No SUPI-Based Paging Applying 5G Cybersecurity and Privacy Capabilities

Published

March 19, 2026

Author(s)

Michael Bartock, Jeffrey Cichonski, Murugiah Souppaya, Karen Kent, Parisa Greyeli, Sanjeev Sharma

Abstract

This white paper provides an overview of "no Subscription Permanent Identifier (SUPI) based paging," a 5G capability for protecting users from being identified and located by an attacker. Unlike previous generations of cellular systems, new requirements in 5G protect subscriber confidentiality by using a temporary identity (ID) instead of SUPI for the paging protocol, and explicitly define when the temporary ID must be reallocated (refreshed). 5G network operators and organizations using 5G technologies are encouraged to verify that the paging is happening as described in the 5G standards. This white paper is part of a series called Applying 5G Cybersecurity and Privacy Capabilities, which covers 5G cybersecurity- and privacy-supporting capabilities that were implemented as part of the 5G Cybersecurity project at the National Cybersecurity Center of Excellence (NCCoE).

Citation

NIST Cybersecurity White Papers (CSWP) - 36D

Report Number

36D

Pub Type

NIST Pubs

Download Paper

https://doi.org/10.6028/NIST.CSWP.36D

Local Download

Keywords

3GPP, 5G, cybersecurity, paging, privacy, Subscription Concealed Identifier (SUCI), Subscription Permanent Identifier (SUPI)

Citation

Bartock, M. , Cichonski, J. , Souppaya, M. , Kent, K. , Greyeli, P. and Sharma, S. (2026), No SUPI-Based Paging Applying 5G Cybersecurity and Privacy Capabilities, NIST Cybersecurity White Papers (CSWP), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.CSWP.36D, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=961425 (Accessed March 20, 2026)