5G Identifiers (RNTI, 5G-GUTI, PCI, NCGI…) in 5G NR

Introduction

An identifier in a mobile network is simply a label that names one thing unambiguously — a subscriber, a radio connection, a cell, a network function, or a data flow. 5G defines dozens of them because each part of the system has genuinely different needs: the core wants labels that are permanent and privacy-preserving, the air interface wants labels that are tiny and disposable, and the transport network wants per-interface bookkeeping. No single universal ID could satisfy all three at once.

You encounter these identifiers throughout the UE lifecycle. At registration the UE presents a concealed subscription identity (SUCI) and is later given a rotating temporary one (5G-GUTI). During random access and scheduling it is addressed on the air by 16-bit RNTIs. Its cell and tracking area are named by PCI, NCGI and TAI; its connection is tracked per interface by paired NGAP/F1AP/E1AP IDs; and its traffic is sorted by S-NSSAI, QFI, 5QI and bearer IDs.

The reference specs are TS 23.003 (numbering and identifiers), TS 38.300 (NR architecture), TS 38.321 (the RNTIs) and TS 23.501 (5G system architecture, QoS). Rather than learning them as a flat list, learn the scope each belongs to — core, radio, cell/area, interface, or QoS/bearer — and almost every property of an identifier (its size, lifetime, and who allocates it) becomes predictable.

Why 5G needs so many identifiers

The concrete reason for the proliferation is that a single universal identifier would fail at least one requirement everywhere it was used. Make it permanent and global (good for the core's subscription record) and it becomes a privacy disaster if broadcast over the air — exactly the 4G "IMSI-catcher" weakness 5G set out to fix. Make it tiny and disposable (good for addressing a UE on the crowded PDCCH every millisecond) and it cannot be globally unique or survive a session. Make it structured and hierarchical (good for routing between network functions) and it is too big to spend radio bits on. So 5G uses a family of purpose-built labels, each optimised for its scope, and defines clean rules for translating between them (for example, the compact 5G-S-TMSI derived from the full 5G-GUTI).

How to read the 5G identifier zoo

Before the tables, fix the mental map. Every identifier below belongs to exactly one of five scopes, and once you know the scope you can usually guess the rest — how long it lives, whether it is sent over the air, and who allocates it.

RNTIs — who you are on the radio, right now

A Radio Network Temporary Identifier (RNTI) is a 16-bit label used only on the air interface (TS 38.321). It is how the gNB addresses a specific UE, a group of UEs, or a broadcast purpose on the PDCCH. There is no separate "address field" in a DCI — instead the 24-bit CRC of the DCI has its last 16 bits masked (XOR-scrambled) with the 16-bit RNTI before transmission. Each UE blind-decodes the PDCCH candidates and XORs the recovered CRC with the RNTIs it currently owns; only the intended recipient gets a CRC that checks out. Different RNTIs therefore mean different purposes, and a UE can hold several at once.

Notice the pattern in the value column. Almost every RNTI lives in the range 0001–FFEF; the block FFF0–FFFD is reserved, and only two are pinned to fixed, universally-known values: P-RNTI = FFFE and SI-RNTI = FFFF. The value 0000 is "N/A" and never assigned. The RA-RNTI and MsgB-RNTI are special because they are not assigned at all — they are computed from the PRACH occasion, so the UE already knows which value to listen for the moment it has sent its preamble.

Here s_id is the first OFDM symbol of the PRACH occasion (0–13), t_id the first slot in the system frame (0–79), f_id the frequency-domain occasion index (0–7), and ul_carrier_id is 0 for the normal UL or 1 for the SUL carrier. The MsgB-RNTI uses the same formula plus a fixed offset of 14 × 80 × 8 × 2 = 17920, so 2-step and 4-step responses never collide on the same occasion.

UE and subscriber identities — who you are to the network

These identify the subscriber and the device at the level of the core network. The golden rule of 5G is that the permanent identity is never sent in the clear over the air — a direct fix for the 4G "IMSI-catcher" attack, where a fake base station could ask a phone for its IMSI and get it.

