Default User Equipment Credentials

Description

Default UE credentials are information configured in the UE to make the UE uniquely identifiable and verifiably secure to perform UE onboarding. This concept was introduced in Release 19 as part of the 3GPP work on UE onboarding and provisioning, defined in 3GPP TS 23.501 (System Architecture for the 5G System) and TS 33.501 (Security Architecture and Procedures for 5G System). These credentials enable a UE that is not yet provisioned with full network credentials to securely connect to a network for the purpose of onboarding, during which it receives its operational credentials and configuration.

In the 5G architecture, UE onboarding refers to the process by which a UE that lacks a subscription or has only limited credentials can connect to a network, be authenticated, and receive the necessary provisioning to become a fully operational device. Default UE credentials serve as the initial trust anchor for this process. They are pre-configured in the UE, typically during manufacturing or by the device vendor, and are used to establish a secure connection to an onboarding network or a provisioning server. The credentials may include a default identity, a default authentication key or certificate, and other security parameters that allow the UE to be uniquely identified and authenticated during the onboarding procedure.

The security architecture for UE onboarding is defined in TS 33.501. It specifies how the default UE credentials are used to establish a secure channel between the UE and the network, how the UE is authenticated, and how the onboarding process is protected against attacks. The credentials must be verifiably secure, meaning that they provide sufficient assurance that the UE is genuine and that the onboarding process cannot be hijacked by malicious actors. This typically involves mutual authentication between the UE and the network, using the default credentials as the basis for trust.

Once the UE successfully completes onboarding, it receives its operational credentials, such as a USIM-based subscription or a certificate for primary authentication. These operational credentials then replace or supplement the default credentials for subsequent network access. The default credentials may be retained for future onboarding or re-onboarding scenarios, or they may be disabled after initial provisioning, depending on operator policy and device configuration.

The introduction of default UE credentials in Release 19 reflects the growing need to support massive numbers of IoT devices, many of which are deployed without pre-provisioned operator subscriptions. These devices need a secure, automated way to join a network and receive their credentials without manual intervention. Default UE credentials provide the foundation for this zero-touch onboarding capability, enabling scalable and secure deployment of IoT devices in 5G networks.

Purpose & Motivation

Default UE credentials were introduced in Release 19 to address the challenge of securely onboarding UEs that do not yet have operational network credentials. In previous releases, UEs were expected to have a pre-provisioned subscription (e.g., a USIM) before they could access the network. This model works well for smartphones and other consumer devices but is impractical for the massive IoT deployments envisioned for 5G, where devices may be manufactured without knowledge of the target operator and need to be provisioned remotely after deployment.

The default UE credentials solve this by providing a pre-configured, verifiably secure identity that the UE can use to connect to an onboarding network. This allows the device to be authenticated and to establish a secure channel for receiving its operational credentials, all without manual intervention. The credentials ensure that the onboarding process is secure and that only genuine devices can participate, preventing unauthorized devices from obtaining network access.

This capability is essential for enabling zero-touch provisioning and large-scale IoT deployments. It also supports scenarios where devices are sold in one market and deployed in another, or where the operator is not known at manufacturing time. By standardizing the default UE credentials and the onboarding procedures, 3GPP provides a foundation for interoperable, secure onboarding across different vendors and operators.