ETSI GS PDL 027 V1.1.1 (2025-05)

Permisioned Distributed Ledger (PDL); Self-Sovereign Identity (SSI) in telecom networks

DGS/PDL-0027_SSI_Telecom Net

General Information

• Status: Not Published
• Technical Committee: PDL - Permissioned Distributed Ledger
• Current Stage: 12 - Citation in the OJ (auto-insert)
• Due Date: 09-Jun-2025
• Completion Date: 28-May-2025

Standards Content (Sample)

GROUP SPECIFICATION
Permissioned Distributed Ledger (PDL);
Self-Sovereign Identity (SSI) in telecom networks
Disclaimer
The present document has been produced and approved by the Permissioned Distributed Ledger (PDL) ETSI Industry
Specification Group (ISG) and represents the views of those members who participated in this ISG.
It does not necessarily represent the views of the entire ETSI membership.

2 ETSI GS PDL 027 V1.1.1 (2025-05)

Reference
DGS/PDL-0027_SSI_Telecom Net
Keywords
core network, distributed ledger, ID
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE

Tel.: [phone]  Fax: [phone]

Siret N° 348 623 562 00017 - APE 7112B
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° w061004871

Important notice
The present document can be downloaded from the
ETSI Search & Browse Standards application.
The present document may be made available in electronic versions and/or in print. The content of any electronic and/or
print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any
existing or perceived difference in contents between such versions and/or in print, the prevailing version of an ETSI
deliverable is the one made publicly available in PDF format on ETSI deliver repository.
Users should be aware that the present document may be revised or have its status changed,
this information is available in the Milestones listing.
If you find errors in the present document, please send your comments to
the relevant service listed under Committee Support Staff.
If you find a security vulnerability in the present document, please report it through our
Coordinated Vulnerability Disclosure (CVD) program.
Notice of disclaimer & limitation of liability
The information provided in the present deliverable is directed solely to professionals who have the appropriate degree of
experience to understand and interpret its content in accordance with generally accepted engineering or
other professional standard and applicable regulations.
No recommendation as to products and services or vendors is made or should be implied.
No representation or warranty is made that this deliverable is technically accurate or sufficient or conforms to any law
and/or governmental rule and/or regulation and further, no representation or warranty is made of merchantability or fitness
for any particular purpose or against infringement of intellectual property rights.
In no event shall ETSI be held liable for loss of profits or any other incidental or consequential damages.

Any software contained in this deliverable is provided "AS IS" with no warranties, express or implied, including but not
limited to, the warranties of merchantability, fitness for a particular purpose and non-infringement of intellectual property
rights and ETSI shall not be held liable in any event for any damages whatsoever (including, without limitation, damages
for loss of profits, business interruption, loss of information, or any other pecuniary loss) arising out of or related to the use
of or inability to use the software.
Copyright Notification
No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and
microfilm except as authorized by written permission of ETSI.
The content of the PDF version shall not be modified without the written authorization of ETSI.
The copyright and the foregoing restriction extend to reproduction in all media.