Inside the network, each interface keeps its own pair of identifiers for a UE's connection, one allocated by each end, so either side can look up the right context. On N2 (NGAP) that pair is the AMF UE NGAP ID plus the RAN UE NGAP ID; the identical pattern repeats on F1 (gNB-CU UE F1AP ID + gNB-DU UE F1AP ID) and on E1 (gNB-CU-CP UE E1AP ID + gNB-CU-UP UE E1AP ID) inside a split gNB.

Breaking down the 5G-GUTI

The 5G-GUTI deserves its own dissection because so many other identities are carved out of it. It answers two things at once: which AMF serves this UE (via the GUAMI) and which UE, temporarily (via the 5G-TMSI). Get this structure straight and 5G-S-TMSI, GUAMI, and the AMF sub-fields all fall out of it.

Add up the sub-fields and the arithmetic is worth carrying: the GUAMI is PLMN ID + 8 + 10 + 6 = 24 bits of AMF identity on top of the PLMN, the AMF ID proper is those 24 bits (Region + Set + Pointer), and the 5G-S-TMSI is exactly the 10 + 6 + 32 = 48 bits the local AMF set needs to route a page. The full 5G-GUTI then is the PLMN ID plus that AMF ID plus the 32-bit 5G-TMSI.

Network and cell identities

These name a cell, an area, or a network node rather than the UE. The recurring theme: the physical layer uses a small, locally-reused number the UE can read blind, while the network layer uses a globally-unique, PLMN-prefixed name for anything it must address unambiguously.

The gNB ID and cell part share the 36-bit NCI: an operator picks how many bits go to the gNB ID (say 24), leaving the rest (12 bits) to number cells under that gNB. Wrap the NCI with the PLMN and you get the NCGI, the name a neighbour gNB uses to request a handover target. The I-RNTI straddles two families: it is technically an RNTI (radio scope) but it also encodes which anchor gNB holds your context, which is why it is longer than a normal 16-bit RNTI and why it lives with the RRC_INACTIVE machinery alongside RANAC.

QoS and bearer identities

The last family names traffic, not the UE or the cell. When a UE opens a PDU session, its packets are sorted into QoS flows, mapped onto radio bearers, and matched to a slice and a data network. Each of those steps has its own identifier.

The mapping flows one way. An S-NSSAI and DNN select the slice and data network; inside the resulting PDU Session ID, the SMF creates QoS flows each tagged with a QFI and governed by a 5QI; the RAN then maps those flows (via SDAP) onto DRBs. Signalling rides SRBs in parallel. So a single packet can be described, top to bottom, by its slice (S-NSSAI), its data network (DNN), its session (PDU Session ID), its flow (QFI), its QoS profile (5QI), and its radio bearer (DRB ID). Standard 5QI values are worth anchoring: 1 = conversational voice (GBR), 5 = IMS signalling (non-GBR), 9 = default best-effort data, and 82–85 = delay-critical GBR for URLLC.

Summary

The whole zoo collapses once you sort by scope. Five families cover everything: core/subscription (SUPI, SUCI, 5G-GUTI, 5G-S-TMSI, PEI), radio (the 16-bit RNTIs), cell/area (PCI, NCI, NCGI, TAC/TAI, PLMN, GUAMI, RANAC, I-RNTI), interface (the paired NGAP/F1AP/E1AP IDs), and QoS/bearer (S-NSSAI, DNN, PDU Session ID, QFI, 5QI, DRB/SRB IDs).

Three heuristics predict the rest: a 16-bit, disposable label is an RNTI addressing the UE on the air by CRC-masking; a PLMN-prefixed, globally-unique label names a cell, area, or AMF; and a concealed or rotating label (SUCI, 5G-GUTI) exists to keep the permanent SUPI off the air. The 5G-GUTI is the keystone structure — GUAMI + 5G-TMSI — from which 5G-S-TMSI, GUAMI and the AMF sub-fields all derive.

Finally, keep the two classic mix-ups straight: QFI names a flow while 5QI describes its treatment; and PCI is a locally-reused physical-layer fingerprint while NCGI is the globally-unique network name for the same cell.