Trusted Identity

Description

In 3GPP specifications, a trusted identity refers to network-generated user address information that is used to identify a user or subscriber in a secure and trusted manner. This concept is particularly relevant in the context of IP Multimedia Subsystem (IMS) and other service enablers where user identities must be verified and trusted by the network. The trusted identity is typically an address or identifier that the network itself generates or assigns to a user, as opposed to identities that are provided by the user or external entities. Because it is network-generated, it can be considered trustworthy for the purposes of authentication, authorization, and accounting (AAA), as well as for service delivery and policy enforcement.

The trusted identity is defined in several 3GPP specifications, including TS 24.173 (IMS multimedia telephony communication service and supplementary services), TS 24.406 (TISPAN; PSTN/ISDN simulation services; Message Waiting Indication (MWI)), TS 24.416 (TISPAN; PSTN/ISDN simulation services; Anonymous Communication Rejection (ACR) and Communication Barring (CB)), TS 24.516 (TISPAN; PSTN/ISDN simulation services; Conference (CONF)), and TS 24.616 (TISPAN; PSTN/ISDN simulation services; Malicious Communication Identification (MCID)). These specifications cover various IMS-based services where user identities play a crucial role. The trusted identity is used to ensure that the user is correctly identified and that services are provided to the right subscriber, while also protecting against identity spoofing and fraud.

In practice, the trusted identity is often implemented as a network-generated user address, such as a SIP URI or a Tel URI, that is associated with the user's subscription. When a user registers with the IMS, the network may generate a trusted identity for that user, which is then used in subsequent signaling and service interactions. This identity is trusted because it is created and managed by the network, and it can be used to authenticate the user and authorize access to services. For example, in the Malicious Communication Identification (MCID) service, the trusted identity of the calling party is used to identify and report malicious calls. Similarly, in the Anonymous Communication Rejection (ACR) service, the trusted identity helps determine whether a call should be rejected based on the caller's identity.

The trusted identity concept is closely related to other identity management concepts in 3GPP, such as the IP Multimedia Private Identity (IMPI) and the IP Multimedia Public Identity (IMPU). The IMPI is a private identity assigned by the home network and used for authentication, while the IMPU is a public identity used for communication. The trusted identity may be derived from these identities or may be a separate network-generated address. The key characteristic is that it is generated by the network and therefore can be trusted for security-sensitive operations. This distinguishes it from user-provided identities, which may be spoofed or unreliable.

As networks evolve towards 5G and beyond, the concept of trusted identity remains important, especially with the proliferation of IoT devices and the need for secure identity management. The 3GPP continues to specify mechanisms for generating and managing trusted identities in various service contexts, ensuring that users can be securely identified and that services can be delivered reliably. The trusted identity is thus a foundational element of secure service delivery in 3GPP networks, enabling trust in user identification without relying solely on user-provided information.

Purpose & Motivation

The trusted identity exists to provide a reliable and secure means of identifying users in 3GPP networks, particularly for services that require a high level of trust. In many communication scenarios, the identity provided by a user or a device cannot be inherently trusted because it may be spoofed, misconfigured, or maliciously altered. This is especially critical in services such as emergency calls, lawful interception, and fraud prevention, where accurate identification is paramount. The trusted identity solves this problem by having the network generate and manage the identity, ensuring that it is authoritative and can be used with confidence. This is particularly important in IMS-based services, where user identities are used for routing, billing, and policy enforcement.

Historically, the concept of trusted identity was introduced in Release 7 as part of the evolution of IMS and TISPAN services. Prior to this, identity management relied heavily on user-provided information, which posed security risks. The introduction of network-generated identities allowed operators to offer services that require trusted identification, such as malicious call identification and anonymous call rejection. These services depend on the network being able to reliably identify the calling party, which is only possible if the identity is generated and verified by the network itself. The trusted identity thus addresses the limitations of user-provided identities by providing a network-controlled alternative.

In addition to security, the trusted identity also facilitates interoperability and service consistency. Because the identity is generated according to standardized rules, it can be understood and trusted by different network elements and across different operators. This is essential for roaming and inter-operator services, where a user's identity must be recognized and trusted by the visited network. The trusted identity ensures that such recognition is based on a reliable, network-generated identifier rather than on potentially unreliable user input. As networks continue to evolve, the trusted identity will remain a key enabler for secure and trustworthy communication services.