5GS UE and Network Identities: SUPI, SUCI, 5G-GUTI, GUAMI, PEI, GPSI, and More
5G uses several different identities for different purposes: permanent subscriber identity, concealed subscriber identity, temporary registration identity, AMF identity, equipment identity, and public-facing service identity. Understanding how they relate is essential for reading traces, debugging registration issues, and designing signaling flows.
This page explains the main 5GS identities, how they are built, where they are used, and how they relate to one another. The goal is simple: for each identity, answer what it is, who assigns it, where it is used, and how it is structured.
Quick Facts
| Technology | 5G |
|---|---|
| Area / Protocol | 5GS UE and network identities in NAS and core procedures |
| Main reader goal | Understand what each identity is, who assigns it, where it is used, and how it is structured |
| Permanent identities | SUPI, PEI, GPSI |
| Concealed or temporary identities | SUCI, 5G-GUTI, 5G-S-TMSI, 5G-TMSI |
| Related procedures | Initial Registration, Paging, Service Request, Emergency Registration, Authentication and NAS Security |
On This Page
Identity Map Overview
Permanent subscriber identity
- SUPI: Subscription Permanent Identifier
Concealed subscriber identity
- SUCI: Subscription Concealed Identifier
Temporary registration identity
- 5G-GUTI: 5G Globally Unique Temporary UE Identity
- 5G-S-TMSI: 5G Shortened Temporary Mobile Subscriber Identity
- 5G-TMSI: 5G Temporary Mobile Subscriber Identity
Network-side identity
- GUAMI: Globally Unique AMF Identifier
- AMF Identifier: Access and Mobility Management Function Identifier
Equipment identity
- PEI: Permanent Equipment Identifier
- IMEI: International Mobile Equipment Identity
- IMEISV: International Mobile Equipment Identity and Software Version
Public-facing subscription identity
- GPSI: Generic Public Subscription Identifier
- MSISDN: Mobile Station International Subscriber Directory Number
- External Identifier: public service-facing identity mapped to the subscription
SUPI
SUPI is the permanent subscription identity in 5GS. It is the root subscriber identity that the network ultimately needs to understand, even when the UE uses a concealed or temporary form during signaling.
What SUPI is
The permanent subscription identity used as the root identity in 5GS.
Common forms
IMSI-based SUPI and NAI-based SUPI.
Who assigns it
The home network subscription domain.
Where it matters
Registration, identity handling, subscription lookup, and security context derivation.
IMSI-based SUPI
imsi-001010123456789NAI-based SUPI
nai-user123@operator.example SUCI
SUCI is the privacy-preserving, concealed form of SUPI. It exists so the UE can present subscriber identity without exposing the permanent identity in clear form over the air or in early signaling.
What SUCI is
The concealed identity form derived from SUPI for privacy-preserving identity presentation.
Who creates it
The UE, using the home network identifier plus concealment inputs and protection scheme information.
Where it is used
Mostly in registration and other NAS identity presentation scenarios.
Why it matters
It protects subscriber privacy while still giving the home network enough information to resolve the real subscription identity.
suci-0-001-01-1234-1-27-abcdef1234567890Read as:
- SUPI type
- home network identifier
- routing indicator
- protection scheme ID
- home network public key ID
- concealed user part
5G-GUTI
5G-GUTI is the temporary UE identity used in 5GS for registration continuity and subscriber confidentiality. The key relationship to remember is simple: 5G-GUTI = GUAMI + 5G-TMSI.
What 5G-GUTI is
The temporary UE identity used for registration continuity in 5GS.
Who assigns it
The network side, anchored to AMF identity context.
Where it is used
Registration continuity, mobility-side context reuse, and temporary UE identity handling.
Why temporary identity matters
It avoids repeatedly exposing the permanent subscriber identity while still preserving continuity across procedures.
5G-GUTI
= GUAMI + 5G-TMSIGUAMI
= MCC + MNC + AMF Region ID + AMF Set ID + AMF Pointer5G-TMSI
= temporary UE identity part 5G-S-TMSI and 5G-TMSI
5G-TMSI is the temporary UE identity component inside 5G-GUTI. 5G-S-TMSI is the shorter radio-efficient form used in procedures such as paging and other identity-efficient radio signaling.
5G-TMSI
The temporary UE-specific component carried inside the full 5G-GUTI.
5G-S-TMSI
The shortened form used for efficient radio procedures such as paging.
Why 5G-S-TMSI is shorter
It carries only the AMF routing information needed for efficient temporary identity use.
Common usage
Paging, service return, and other procedures where compact temporary identity is preferred.
5G-S-TMSI = AMF Set ID + AMF Pointer + 5G-TMSI GUAMI and AMF Identifier
GUAMI is the globally unique AMF identity. It anchors the AMF side of UE temporary identity continuity and is not the same thing as the full 5G-GUTI. The AMF Identifier inside GUAMI is built from AMF Region ID, AMF Set ID, and AMF Pointer.
What GUAMI is
The globally unique identity of the AMF context used in 5GS temporary identity handling.