© ETSI 2025.
All rights reserved.
ETSI
3 ETSI GS PDL 027 V1.1.1 (2025-05)
Contents
Intellectual Property Rights . 6
Foreword . 6
Modal verbs terminology . 6
1 Scope . 7
2 References . 7
2.1 Normative references . 7
2.2 Informative references . 7
3 Definition of terms, symbols and abbreviations . 8
3.1 Terms . 8
3.2 Symbols . 9
3.3 Abbreviations . 9
4 Telecom Network Identity Solution Overview . 10
4.1 General Information . 10
4.2 Identity Solutions in the Previous Generations of Telecom Networks . 10
4.3 Recent Trends . 11
5 Key Issues of current Telecom Network Identity Systems . 11
5.1 General Information . 11
5.2 Key Issue#1: Lack of identity attribute extension . 11
5.3 Key Issue#2: Lack of cross-domain authentication . 11
5.4 Key Issue#3: Derived identity challenges . 12
5.5 Key Issue#4: Difficulty achieving attribute-based service authorization . 12
5.6 Key Issue#5: Identity roaming . 12
5.7 Key Issue#6: Dynamic/On-demand network access and service onboarding . 12
5.8 Summary . 13
6 User-Centric Identity (UCDID) for Telecom Networks . 13
6.1 Overview . 13
6.2 UCDID Design . 13
6.2.1 UCDID structure . 13
6.2.1.1 Introduction . 13
6.2.1.2 Identifier . 14
6.2.1.3 Profile . 14
6.2.1.3.1 General information . 14
6.2.1.3.2 Document . 14
6.2.1.3.3 Verifiable Credential . 15
6.2.1.4 UCDID composition . 16
6.3 Telecom-Native UCDID System . 17
6.3.1 The concept of multi-domain trust . 17
6.3.2 UCDID PDL service in telecom networks . 17
6.3.3 Proposed Telecom-native UCDID service architecture . 18
6.3.3.1 General Information . 18
6.3.3.1.1 IDM (Identity Credential Management function) . 18
6.3.3.1.2 dSPR (decentralized Shared Profile Repository) . 18
6.3.3.2 Single domain UCDID service architecture . 18
6.3.3.2.1 Diagram . 18
6.3.3.2.2 UE context . 19
6.3.3.2.3 NF context . 19
6.3.3.3 Multi-domain UCDID service architecture . 20
7 UCDID-based Service Procedures . 21
7.1 UCDID Management . 21
7.1.1 UCDID profile publication . 21
7.1.2 UCDID profile publication with additional UE credential authentication . 21
7.1.3 UCDID cross-domain synchronization . 22
ETSI
4 ETSI GS PDL 027 V1.1.1 (2025-05)
7.2 Credentials Management . 23
7.2.1 Key credential application . 23
7.2.1.1 General information . 23
7.2.1.2 Application of asymmetric key credential . 23
7.2.1.3 Application of symmetric key credential . 25
7.2.2 Application of attribute credential . 25
7.3 Authentication . 26
7.3.1 General introduction . 26
7.3.2 UE authentication procedure. 27
7.3.3 Decentralized identifier-based authentication for network service Onboarding . 28
7.4 UE Authorization . 30
7.5 Credential Circulation . 31
7.5.1 Global Issuer List . 31
7.5.2 UCDID Migration among different dSPR regions. 32
8 Security Aspect . 34
9 Conclusion . 34
Annex A (informative): W3C Decentralized Identity (DID) . 35
Annex B (informative): Comparison of telecom UCDID and W3C DID . 36
Annex C (informative): European Blockchain Services Infrastructure (EBSI) . 38
History . 39

ETSI
5 ETSI GS PDL 027 V1.1.1 (2025-05)
List of Tables
Table 1: Attributes in the document element of a UCDID .15
Table 2: Data fields of a verifiable credential for telecom-native UCDID .15
Table 3: Symmetric key fields .25
Table B.1: Field attributes defining UCDID .36

List of Figures
Figure 1: A general structure of UCDID for telecom networks .14
Figure 2: Service architecture supporting telecom-native UCDID in a single domain .18
Figure 3: Service architecture supporting telecom-native UCDID in multiple domain .20
Figure 4: UCDID publishing procedure .21
Figure 5: UCDID publishing with authentication procedure .21
Figure 6: Synchronization procedure between two dSPRs .22
Figure 7: Key credential generation procedure .24
Figure 8: Symmetric key generation procedure .25
Figure 9: Attribute credential application procedure .26
Figure 10: UE registration and authentication procedure with UCDID .27
Figure 11: On-demand/dynamic network service access based on Decentralized Identifier authentication .29
Figure 12: Attribute-Based Authorization (ABA) .30
Figure 13: Attribute-based authorization procedure .31
Figure 14: Global issuer list on dSPRs in two different regions .31
Figure 15: UCDID migration procedure .32

