User Identity Profile

Description

The User Identity Profile (UIP) is a concept introduced in 3GPP Release 19 to provide a structured, standardized representation of user identity information within 5G-Advanced networks. It is defined in the study and specification work captured in TS 23.700 (Study on architecture enhancements) and TS 33.700 (Study on security enhancements). The UIP addresses the growing complexity of user identity management in an environment where subscribers may have multiple identities, devices, and service contexts, and where privacy and security requirements are increasingly stringent. The UIP provides a framework for how identity attributes are collected, stored, shared, and protected across network functions and with external parties.

Architecturally, the UIP is associated with the subscriber's identity data held in the Unified Data Management (UDM) and Unified Data Repository (UDR). It extends beyond traditional subscription identifiers such as SUPI (Subscription Permanent Identifier) and GPSI (Generic Public Subscription Identifier) to include a richer set of identity attributes: device identifiers, service-specific identities, pseudonyms, and privacy-preserving tokens. The UIP may be used by network functions such as the AMF (Access and Mobility Management Function), SMF (Session Management Function), NEF (Network Exposure Function), and AUSF (Authentication Server Function) to make consistent authorization and privacy decisions. It can also be exposed to authorized application functions and external identity providers under controlled conditions.

A key aspect of the UIP is privacy protection. Release 19 security work (TS 33.700) investigates how user identity information can be shared without compromising privacy, including techniques such as anonymization, pseudonymization, and selective disclosure. The UIP may include multiple profiles for different purposes — for example, a public profile for exposure to third parties and a private profile for internal network use. This multi-faceted approach allows the network to satisfy both functional requirements (such as lawful intercept or emergency services) and privacy requirements (such as user consent and data minimization) in a consistent manner.

The UIP also supports identity federation and interoperability across domains. In 5G-Advanced, users may access services from multiple providers, including mobile network operators, cloud service providers, and vertical industry applications. The UIP provides a common language for describing identity attributes, enabling secure and privacy-preserving identity exchange between these domains. This is particularly relevant for network slicing, where different slices may require different identity and authentication policies, and for enterprise deployments where the enterprise may manage its own identity provider while relying on the operator's network for connectivity.

Implementation of UIP involves updates to identity management procedures in the 5G Core, including authentication, authorization, and identity provisioning. The UIP must be managed throughout the identity lifecycle, from creation and provisioning to updates and deletion, with appropriate audit and compliance controls. Security mechanisms such as encryption, integrity protection, and access control are applied to protect UIP data at rest and in transit. As Release 19 is a study-focused release for UIP, the full normative architecture and procedures are expected to mature in subsequent releases. Nonetheless, UIP represents an important step toward more flexible, secure, and privacy-aware identity management in 5G and future 6G networks.

Purpose & Motivation

UIP was motivated by the increasing complexity and security challenges of user identity management in 5G-Advanced networks. Traditional identity concepts like SUPI and GPSI were designed primarily for subscription and routing purposes, not for the rich, multi-context identity needs of modern applications. With the rise of network slicing, edge computing, enterprise services, and IoT, a single user or device may have multiple identities that need to be managed consistently while respecting privacy regulations such as GDPR. Existing mechanisms lacked a unified way to represent, share, and protect these identities across network functions and external partners.

Another driver is the need for privacy-preserving identity exchange. As networks expose more capabilities to third parties through the NEF and service-based interfaces, there is a risk that user identity information could be over-shared or misused. UIP provides a framework for selective disclosure, pseudonymization, and consent management, allowing the network to balance functionality with privacy. This is essential for maintaining user trust and complying with regulatory requirements in different regions.

Finally, UIP supports the evolution toward identity federation and cross-domain interoperability. In a future where users interact with multiple service providers, a standardized identity profile simplifies integration and reduces the risk of inconsistency or security gaps. By studying UIP in Release 19, 3GPP lays the groundwork for a more coherent identity architecture in later releases, potentially extending into 6G. UIP thus addresses a fundamental need: managing who users are, what they are allowed to do, and how their identity information is protected, in a world of increasingly diverse and interconnected services.