AMF Identifier fields
AMF Region ID, AMF Set ID, and AMF Pointer.
How GUAMI differs from 5G-GUTI
GUAMI is only the AMF side of the identity. 5G-GUTI is the full temporary UE identity built from GUAMI plus 5G-TMSI.
Where GUAMI matters
AMF continuity, temporary identity routing, and troubleshooting stale 5G-GUTI or wrong AMF path problems.
PEI
PEI is the permanent equipment identifier in 5GS. It identifies the device, not the subscription, so it should not be confused with SUPI or other subscriber identities.
What PEI is
The permanent equipment identity in 5GS.
Common forms
IMEI-based PEI and IMEISV-based PEI.
What it identifies
The device or equipment, not the subscription itself.
Why it matters
It becomes important in equipment identification, policy, and certain emergency or security-side branches.
imei-490154203237518imeisv-4901542032375186 GPSI
GPSI is the generic public subscription identifier. It is the public-facing identity form and should not be confused with the permanent core-side subscription identity.
What GPSI is
The public-facing subscription identity used for service-facing identity representations.
Common forms
MSISDN-based GPSI and External-ID-based GPSI.
How it differs from SUPI
SUPI is the core permanent subscription identity, while GPSI is the public-facing representation.
Where it matters
Reachability, service-facing identity, and API-style subscription representations.
MSISDN-style GPSI
msisdn-46701234567External-ID-style GPSI
extid-alice@example.com Other 5GS Identity Terms You Should Include
Many readers search for the subordinate terms rather than the umbrella identities. These belong on the same page because they are either concrete forms or structural fields of the main 5GS identity model.
Subscriber-related terms
- IMSI
- NAI
- Home Network Identifier
- Routing Indicator
Equipment-related terms
- IMEI
- IMEISV
Public identity terms
- MSISDN
- External Identifier
AMF and concealment fields
- AMF Identifier
- Protection Scheme Identifier
- Home Network Public Key Identifier
Where These Identities Appear in Real Procedures
| Procedure area | Most visible identities | Why they matter there |
|---|---|---|
| Initial registration | SUPI, SUCI, 5G-GUTI, GUAMI | Identity presentation, privacy protection, and temporary identity continuity are central to the registration branch. |
| Paging and service request | 5G-S-TMSI, 5G-TMSI, GUAMI | Shortened temporary identity is used for efficient radio-side reachability and service return. |
| Identity continuity after mobility | 5G-GUTI, GUAMI | Stale or mismatched temporary identity context can make AMF selection and continuity fail. |
| Emergency registration | 5G-GUTI, SUCI, PEI | Emergency branches can use different identity handling rules when the UE has no SUPI or valid 5G-GUTI path. |
| Management and API views | GPSI, PEI, SUPI | Public-facing identity and equipment identity often appear in service or management representations. |
In practice, SUCI and SUPI matter most in registration and identity handling, 5G-GUTI and 5G-S-TMSI matter most in temporary identity continuity and paging-related procedures, PEI matters for equipment identification, and GPSI matters for public-facing service identity.
Identity Comparison Table
| Identity | Type | Permanent or Temporary | Who or What it Identifies | Common Use |
|---|---|---|---|---|
| SUPI | Subscriber | Permanent | Subscription | Core identity |
| SUCI | Subscriber | Derived or concealed | Concealed SUPI | Privacy-preserving registration |
| 5G-GUTI | UE temporary identity | Temporary | UE registration context | Registration continuity |
| 5G-S-TMSI | UE temporary identity | Temporary | Shortened temporary UE context | Paging and efficient radio procedures |
| GUAMI | Network identity | Stable per AMF context | AMF | Temporary identity anchor |
| PEI | Equipment identity | Permanent | Device | Equipment identification |
| GPSI | Public identity | Stable | Public-facing subscription | Reachability and service identity |
FAQ
What is the difference between SUPI and SUCI?
SUPI is the permanent subscription identity. SUCI is the concealed, privacy-preserving form used so the UE does not expose the permanent subscription identity directly in early signaling.
What is the difference between 5G-GUTI and GUAMI?
5G-GUTI is the full temporary UE identity. GUAMI is only the AMF identity portion inside that temporary identity.
What is the difference between 5G-TMSI and 5G-S-TMSI?
5G-TMSI is the UE-specific temporary identity component. 5G-S-TMSI is the shorter form built for efficient radio procedures such as paging.
Is PEI the same as IMEI?
PEI is the broader 5GS equipment identity concept. IMEI is one common form used to represent PEI.
Is GPSI the same as SUPI?
No. SUPI is the permanent subscription identity used by the core, while GPSI is the public-facing subscription identity used for service-facing representation.
Why does 5G need so many different identities?
Because privacy, temporary continuity, equipment identification, network routing, and public-facing service identity all require different forms and different usage rules.
References
- 3GPP TS 23.003, Numbering, addressing and identification for 5G System
- 3GPP TS 33.501, Security architecture and procedures for 5GS
- 3GPP TS 24.501, NAS protocol for the 5G System
- 3GPP TS 29.571, Common data types including 5GS identity string forms