ETSI
6 ETSI GS PDL 027 V1.1.1 (2025-05)
Intellectual Property Rights
Essential patents
IPRs essential or potentially essential to normative deliverables may have been declared to ETSI. The declarations
pertaining to these essential IPRs, if any, are publicly available for ETSI members and non-members, and can be
found in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to
ETSI in respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the
ETSI IPR online database.
Pursuant to the ETSI Directives including the ETSI IPR Policy, no investigation regarding the essentiality of IPRs,
including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not
referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become,
essential to the present document.
Trademarks
The present document may include trademarks and/or tradenames which are asserted and/or registered by their owners.
ETSI claims no ownership of these except for any which are indicated as being the property of ETSI, and conveys no
right to use or reproduce any trademark and/or tradename. Mention of those trademarks in the present document does
not constitute an endorsement by ETSI of products, services or organizations associated with those trademarks.
DECT™, PLUGTESTS™, UMTS™ and the ETSI logo are trademarks of ETSI registered for the benefit of its
Members. 3GPP™, LTE™ and 5G™ logo are trademarks of ETSI registered for the benefit of its Members and of the
3GPP Organizational Partners. oneM2M™ logo is a trademark of ETSI registered for the benefit of its Members and of ®
the oneM2M Partners. GSM and the GSM logo are trademarks registered and owned by the GSM Association.
Foreword
This Group Specification (GS) has been produced by ETSI Industry Specification Group (ISG) Permissioned
Distributed Ledger (PDL).
Modal verbs terminology
In the present document "shall", "shall not", "should", "should not", "may", "need not", "will", "will not", "can" and
"cannot" are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of
provisions).
"must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation.

