GUTI(Globaly Unique Temporary ID)

As the name implies, GUTI is a kind of temporary ID. Each of the UE has a couple of different kind of it's own Unique ID like IMSI, IMEI etc, but to use these unique ID all the time during the communication would make the security vulnerable. So in some wireless communication, we use a temporary ID which maps the unique ID allocated to UE. And this temporary ID changes often, so even if somebody hacked out the ID it will be useless soon.

Why a temporary identity

In WCDMA, you may remember that we had several commonly used IDs, IMSI, TMSI, P-TMSI. IMSI is a unique ID stored in USIM and permanent ID. TMSI, P-TMSI is a temporary ID which is mainly used as a replacement for IMSI.

23.003 puts the purpose in one sentence. The GUTI identifies the UE without revealing the permanent identity, and it identifies the MME and the network at the same time.

That second half is easy to miss. A GUTI is not only a pseudonym. The network reads it to learn which MME holds the context for this UE. It therefore does a routing job as well as a privacy one.

It also changes, and the change is deliberate. 24.301 gives the MME a procedure for reallocating a GUTI on its own, and the identity is reallocated again at attach and at tracking area updating.

One note in 24.301 is worth carrying over. The reallocation is usually performed in ciphered mode. A new pseudonym sent in the clear beside the old one would tie the two together and undo the point of changing it.

A GUTI hides the permanent identity : 23.003 makes that the first half of its purpose.
It also says which MME to ask : the same value routes a request as well as anonymising the subscriber.
It is meant to be short lived : the MME can reallocate it at any time, and does so at attach and at tracking area updating.
The reallocation is normally ciphered : sending the new value in the clear beside the old one would link them.

How the GUTI is built

The four fields below are not four independent numbers. They nest, and 23.003 gives each level of the nesting its own name. Those names are what the specifications use, so they are worth having before reading any further.

GUTI is also a temporary ID and it is slimilar to P-TMSI in UMTS. The structure of GUTI is as follows :

PLMN (3 Bytes)
MME Group ID (2 Bytes)
MME Code (1 Bytes)
M-TMSI (4 Bytes)

23.003 builds the identity from the outside in. The MCC and the MNC together with the MME Identifier make the GUMMEI, which is the Globally Unique MME Identifier. The MME Identifier is the MME Group ID and the MME Code.

The GUTI is then the GUMMEI followed by the M-TMSI. The first six bytes say which MME, and the last four say which UE inside that MME.

The sizes come from the same clause. M-TMSI is 32 bits, MME Group ID is 16 bits, and MME Code is 8 bits. MCC and MNC keep the size they had in earlier 3GPP systems, which is the three bytes the list above gives.

One more name matters, and it is the one a reader meets during paging. 23.003 builds the S-TMSI from the MME Code and the M-TMSI alone. That is five bytes rather than ten, because paging inside one MME pool needs neither the PLMN nor the group.

The fields nest rather than sitting side by side : MME Code and Group ID make the MME Identifier, which with the PLMN makes the GUMMEI.
Six bytes name the MME and four name the UE : the GUTI is the GUMMEI followed by the M-TMSI.
Only the M-TMSI is unique to the subscriber : everything in front of it is shared by every UE on that MME.
Paging uses the short form : the S-TMSI drops the PLMN and the group and keeps five bytes.

The GUTI inside a NAS message

The decode below is what a GUTI looks like on the wire, and it runs to thirteen octets rather than ten. The three extra ones are the information element wrapper rather than any part of the identity.

A decoded GUTI element, capture. The values are what one network sent, not what the specification requires.

  +-GUTI ::= TLV OPTIONAL:Exist
  | +-Octet1 ::= DIVISION
  | | +-EPS mobile identity IEI ::= IEI [50]
  | +-Octet2 ::= DIVISION
  | | +-Length of EPS mobile identity contents ::= LEN (0..255) [11]
  | +-Octet3 ::= DIVISION
  | | +-Spare ::= FIX [F]
  | | +-Odd/even indication ::= CHOICE [....]
  | | +-Type of identity ::= CHOICE [GUTI]
  | +-Octet4 ::= DIVISION
  | | +-MCC digit 2 ::= INT (0..15) [0]
  | | +-MCC digit 1 ::= INT (0..15) [0]
  | +-Octet5 ::= DIVISION
  | | +-MNC digit 3 ::= INT (0..15) [15]
  | | +-MCC digit 3 ::= INT (0..15) [1]
  | +-Octet6 ::= DIVISION
  | | +-MNC digit 2 ::= INT (0..15) [1]
  | | +-MNC digit 1 ::= INT (0..15) [0]
  | +-Octet7 ::= DIVISION
  | | +-MME Group ID ::= INT (0..255) [128]
  | +-Octet8 ::= DIVISION
  | | +-MME Group ID(continued) ::= INT (0..255) [1]
  | +-Octet9 ::= DIVISION
  | | +-MME Code ::= INT (0..255) [1]
  | +-Octet10 ::= DIVISION
  | | +-M-TMSI ::= INT (0..255) [0]
  | +-Octet11 ::= DIVISION
  | | +-M-TMSI(continued) ::= INT (0..255) [0]
  | +-Octet12 ::= DIVISION
  | | +-M-TMSI(continued) ::= INT (0..255) [0]
  | +-Octet13 ::= DIVISION
  |   +-M-TMSI(continued) ::= INT (0..255) [1]

