Section: 5.9.2 Subscription Permanent Identifier
Content: A globally unique 5G Subscription Permanent Identifier (SUPI) shall be allocated to each subscriber in the 5G System and provisioned in the UDM/UDR. The SUPI is used only inside 3GPP system, and its privacy is specified in TS 33.501[ Security architecture and procedures for 5G System ]  [29]. The SUPI may contain: - an IMSI as defined in TS 23.003[ Numbering, addressing and identification ]  [19], or - a network-specific identifier, used for private networks as defined in TS 22.261[ Service requirements for the 5G system ]  [2]. - a GLI and an operator identifier of the 5GC operator, used for supporting FN-BRGs, as further described in TS 23.316[ Wireless and wireline convergence access support for the 5G System  (5GS) ]  [84]. - a GCI and an operator identifier of the 5GC operator, used for supporting FN-CRGs and 5G-CRG, as further described in TS 23.316[ Wireless and wireline convergence access support for the 5G System  (5GS) ]  [84]. A SUPI containing a network-specific identifier shall take the form of a Network Access Identifier (NAI) using the NAI RFC 7542 [20] based user identification as defined in TS 23.003[ Numbering, addressing and identification ]  [19]. When UE needs to indicate its SUPI to the network (e.g. as part of the Registration procedure), the UE provides the SUPI in concealed form as defined in TS 23.003[ Numbering, addressing and identification ]  [19]. In order to enable roaming scenarios, the SUPI shall contain the address of the home network (e.g. the MCC and MNC in the case of an IMSI based SUPI). For interworking with the EPC, the SUPI allocated to the 3GPP UE shall always be based on an IMSI to enable the UE to present an IMSI to the EPC. The usage of SUPI for W-5GAN is further specified in TS 23.316[ Wireless and wireline convergence access support for the 5G System  (5GS) ]  [84].