ETSI
7 ETSI GS PDL 027 V1.1.1 (2025-05)
1 Scope
The present document aims to specify the technical requirements and solutions based on PDL to build a native User
Centric Digital IDentity (UCDID) system under the constraints of telecom networks so that a user, an organization or a
network entity with such an identity can access network services among different operators and service providers
seamlessly. Specifically, the present document delivers specifications in the following aspects:
1) Methods of lifecycle management of the SSI associated with a user device/a network node of a telecom
network.
2) Architecture changes for realizing the new identity system natively in a telecom network.
3) Revisions to legacy service procedures and new service procedure design based on the proposed identity
framework.
The present document specifies how a self-sovereign identity, called User-Centric Digital Identity (UCDID) can be
supported in a telecom network.
2 References
2.1 Normative references
References are either specific (identified by date of publication and/or edition number or version number) or
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the
referenced document (including any amendments) applies.
Referenced documents which are not found to be publicly available in the expected location might be found in the
ETSI docbox.
NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee
their long-term validity.
The following referenced documents are necessary for the application of the present document.
[1] ETSI GS PDL 023 (V1.1.1): "PDL service enablers for Decentralized Identification and Trust
Management".
[2] ETSI GS PDL 024 (V1.1.1): "Permissioned Distributed Ledgers (PDL); Architecture
enhancements for PDL service provisioning in telecom networks".
2.2 Informative references
References are either specific (identified by date of publication and/or edition number or version number) or
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the
referenced document (including any amendments) applies.
NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee
their long term validity.
The following referenced documents may be useful in implementing an ETSI deliverable or add to the reader's
understanding, but are not required for conformance to the present document.
[i.1] ETSI TR 122 904 (V18.0.1): "5G; Study on user-centric identifiers and authentication (3GPP
TR 22.904 version 18.0.1 Release 18)".
[i.2] 3GPP TR 23.700-32 (V1.0.0): "Study on User Identities and Authentication Architecture".
[i.3] 3GPP TR 33.700-32 (V0.2.0): "Study on the security aspects for usage of user identifiers in the 5G
system".
ETSI
8 ETSI GS PDL 027 V1.1.1 (2025-05)
[i.4] Dumortier J., 2017: "Regulation (EU) No 910/2014 on electronic identification and trust services
for electronic transactions in the internal market (eIDAS Regulation)". In EU Regulation of
E-Commerce (pp. 256-289). Edward Elgar Publishing.
[i.5] 3GPP TR 22.844 (V18.2.0): "Study on 5G Networks Providing Access to Localized Services".
[i.6] GSMA: "Blockchain for Development: Emerging Opportunities for Mobile, Identity and Aid",
2017.
[i.7] Europa Futurium: "eIDAS Supported Self-Sovereign Identity", 2019.
[i.8] NGMN Alliance: "6G Trustworthiness Considerations", 2023. ®
[i.9] W3C Recommendation 19 July 2022: "Decentralized Identifiers (DIDs) v1.0".
[i.10] Berners-Lee, Tim, Roy Fielding and Larry Masinter: "Uniform resource identifier (URI): Generic
syntax". No. rfc3986. 2005.
[i.11] IETF draft-irtf-cfrg-bbs-signatures-07: "The BBS Signature Scheme", Tobias Looker, Vasilis
Kalos, Andrew Whitehead and Mike Lodder, Internet Engineering Task Force, September 2024.
Work in Progress.
3 Definition of terms, symbols and abbreviations
3.1 Terms
Attribute-Based Authorization (ABA): method of access control where access decisions are based on attributes
associated with subjects, resources, actions, or the environment rather than the identity of the subject
Attribute Credential (AC): set of claims about an identity subject that represent either long-lasting properties (e.g.
date-of-birth) or temporal properties (e.g. current location) that are signed by an issuer
Decentralized Identifier (DID): new type of identifier that enables verifiable, decentralized digital identity, designed
to be decoupled from centralized registries, identity providers, and certificate authorities
decentralized Shared Profile Repository (dSPR): distributed storage system for identity profiles that enables secure
sharing of identity information across multiple domains or authorities
electronic Identification, Authentication and Trust Services (eIDAS): regulation that provides a regulatory
environment for electronic identification and trust services for electronic transactions in the EU internal market
Global Issuer List (GIL): registry of trusted credential issuers whose digital identities and public keys are recognized
across multiple systems or domains to enable cross-domain verification
IDentity Management (IDM): processes and technologies involved in the management of digital identities, including
creation, authentication, and authorization
Key Credential (KC): cryptographic credential used for authentication, which can be either symmetric (shared secret)
or asymmetric (public-private key pair)
Permissioned Distributed Ledger (PDL): type of distributed ledger where access is restricted to a specific list of
identified participants, providing a shared database with higher transaction privacy
Self-Sovereign Identity (SSI): identity system where individuals or organizations have sole ownership of their digital
identities and control how their personal data is shared and used
Subscription Concealed Identifier (SUCI): encrypted form of the SUPI that protects user privacy by preventing
transmission of the permanent identifier over the air interface
Subscription Permanent Identifier (SUPI): globally unique 5G identifier assigned to each subscriber that
permanently identifies the subscriber's home network and account
ETSI
9 ETSI GS PDL 027 V1.1.1 (2025-05)
Trust Service Provider (TSP): entity that provides one or more trust services, such as electronic signatures, electronic
