Subscribers & identities

The identities, credentials, and subscription data that make a UE known to the core — and where each piece lives.

Overview

A subscriber is a device the core knows about: an identity, the secret keys that authenticate it, and the subscription data that says what it is allowed to do. In dflux TinyCore this data is held by the UDM/UDR inside the DPF. The lab ships with a set of seeded test subscribers so you can register a UE immediately.

Identities

SUPI / IMSI — the permanent subscriber identity, e.g. imsi-001010000000001. This is the stable key everything else hangs off.
SUCI — the SUPI in concealed form, sent over the radio so the IMSI never travels in the clear. The DPF's SIDF de-conceals it back to the SUPI during authentication.
5G-GUTI — a temporary identity the AMF assigns at Registration Accept and reuses afterward, so the SUPI/SUCI isn't sent on every interaction.

How these are used

SUCI de-concealment and 5G-GUTI assignment happen during attach — see Registration & authentication.

Credentials

Authentication credentials are stored per SUPI and mirror what the UE's SIM holds:

K — the 128-bit permanent subscriber key.
OPc — the operator key, the subscriber-specific variant of the operator's OP, pre-computed for Milenage.
AMF field — the authentication management field (a 16-bit value; not to be confused with the AMF network function).
SQN — the sequence number used for replay protection, advanced on each successful authentication.

Each subscriber also records an authentication method (5G_AKA or EAP_AKA_PRIME) and an algorithm (MILENAGE). The seeded test subscribers use the well-known open5gs test vectors: K = 465B5CE8B199B49FAA5F0A2EE238A6BC, OPc = E8ED289DEBA952E4283B54E88E6183CA, AMF field 0x8000.

Subscription data

Beyond credentials, the UDM holds what the subscriber is provisioned for:

NSSAI — the slices the subscriber may use. Each S-NSSAI is an SST (Slice/Service Type) plus an optional SD (Slice Differentiator); the default slice is SST 1.
DNN — the data networks the subscriber may reach (default internet), per slice, with a default-DNN indicator.
Session-AMBR — the per-session aggregate maximum bit rate (uplink/downlink) applied to non-GBR traffic.

The SMF reads this data when a UE asks for a PDU session and rejects requests for a slice or DNN the subscriber isn't provisioned for — see PDU sessions.

Schema and provisioning

For the full subscriber data model field by field, see the subscriber schema. To add your own subscribers, follow Provisioning subscribers — today this is seed/SQL based.