Private Identity

Description

In 3GPP identity management, a Private Identity serves as a generic umbrella term that refers to either a Private User Identity (IMPI) or a Private Service Identity (IMPSI). These identities are fundamental to the authentication, authorization, and service provisioning processes within the IP Multimedia Subsystem (IMS). The concept was introduced in Release 8 and is defined in specifications such as TS 29.228 and TS 29.562, which cover IP Multimedia (IM) Subsystem Cx and Dx interfaces and the Home Subscriber Server (HSS) respectively. The Private User Identity is a unique, permanent identity assigned to a subscriber and is used for authentication with the IMS. It is stored in the ISIM (IP Multimedia Services Identity Module) and is never exposed to the public network. On the other hand, a Private Service Identity is used to identify a service, typically in the context of service invocation and authorization, such as in the Service Capability Interaction Manager (SCIM) or Application Server (AS) interactions.

The architecture relies on the Private Identity being distinct from public identities, which are used for communication. A single Private User Identity can be associated with multiple Public User Identities, allowing a subscriber to have multiple public identities (e.g., SIP URIs, E.164 numbers) for different services or contexts. This separation enhances privacy and security, as the private identity is not shared publicly. The Private Identity is used during the registration process, where the user equipment (UE) authenticates with the IMS core using protocols like Digest-AKA. The HSS stores the Private Identity and associated security credentials. The Cx interface between the IMS core components (e.g., Call Session Control Functions) and the HSS is used to retrieve authentication vectors and subscriber data.

For Private Service Identities, these are used to represent services themselves, not users. They can be used for service invocation, routing, and authorization. For instance, a service might have a private identity that is used to access the HSS and obtain service-related data. The Private Service Identity is typically an IMSI-like identity or a network-specific identity. These identities are managed by the network operator and are used internally.

The definition of Private Identity has remained remarkably stable across 3GPP releases from Rel-8 through Rel-20. The core meaning—either a Private User Identity or a Private Service Identity—has not changed. This consistency reflects the maturity of the IMS identity framework. Minor editorial changes in some releases (e.g., Rel-17 and Rel-20) do not alter the technical semantics. The Private Identity concept is critical for interoperability and security in IMS-based services, including VoLTE and VoWiFi. It ensures that authentication is based on a secure, private credential, while public identities enable flexible service access.

Purpose & Motivation

The Private Identity concept exists to address the need for secure and unambiguous identification of subscribers and services within the IMS. Before its introduction, early mobile networks primarily used identities like IMSI for authentication but lacked a clear separation between private credentials and public identities for multimedia services. The Private Identity provides a unique, permanent, and private identifier for authentication, which is essential for preventing fraud and unauthorized access. It also allows a single subscription to support multiple public identities, enabling users to have different addresses for different services (e.g., personal vs. business) without compromising security.

For services, the Private Service Identity allows the network to treat services as distinct entities for authorization and invocation. This is particularly important in IMS where application servers need to authenticate and authorize service requests. By having a private identity for services, the network can apply security policies and charging rules specific to each service. This separation also simplifies roaming and inter-operator scenarios, as the private identity is tied to the home network.

The stability of the Private Identity definition across releases indicates that the foundational principles of IMS security and identity management have not required fundamental changes. The introduction of 5G and network slicing has not altered the core concept, though new identities may be introduced for specific 5G services. The Private Identity remains a cornerstone of IMS security architecture.