the subset ${\mathcal{P}}_{sid}$ highlighted in blue.

Figure 6 shows more explicitly the widespread prevalence of parameters within ${\mathcal{P}}_{sid}$ alongside non-SUPI-related parameters. Whereas the non-SUPI-related parameters seem to span the entire distribution, and clustering near the heavy tail, the ${\mathcal{P}}_{sid}$ set of parameters seems to be situated near the middle/top left of the distribution. This illustration underscores the widespread use of SUPI-related parameters across 5G NF communications.

Due to the nature of the heavy-tailed distribution of the rank of parameter prevalence, Figure 7 uses a comparative boxen plot. The two sets of SUPI-related and non-SUPI-related parameters are grouped side by side. The blue boxes highlight a higher median prevalence for parameters that contain SUPI-related identifiers, whereas the gray plot details any non-SUPI-related parameters, which are dominated by lesser-used parameters. Visually, the median of the ${\mathcal{P}}_{sid}$ plot is nearly one order of magnitude larger than the non-SUPI-related parameters. This difference is supported by a Mann-Whitney U test, where $p<0.001$, indicating strong evidence that the two sets do not share the same underlying distribution. These results indicate that parameters containing SUPI-related identifiers are not isolated outliers but are strongly associated with operational importance and are prevalent in 5G NF API communications.

6. Conclusions

Subscriber identity privacy within 5G networks is based upon the assumption that the MNO adheres to all regulations and maintains a strict security posture. Recent attacks on US telecom infrastructure, where prominent subscriber metadata and behavioral information were leaked, demonstrate that this approach is not fully hardened and remains vulnerable to large-scale compromise. Our study of the 3GPP VNF schema standards strengthens this claim by clearly and unequivocally demonstrating that subscribers’ permanent identifiers and closely related identifiers play a significant role in internal network control traffic.

Our results are derived from standards/schema analysis and have not yet been validated through testbed or deployment measurements, so schema prevalence may not reflect one-to-one runtime exposure across specific vendor cores and configurations. Extending the analysis to Application Functions and external exposure interfaces would introduce diverse application-layer identifiers and contextual metadata. This broadened scope may compound identity-linkage risks by revealing cross-layer dependencies or shift the primary vulnerability from exposing device identifiers to revealing specific usage habits. Future work will focus on validating with system-level data and prototyping identity decoupling mechanisms such as ephemeral identifiers or SSI to quantify security and performance trade-offs within 5G networks. Future standardization efforts offer two distinct architectural pathways to minimize SUPI exposure in 5G/6G CNs. The first adopts a zero-trust paradigm in which the HN validates a ’valid active user’ via SSI or zero-knowledge proofs, effectively decoupling network connectivity from identity resolution. The second option retains the standard SUPI resolution at the UDM but enforces strict internal pseudonymization, where the UDM creates short-lived, ephemeral identifiers for all downstream SBI workflows, confining plaintext SUPI storage to a secure, hardened enclave. While the former maximizes privacy against coercive threats, the latter offers a backward-compatible migration path to mitigate insider lateral movement.

Thus, we conclude that further research into pseudonymization, masking, SSI, or the integration of ephemeral identifiers for subscribers to these networks is urgently needed to advance this solution to the identity threat in 5G Core networks. Methods that decouple a subscriber’s permanent identity from the MNO, and move away from a central point of identity privacy failure, reduce the attack surface that attackers can exploit to track subscribers. Protecting a subscriber’s permanent identity on a public network requires either a fully trusted entity within the network or mechanisms that reduce the required trust, such as zero-knowledge proofs. In a sense, there must be a mechanism that instills a root of trust that every user can confidently rely on to mask and protect their identity on the network. In addition to technical advances, any applicable models must remain compliant with current legal and regulatory requirements, unless and until those frameworks are revised.