SAE Temporary Mobile Subscriber Identity

Description

The SAE Temporary Mobile Subscriber Identity (S-TMSI) is a crucial temporary identifier used within the 3GPP Evolved Packet System (EPS). It is constructed and assigned by the Mobility Management Entity (MME) to a User Equipment (UE) upon successful attachment to the network or during a Tracking Area Update (TAU). The S-TMSI serves as a concise alias for the globally unique International Mobile Subscriber Identity (IMSI), with the primary objective of safeguarding subscriber privacy and optimizing radio signaling efficiency. It is used in scenarios where the UE's identity needs to be conveyed over the radio interface, such as during the paging procedure to alert a UE of incoming data, or in the initial Non-Access Stratum (NAS) message of a service request.

Structurally, the S-TMSI is a 40-bit value composed of two main parts: the MME Code (MMEC) and the MME Temporary Mobile Subscriber Identity (M-TMSI). The MMEC is an 8-bit code that uniquely identifies the MME within a group of MMEs (an MME Group, identified by the MME Group ID or GUMMEI). The M-TMSI is a 32-bit number that uniquely identifies the UE within the scope of that specific MME. When combined with the MME Group ID (which is derived from the PLMN ID and the MME Group ID part of the GUMMEI), the S-TMSI allows any network entity to uniquely identify the serving MME for that UE. The S-TMSI is delivered to the UE within the Attach Accept or TAU Accept NAS messages.

From a procedural perspective, the S-TMSI is used extensively. In the paging process, the MME sends a paging message to the eNodeB containing the S-TMSI (or, if not available, the IMSI). The eNodeB then broadcasts the paging message over the air using this S-TMSI. The UE, monitoring the paging channel, recognizes its assigned S-TMSI and initiates a service request procedure. In the initial NAS message of this service request (or during a periodic TAU), the UE includes its S-TMSI, allowing the network to quickly identify the UE's context in the MME without transmitting the full IMSI. This mechanism not only protects the IMSI from eavesdroppers but also reduces the message size on the radio link, conserving valuable radio resources and speeding up connection establishment.

Purpose & Motivation

The S-TMSI was introduced with the EPS in 3GPP Release 8 to address two key shortcomings of previous systems: subscriber identity privacy and signaling efficiency. In pre-LTE systems like GSM and UMTS, the Temporary Mobile Subscriber Identity (TMSI) served a similar purpose, but the S-TMSI was redesigned for the flatter, all-IP architecture of EPS. Its primary purpose is to obfuscate the permanent IMSI, which is a critical privacy concern, as frequent transmission of the IMSI would allow for easy tracking and profiling of subscribers. By using a frequently changing temporary identifier, user location and activity become more difficult to correlate for unauthorized observers.

Furthermore, the S-TMSI solves the problem of signaling overhead. The IMSI is a long, 15-digit identifier. Transmitting it frequently for paging and connection setup consumes significant radio bandwidth. The compact, fixed-length 40-bit S-TMSI drastically reduces the size of signaling messages. Its structure also serves an architectural purpose: by including the MMEC, it provides a efficient routing mechanism within the core network. When an eNodeB or another MME receives an S-TMSI, it can infer the serving MME (or at least the MME pool) without extensive lookups, streamlining procedures like inter-MME handovers. The motivation for its creation was integral to the EPS design goals of improved security, reduced latency, and support for a massive number of devices, making it a foundational element for all subsequent cellular generations, including 5G, where a similar concept (the 5G-S-TMSI) is used.

Key Features

• 40-bit temporary identifier comprising an 8-bit MMEC and a 32-bit M-TMSI
• Assigned by the MME to a UE during attach or tracking area update procedures
• Used to page the UE and identify it in initial NAS messages, protecting the IMSI
• Enables efficient routing within the core network via the MMEC
• Reduces signaling overhead on the radio interface compared to using the full IMSI
• Fundamental for UE privacy and network efficiency in EPS and 5GS

Evolution Across Releases

Defining Specifications