Octet 1 is the element identifier. 24.301 gives the GUTI the value 50 in the messages that carry it, as an optional TLV of thirteen octets.
Octet 2 is the length of the contents. It reads 11 here, which is octets 3 to 13.
Octet 3 says which kind of identity follows. The four spare bits read F, and the type field reads GUTI, which 24.301 codes as 110.
Octets 4 to 13 are the identity itself. They line up with the four fields above: three for the PLMN, two for the MME Group ID, one for the MME Code and four for the M-TMSI.

The arithmetic closes. Thirteen octets carry an identifier and a length octet in front, which leaves the eleven the length field claims. Ten of those eleven are the GUTI the section above describes.

The values decode to a usable identity. The MCC digits are 0, 0 and 1, so the MCC is 001. The MNC digits are 0, 1 and F, and 24.301 uses that F to mark a two digit MNC, so the MNC is 01.

The rest reads straight off. MME Group ID is 128 and 1 across two octets, which is 32769. MME Code is 1. The M-TMSI is 0, 0, 0 and 1, which is 1.

Three octets of the thirteen are wrapper : identifier, length, and the octet that says the identity is a GUTI.
The length field counts from octet 3 : 11 contents octets, of which 10 are the GUTI.
An F in the third MNC digit means a two digit MNC : 24.301 codes those four bits as 1111 when an operator uses only two.
This capture carries MCC 001 and MNC 01 : with MME Group ID 32769, MME Code 1 and M-TMSI 1.

Where the GUTI appears

The three messages below are not three separate uses of a GUTI. They are one exchange. Reading them in order shows how a UE gets a new identity, and how the network learns it has been taken.

Examples of NAS messages using GUTI are

Attach Request
Attach Accept
Attach Complete

The order is what matters. The UE offers the GUTI it already holds in the Attach Request. The MME returns a new one in the Attach Accept. The Attach Complete is the acknowledgement.

24.301 is precise about that last step. On receiving an ATTACH COMPLETE the MME stops timer T3450, enters EMM-REGISTERED, and considers the GUTI it sent in the ATTACH ACCEPT as valid. Until then the old value still stands.

There is a dedicated procedure as well. Clause 5.4.1 lets the MME reallocate a GUTI by itself, and only while the UE is EMM-REGISTERED. The same clause adds that a GUTI is reallocated implicitly at attach and at tracking area updating.

One line in that clause is worth remembering while reading a log. The PLMN identity in the GUTI indicates the current registered PLMN. A GUTI that disagrees with the serving cell is a UE that has not updated yet.

The three attach messages are one handover of identity : old GUTI up, new GUTI down, acknowledgement up.
The new value is not valid until the Attach Complete : 24.301 makes the MME wait for it before trusting the GUTI it sent.
The MME can also reallocate on its own : clause 5.4.1 defines the procedure, and it runs only in EMM-REGISTERED.
The PLMN inside the GUTI is the registered one : a mismatch against the serving cell means the update has not happened yet.

Reference

[1] 23.003 : 3GPP - Numbering, addressing and identification, v20.0.0. Clause 2.8.1 gives the GUTI, the GUMMEI, the MME Identifier, the S-TMSI and the field sizes quoted above.

[2] 24.301 : 3GPP - Non-Access-Stratum protocol for EPS; Stage 3, v20.0.0. Clause 9.9.3.12 gives the EPS mobile identity element, with Figure 9.9.3.12.1 and Table 9.9.3.12.1. Clause 5.4.1 gives the GUTI reallocation procedure, and the attach clause settles what an ATTACH COMPLETE confirms.