## 2 Concerns Related to User Identity and Privacy in 5G Core Networks
### Fifth-Generation Service-Based Architecture and Personally Identifiable Information  
One of the major innovations in 5G CNs compared to previous generations is the inclusion of SBA and Virtual Network Functions (VNFs). VNFs are specialized software programs, also known as micro-services, utilized to perform a specific and limited set of tasks. In 5G technology, many different VNFs come together within the CN, working together through well-defined interfaces to facilitate 5G operations. For example, the AMF (Access and Mobility Function) plays the important role of granting a user access to the 5G network. The SBA is the mechanism that allows all VNFs to communicate with each other. Communications between VNFs are carried out by way of RESTful APIs (Representational State Transfer Application Programming Interfaces), similar to how normal day-to-day internet communications with web services are handled. 3 GPP standardizes the request schema, parameters, responses, etc., such as in TS 29.500 and 29.501 [17; 18]. Many of these requests, however, contain important data elements that can be linked back to a specific user, also known as Personally Identifiable Information (PII). The HN is responsible for maintaining user privacy during authentication or operations together with a roaming network. This is achieved by way of the 5G-GUTI, a temporary identifier used to obfuscate the identity of a user in the Radio Access Network (RAN), as specified in 3 GPP TS 33.501. The AMF holds a mapping table of UE (User Equipment) 5G-GUTIs that ultimately trace back to the SUPI. The 5G-GUTI is primarily used in NAS (Non-Access Stratum) layer signaling procedures from the AMF to the UE, instead of leaking the device's permanent identifier over the air [19]. Interactions between the RAN and UE utilize dynamic identifiers for radio scheduling and resource control. Notably, the Radio Network Temporary Identifier (RNTI) is vital for these RAN operations at the MAC (Medium Access Control) layer of the 5G protocol stack. RNTI usage is related to the 5G-GUTI at higher protocol layers but is not directly associated with or mapped within the CN. To protect against eavesdropping or the capture of the SUPI when transmitting over the air, 5G technology implements an encrypted version of the SUPI called the SUCI (Subscription Concealed Identifier). The SUCI is mainly utilized in the initial connection of a UE to the network. The SUPI, however, is widely used within the CN to enable normal network operations for connected devices. Some of these operations include Authentication, Roaming Support, Billing, Subscriber Data Management, Quality of Service (QoS), and PDU (Protocol Data Unit) Session Management. Figure 2 represents the elements and VNFs that the SUCI and SUPI are associated with, according to our extensive analysis of the 3 GPP Release 18 VNF API specifications. This analysis clearly shows that the SUPI is used extensively throughout many VNFs along the SBA, which causes concerns for user identity exposure through CN metadata tracking and analysis by Core Network elements. In Table 2, we present an overview of the various identifiers used throughout 5G activities, along with the standards that define them and a description of how and where