seals, or website authentication
User-Centric Digital Identity (UCDID): identity system where users control their identifiers and credential
information, with the ability to selectively disclose information to different service providers
Verifiable Credential (VC): tamper-evident credential with authorship that can be cryptographically verified,
containing claims about a subject issued by an entity. It was defined in W3C Verifiable Credentials Data Model 1.0
3.2 Symbols
Void.
3.3 Abbreviations
For the purposes of the present document, the following abbreviations apply:
ABA Attribute-Based Authorization
AC Attribute Credential
AF Application Function
AI Artificial Intelligence
AKA Authentication and Key Agreement
AMF Access and Mobility Function
AUSF Authentication Server Function
CA Certificate Authority
CRL Certificate Revocation List
DL Distributed Ledger
DLE Distributed Ledger Enabler
dSPR decentralized Shared Profile Repository
ECDH Elliptic Curve Diffie--Hellman
ECDHE Elliptic Curve Diffie-Hellman Ephemeral
eIDAS electronic IDentification, Authentication and trust Services
ESN Equipment Serial Number
GIL Global Issuer List
GSMA Global System for Mobile Communication Association
GSMC Global System for Mobile Communication
IDM IDentity Management
IMEI International Mobile Equipment Identity
IMPI IP Multimedia Private Identity
IMSI International Mobile Subscriber Identity
IoT Internet-of-Thing
KC Key Credential
KYC Know Your Customer
MIN Mobile Identification Number
MNO Mobile Network Operator
NAS Non-Access Stratum
NF Network Function
PDL Permissioned Distributed Ledger
PLMN Public Land Mobile Network
SEAF SEcurity Anchor Function
SEPP Security and Edge Protection Proxy
SIM Subscriber Identity Module
SPR Shared Publish Repository
SSI Self-Sovereign Identity
SUCI Subscription Concealed Identifier
SUPI Subscription Permanent Identifier
TSP Trust Service Provider
UCDID User-Centric Digital IDentity
UDM Unstructured Data Management
UICC Universal Integrated Circuit Card
ETSI
10 ETSI GS PDL 027 V1.1.1 (2025-05)
USIM Universal Subscriber Identity Module
UUID Unique Universal IDentifier
VC Verifiable Credential
WCDMA Wideband Code Division Multiple Access
4 Telecom Network Identity Solution Overview
4.1 General Information
Identity system is a necessity for accessing any system. For a telecom network, a user has to submit its personal data
and create a user profile in the operator's database where the operator binds a Subscription Permanent Identifier (SUPI)
with the user profile. This SUPI will be provisioned in an (either physical or electronic) UICC card issued to the user.
The user will use this identity (provisioned in a UE) to access the operator's network. The user profiles and bindings
with SUPIs are created, maintained and managed in a centralized place (e.g. in a network operator's database) while the
end users only have the right to hold and use the accounts (identities). The unique identifiers for users in telecom
networks have undergone significant evolution from 1G to 5G, driven by technological advancements and increasing
security demands. These identifiers are essential not only for identifying users and devices but also for authentication,
authorization, and privacy protection.
4.2 Identity Solutions in the Previous Generations of Telecom
Networks
In 1G networks, each mobile phone has an Equipment Serial Number (ESN), and the operator assigns a unique Mobile
Identification Number (MIN) to each subscriber. The combination of ESN and MIN is used to identify the user and the
device.
In 2G networks, represented by Global System for Mobile Communications (GSMCs), an innovative concept of
separating the mobile phone from the SIM card (Subscriber Identity Module) was introduced. The SIM card stores the
International Mobile Subscriber Identity (IMSI), which uniquely identifies the subscriber and is used for authentication
and authorization when accessing the mobile communication network.
In 3G networks, represented by Wideband Code Division Multiple Access (WCDMA), the SIM card was upgraded to
Universal Subscriber Identity Module (USIM) to support mutual authentication between the terminal and the network.
The terminal equipment identifier remains International Mobile Equipment Identity (IMEI) and the subscriber identifier
remains as IMSI.
In 4G-LTE networks, the circuit-switched domain ceased to evolve, and the IP Multimedia Subsystem (IMS) domain
took over audio and video services. Within the IMS domain, the IP Multimedia Private Identity (IMPI) uniquely
identifies the subscriber and is used for registration, authorization, management, and accounting purposes. The IMPI
adopts the Network Access Identifier (NAI) format, and the IMSI can be included in the IMPI's NAI.
In 5G networks, SUPI was introduced and is equivalent to the IMSI in LTE, using the same format. However, to
enhance privacy protection, the SUPI is not transmitted over the air interface unencrypted. Instead, the Subscription
Concealed Identifier (SUCI), which contains the encrypted SUPI, is transmitted over the air, thereby improving user
identity privacy protection.
From 1G to 5G, the user identifiers in mobile communication networks have evolved from simple device serial numbers
and mobile identification numbers to more complex and secure identification systems such as IMSI, USIM, IMPI,
SUPI, and SUCI. This evolution has not only improved the accuracy and security of user identification but also
enhanced privacy protection, ensuring the security and reliability of modern mobile communication networks.
ETSI
11 ETSI GS PDL 027 V1.1.1 (2025-05)
4.3 Recent Trends
The operation and service models of current telecom networks are heading towards diversification of their offered
services according to customized requirements from different users [i.1]. Specifically, with the same subscription
(tariff) plan, users will experience differential service based on their requests. For example, assuming a father has a
mobile phone with a subscription from an operator, and his son wants to use his father's phone to access the Internet; in
