Subscriber data model

The fields that define a subscriber in dflux TinyCore — credentials, slice and DNN entitlements — plus the seeded lab vectors and the database tables that back them.

A dflux TinyCore subscriber is the data the DPF (UDM + UDR + AUSF) holds for one SIM: who they are, the long-term key that authenticates them, and which slices and data networks they may use. These records correspond to the 3GPP UDR authentication-subscription and subscription-data resources. See Subscribers for the conceptual model.

Identity

Field	Description
`SUPI`	Subscription Permanent Identifier — the primary key for a subscriber. In dflux TinyCore this is an IMSI in the form `imsi-<MCC><MNC><MSIN>`.
`GPSI`	Generic Public Subscription Identifier (the external identity, e.g. an MSISDN). Optional.

Authentication credentials

The authentication subscription holds the Milenage inputs. These are stored as the operator-variant OPc (not the bare OP), as is standard for provisioned subscribers.

Field	Width	Description
`K` (PermanentKey)	16 bytes	Subscriber permanent key. Matches the K burned into the SIM.
`OPc` (OpcKey)	16 bytes	Operator variant of `OP`, pre-computed per subscriber.
`AMF` (AuthManagementField)	2 bytes	Authentication Management Field (not the AMF network function).
`SQN` (SequenceNumber)	6 bytes	Sequence number for replay protection. Advanced atomically on each successful authentication.
`AuthMethod`	—	`5G_AKA` or `EAP_AKA_PRIME`.
`AlgorithmID`	—	Key-derivation algorithm — `MILENAGE` (TUAK is reserved).

Slice & data-network entitlements

Field	Description
`NSSAI` / `S-NSSAI`	The slices the subscriber may use. Each S-NSSAI is an `SST` (Slice/Service Type, e.g. `1`) plus an optional `SD` (Slice Differentiator). Includes a default set and an allowed set.
`DNN`	The Data Network Name(s) the subscriber may connect to per slice (e.g. `internet`), carried in the SMF-selection and session-management data.
Session-AMBR	Per-DNN aggregate maximum bit rate, as uplink/downlink strings (e.g. `200 Mbps` / `400 Mbps`).

Seeded lab vectors

Running any DPF backend with -seed installs five canonical test subscribers. They share the well-known open5gs default key material so off-the-shelf test SIMs and simulators (UERANSIM, etc.) authenticate without extra provisioning.

text

Subscribers 1–4 are provisioned for 5G_AKA; subscriber 5 (imsi-001010000000005) is provisioned for EAP_AKA_PRIME so the non-3GPP / Wi-Fi-calling auth path has a known-good fixture.

Lab credentials only

These vectors are public and identical across every dflux TinyCore install. They are for labs and conformance testing only — never reuse them for anything that matters.

Persistent-store tables

With the SQLite or PostgreSQL backend, the per-resource subscriber data is split across these tables (created by the DPF migrations). Each is keyed by SUPI:

Table	Holds
`udm_auth_subscriptions`	K / OPc / AMF / SQN / auth method (the authentication subscription).
`udm_am_data`	Access & Mobility subscription data.
`udm_nssai`	Default and allowed NSSAI.
`udm_smf_sel`	SMF-selection subscription data (slice → DNN mapping).
`udm_sm_data`	Session-management data per (slice, DNN), including Session-AMBR.
`udm_am_policy_data` / `udm_sm_policy_data`	PCF access-mobility and session-management policy data.

Registration state (udm_amf_registrations, udm_smf_registrations), auth events, AUSF context, and shared data live in further udm_*, ausf_*, and pcf_* tables. The in-memory backend keeps the same shape without a database.

Provisioning is by seed or direct DB today

There is no admin REST API for subscribers in dflux TinyCore yet. Provision either with the built-in -seed fixture or by writing rows into the tables above on a persistent backend. See Provisioning subscribers.