Definition
Privacy Protection aims to prevent sensitive information such as user identity, location, and behavior from being intercepted, tracked, or misused during air interface transmission, storage, and processing. 5G introduces SUCI (Subscription Concealed Identifier) to replace plaintext IMSI during initial registration, using elliptic curve encryption, which is decrypted by the UDM to obtain the SUPI. In addition, location information, CDRs, and user behavior data must comply with privacy regulations such as GDPR and the Personal Information Protection Law.
Core Mechanism
Protection of SUCI and IMSI
SUCI encrypts the SUPI (including IMSI) on the terminal side, and only the UDM can decrypt it. The air interface and intermediate network elements cannot obtain the plaintext IMSI, effectively preventing IMSI catching and tracking attacks.
Temporary Identifier GUTI
After successful registration, the network assigns a GUTI (Globally Unique Temporary Identifier) to replace the IMSI for subsequent signaling, reducing IMSI exposure over the air interface. GUTI is periodically reallocated to reduce the risk of correlation.
Location and Data Anonymization
Location information can be controlled in granularity (e.g., cell-level, TA-level), anonymized, or pseudonymized; CDRs and user behavior data must be collected minimally, stored encrypted, and access-controlled, in accordance with the data minimization principle.
IoT Privacy Considerations
The number of IoT devices is large, and location information is sensitive, requiring protection against device tracking and identity misuse. 5G IoT supports SUCI and GUTI; device identifiers, IMEI, etc., also need to be protected during transmission and storage. Coordinated with air interface encryption and integrity protection , they form a security architecture .
SimtoLink's IoT SIM cards and cloud platform strictly follow privacy protection and data compliance requirements in scenarios such as device management and location services. Sensitive data such as device identifiers and location information are transmitted and accessed in encrypted form; SimtoLink assists customers in assessing privacy risks in solution design, meeting industry regulatory and customer compliance requirements.
The Long-Term Identity Is Hidden Only at First Registration
Cellular privacy protects the identifiers that can tie a person or a device to a location and a pattern of behavior. In 5G the device encrypts the permanent subscriber identity, SUPI, with the home network’s public key into a SUCI. The first registration on the air interface no longer sends a plaintext IMSI. Only the home UDM can decrypt it. The encryption uses the home network’s public key. A visited network or a fake base station, without the matching private key, cannot read the permanent identity by listening to registration. After registration the network issues a GUTI, and later attach, paging, and service requests use that temporary identity. If the GUTI is not changed for a long time, an eavesdropper can still string repeated appearances of the same temporary identity into a track.
This covers only the identity field on the air interface. A location update still tells the network which tracking area the device is in, or paging cannot work. Privacy protection does not cancel location management. It limits who can see the permanent identity, how fine a location may be, and how long logs are kept. If an application device number, a license plate, or a face is linked in plaintext on the platform, swapping the air interface for SUCI does not stop misuse inside the organization.
Reallocate the Temporary Identity When Signaling Can Bear It
GUTI reallocation, location masking, and minimized call records have to be designed together. Reallocate too rarely and the temporary identity becomes a long-term identity in practice. Reallocate too often and registration signaling rises, which breaks the power-saving model of a low-power device. The condition is that both the device and the network support SUCI, and that the SIM carries the correct home-network public key or profile. An old SIM, test firmware with concealment switched off, or a switch that forces paging by IMSI all bypass the protection. While roaming, the visited network should see only the SUCI and the temporary identity it assigned. It should not ask the device to report a plaintext IMSI “to make activation easier.”
The conditions on the platform are just as concrete. Location display should take cell level or tracking-area level as the service needs, not save a latitude and longitude every few seconds by default. User identifiers in call records need access control. A maintenance export needs an expiry. The split with TLS is this: TLS protects the application payload from the device to the platform, and SUCI and GUTI protect the cellular identity. Do only one layer, and the other layer can still correlate the same device. If a third-party operator keeps logs for a long time, the contract also has to state the retention time and who deletes them.
The Air Interface Is Encrypted, and the Call Records Are Still Plaintext
A common mistake is to treat air-interface encryption as finished privacy protection. Air-interface encryption stops a radio eavesdropper from reading the service content. It does not stop the operator and the platform from seeing identity and location as part of their job. Writing IMSI, IMEI, cell identity, and an exact timestamp into every line of a debug log, then uploading that log to a shared drive, builds the correlation database yourself. Another mistake is paging and test commands that carry the IMSI for a long time, discarding the temporary identity because it is easier to troubleshoot.
A test SIM that uses plaintext in the lab, with engineering mode left on for the production SIM, keeps sending the permanent identity in the field. Confirm in an air-interface capture that the first registration shows a SUCI and not an IMSI, and check whether a platform export still contains fields that identify a person directly. A compliance text that says “encrypted,” next to an export table of plaintext IMSIs, means the protection stopped at the slogan.
Maintenance accounts, test exports, and third-party operations interfaces often bypass the masking on the business page. The page shows a mask. The exported table still has the full identifier and an exact time. Put the two together and the track can be rebuilt. If a temporary identity is not changed for months, an eavesdropper can string repeated appearances together without ever breaking the permanent identity. Location display should default to the granularity the service actually needs. A finer record needs its own permission and a shorter retention time. Confirming in an air-interface capture that the first registration no longer shows a plaintext long-term identity is only the first check.