Packet-Temporary Mobile Subscriber Identity

Description

The P-TMSI is a cornerstone identity in the 2G GPRS and 3G UMTS packet-switched core network. It is a 32-bit temporary identifier locally assigned by the Serving GPRS Support Node (SGSN) to a UE upon successful attachment to the packet-switched domain or during a routing area update. The primary purpose of the P-TMSI is to serve as a substitute for the permanent International Mobile Subscriber Identity (IMSI) in most signaling messages between the UE and the network, thereby minimizing the exposure of the sensitive IMSI. The P-TMSI is structured to include the identity of the SGSN that allocated it (often via a Network Resource Identifier - NRI part) and a local sequence number. When a UE initiates a signaling procedure like a Routing Area Update (RAU) or Service Request, it typically uses the P-TMSI along with a P-TMSI Signature (a 3-byte authentication token) to identify itself to the network. The receiving SGSN uses the P-TMSI to look up the UE's context in its database. If the context is not found (e.g., because the UE has moved to a new SGSN area), the network may initiate an identity request procedure to retrieve the UE's IMSI. The P-TMSI is reallocated periodically or during specific mobility events to enhance privacy. Its scope is limited to a Routing Area (RA), and it must be updated when the UE moves to a new RA served by a different SGSN. The P-TMSI is tightly linked with the GPRS attach and routing area update procedures and is a key parameter in the security context establishment between the UE and the SGSN.

Purpose & Motivation

The P-TMSI was introduced to address critical security and privacy vulnerabilities associated with transmitting the permanent IMSI over the radio interface. Sending the IMSI in clear text (which was more common in early systems) would allow eavesdroppers to track a subscriber's location and identity. The P-TMSI provides identity confidentiality by ensuring the IMSI is sent very infrequently. It solves the problem of subscriber traceability and reduces the risk of IMSI-catcher attacks. Furthermore, it improves signaling efficiency; using a shorter, locally significant temporary identity is more efficient than transmitting the full IMSI in every message. Its creation was motivated by the development of the packet-switched core for GPRS, which required its own mobility and session management identities separate from the circuit-switched TMSI. The P-TMSI, along with its signature, also provides a mechanism for the network to quickly validate the UE's claim of identity without full authentication every time, speeding up mobility procedures. It addressed the limitations of the earlier systems that lacked robust temporary identity mechanisms for data services.

Key Features

• 32-bit temporary identity assigned by the SGSN for the packet-switched domain.
• Replaces the IMSI in most air-interface signaling to enhance subscriber privacy and security.
• Used as the primary UE identifier in GMM (GPRS Mobility Management) procedures like Attach and Routing Area Update.
• Typically accompanied by a P-TMSI Signature for identity validation without full authentication.
• Has a limited scope, usually within the area controlled by the allocating SGSN (Routing Area).
• Reallocated periodically or during inter-SGSN mobility to prevent long-term tracking.

Evolution Across Releases

Defining Specifications