Back to PCAP Labs
PCAP Lab intermediate 20 min4 graded questions
SUCI / SUPI Privacy — Tracing Subscriber Privacy in 5G
A researcher claims 5G finally closes the IMSI-catcher loophole. Walk through a successful registration and verify it for yourself: the UE sends SUCI (not IMSI) on the air, UDM/SIDF decrypts it inside the core, and SUPI only ever appears on SBI traffic.
Scenario
You are reviewing the security posture of a 5G network. A researcher claims that subscriber identity privacy (SUPI) is now protected from IMSI catchers. You have captured a UE's initial registration where SUCI is used instead of a plain IMSI.
Analyze the trace: find where SUPI is revealed (inside the core), confirm that the over-the-air interface only sees SUCI, and identify the SIDF (Subscription Identifier De-concealing Function) that handles the decryption.
References worth having open: TS 33.501 §6.12 (SUCI/SUPI & SIDF), TS 33.501 Annex C (Protection Schemes — Null, ECIES Profile A, ECIES Profile B), TS 29.503 (Nudm_UEAuthentication), TS 29.509 (Nausf_UEAuthentication).
Hands-on labs are a Pro feature
Engineer-grade PCAP labs, protocol dissection and TelcoMentor assistance are included with 5G/6G Academy Pro.
See Pro plans7-day money-back guarantee · cancel anytime.