IMSI, TMSI and GUTI - how they are created

Last time, in article about Network Attach, many times I was using IMSI, P-TIMSI, GUTI and few more numbers. This time I will try to explain most of them. It's good to know what consist on them, how they are created, and what's the purpose of using them.

As always is good to start with a big picture, that this time, we will start with general description of mentioned above.

Mobile subscribers identification

General information

A unique International Mobile Subscriber Identity (IMSI) shall be allocated to each mobile subscriber in every (GSM, UMTS, and EPS) system. In order to support the subscriber identity confidentiality service the VLRs, SGSNs and MMEs may allocate Temporary Mobile Subscriber Identities (TIMSI) to visiting mobile subscribers. The VLR, SGSN, and MME must be capable of correlating an allocated TIMSI with the IMSI of the Mobile Station (MS) to which it is allocated.

An MS may be allocated three TMSIs, one for services provided through the MSC, one for services provided through the SGSN (P-TIMSI for short) and one for the services provided via the MME (M-TIMSI which is part of GUTI).

For addressing on resources used for GPRS, a Temporary Logical Linkt Identity (TLLI) is used. The TLLI to use is built by the MS either on the basis of the P-TIMSI (local or foreign TLLI), or directly (random TLLI).

In order to speed up the search for subscriber data in the VLR a supplementary Local Mobile Station Identity (LMSI) is defined. The LMSI may be allocated by the VLR at location updating and is sent to the HLR together with the IMSI. The HLR makes no us of it but includes it together with the IMSI in all messages sent to the VLR concerning that MS.

Composition of IMSI

IMSI is compose of three parts, as shown in Fig. 1.

Fig. 1. IMSI structure

1. Mobile Country Code (MCC) consisting of three digits. The MSS identifies uniquely the country of domicile of mobile subscriber. 
2. Mobile Network Code (MNC) consisting of two or three digits for GSM/UMTS applications.  That's why, if you are close to your country border UE is still using eNodeBs that belongs/are controled by Mobile Operator from your country. In other words .. the MNC identifies the home PLMN of the mobile subscriber. The length of the MNC (two or three digits) depends on the value of the MCC. A mixture of two and three digit MNC codes within a single MCC area is not recommended according to 3GPP specification.
3. Mobile Subscriber Identification Number (MSIN) identifying the mobile subscriber within a PLMN.

In Fig. 1. there is also shown NMSI entity. The National Mobile Subscriber Identity (NMSI) consists of the MNC and the NMSI.

The 3GPP spec is also saying, that allocation of IMSIs should be such that not mode than MCC +MNC number of digits have to be analysed in a foregin PLMN for information transfer. Just to make roaming a little bit more easier.

Temporary Mobile Subscriber Identity (TMSI)

Since the Temporary Mobile Subscriber Identity (TMSI) has only local significance (in VLR/SGSN/MME and area controlled by VLR/SGSN/MME), the structure and coding of it can be chosen by agreement between operator and ME manufacturer in order to meet local needs. The TMSI is used instead of IMSI to protect subscriber from being identified and also make life more difficult to radio interface eavesdroppers.
The TMSI consists of 4 octets. It can be coded using a hexadecimal representation. The network shall not allocate a TMSI with all 32 bits equal to 1, because TMSI must be stored in the SIM, and SIM uses 4 octets with all bits equal to 1 to indicate that no valid TMSI is available.
In order to avoid problems such as double allocation of TMSIs after a restart of an allocationg node, some part of the TMSI may be related to the time when it was allocated or TMSI can contain a bit field which is changed when the allocating node has recovered from the restart.

In other words TMSI is being hold by VLR and is not passed to HLR. The TMSI is used mostly in Paging situations. Where Paging is used by network to request the establishment of NAS signaling connection to UE. The NAS signaling connection after being established can also be used in process of sending signaling messages to UE. Paging procedure can also be used to prompt UE to reattach itself to the network if needed.

Globally Unique Temporary UE Identity (GUTI )
The purporse of the GUTI is to provife an unambiguous identification of the UE that does not reveal the UE or the user's permanent identity in the Evolved Packet System (EPS). It also allows the identification of the MME and network. It can be used by network and the UE to establish UE's identity during signaling between them in EPS.
On GUTI consist two main components:

• GUMMEI - that uniquely identifies the MME which has allocated the GUTI
• M-TMSI - other that uniquely identifies the UE within the MME because of allocated the GUTI

Because of that when UE is contacting the network it sends the GUTI to the eNodeB which then uses the GUTI number to identify to which MME re-establish request will be send. If the UE has moved from UMTS cell to LTE cell, a TAU procedure is made (because UE does not have its GUTI) and P-TMSI is send. By this way MME, which is in control of area to which UE moved to, can contact SGSN, which controlled area where UE was previously, to request the subscribers current profile like IP address and PDP contexts. Situation is similiar when UE has moved from LTE to UMTS cell. GUTI is sent as the P-TMSI parameter and the procedure is reffered as Routing Area Update (RAU).

If there is a situation where eNodeB from new LTE cell is not associated with MME on which GUMMEI is pointing eNodeB simply will select new MME. The new MME could get context information from old MME using same GUTI.

Fig. 2. GUTI structure

Globally Unique MME Identifier (GUMMEI)

The format and size of the GUTI is:

GUTI = GUMMEI + M-TMSI, where

GUMMEI = MCC + MNC + MME Identifier and

MME Identifier = MME Group ID + MME Code

MCC and MNC shall have the same field size as in earlier 3GPP systems.

M-TMSI shall be of 32 bits length.

MME Group ID shall be of 16 bits length.

MME Code shall be of 8 bits length.

Sources:

Biggest part of materials above is from here 3GPP TS 23.003, but I also used a helping hand of two other blogs here are the links Learning LTE - blog and 3G and 4G Wireless Blog - blog