another example, a guest may want to use the father phone with the same subscription (tariff) plan. The service policy
should be different for each of those three users (father, son, guest). The service policy for the son should consider
limiting access to certain content types while the service policy for the father's friend (guest) should consider to limiting
speed and placing a cap on the data volume consumption.
This new feature is under intensive and extensive study in 3GPP Release-19 with two Study Item Descriptions (SIDs).
The first SID is titled "Study on User Identities and Authentication Architecture", which will be delivered as 3GPP
TR 23.700-32 [i.2]; and the second SID is titled "Study on security aspects of User Identities and Authentication",
which will be delivered as 3GPP TR 33.700-32 [i.3]. The major enhancement is that 3GPP networks will store not only
a UE subscription profile, but also one or more User Identity Profiles (UIPs), in the core network functions (e.g. User
Data Management (UDM)). A UIP describes a user with attributes, among which one mandatory attribute is a linkage to
at least one UE's Subscription Permanent Identifier (SUPI).
5 Key Issues of current Telecom Network Identity
Systems
5.1 General Information
The existing centralized identity systems have been used for several decades. Such centralized identity systems are
facing the following challenges/key issues.
5.2 Key Issue#1: Lack of identity attribute extension
In current telecommunication services, (social) attributes of a user cannot be associated with the subscriber's identifier
(e.g. mobile phone number). In other words, the mobile phone number of a subscriber cannot reflect any real-world
attribute of that user. In reality, for example, a phone number cannot be verified as a credential of the social role of the
mobile phone user (e.g. is the person calling and claiming they have a package to deliver is indeed a parcel delivery
person?), unless the express delivery service provider unilaterally informed the recipient of the package of the phone
number of the delivery person and endorsed its role. The service consumer needs to trust the claim purely based on the
trust to the reputation of the express delivery service provider. However, if the telecom network operator can endorse
and certify that a mobile phone number does belong to a staff member of an authentic express delivery company, when
a recipient gets a message that a parcel is being delivered, the user will feel more confident with the credibility of the
delivery service.
In general, if the identifier can be easily extended to contain attributes that are provided either directly by the telecom
rd
network operator or a 3 party and are cryptographically verifiable, it will not only improve the users' experience, but
also turn the reputation of an operator into business value.
5.3 Key Issue#2: Lack of cross-domain authentication
Currently different identity systems operate independently. The identities for such systems are maintained separately
and authenticated separately. For example, when users access the Internet they need to maintain multiple account
registrations and manage passwords for different services. Each ICT service registration requires entering personal data,
and it is impossible to determine whether each service provider (e.g. social network, video streaming or online
shopping) guarantees the security and privacy protection and properly prevents information leakage of user information.
Although there are many consortiums formed to mitigate this issue, their interoperations are managed offline and the
identities created are still handled centrally by a handful of giant tech companies (e.g. use email and password as
account credential to log into a third party service). Achieving a unified set of digital identities that can be used across
both 3GPP and non-3GPP platforms is a key issue. Cross-domain authentication will reduce the cost and security risks
associated with user identity management while ensuring user privacy.
ETSI
12 ETSI GS PDL 027 V1.1.1 (2025-05)
5.4 Key Issue#3: Derived identity challenges
With the development of advanced application scenarios (such as digital human, AI agent and other businesses), a
single user can have multiple digital avatars in cyberspace, which are used to access different services and perform
different tasks for various purposes. The current identity system where only one identity can be created for one user
cannot easily handle such scenarios. For example, as already described in the recent 3GPP use case [i.1], different users
have to be able to share one UE subscription. To improve user experience, settings of operator deployed services should
automatically change according to the activated profile of such user. This way, non-3GPP devices (e.g. one or more IoT
or wearable devices) that do not own a subscription can still enjoy the mobile network service by using a UE as a
gateway and sharing the subscription of the gateway UE. Currently it is challenging to derive multiple identities from
one root identity to access the network service using existing identity system.
5.5 Key Issue#4: Difficulty achieving attribute-based service
authorization
Current telecom networks face challenges in implementing attribute-based service authorization due to the limitations
of existing identity systems. The centralized nature of these systems makes it difficult to incorporate and verify diverse
user attributes from various sources. This hinders the ability to provide personalized and context-aware services based
on specific user characteristics or credentials. As a result, service providers struggle to offer granular access control and
tailored experiences, limiting the potential for innovative and secure service delivery in telecom networks.
5.6 Key Issue#5: Identity roaming
Identity roaming in current telecom networks presents significant challenges. As users move between different network
domains or operators, their identity information often fails to seamlessly transfer, leading to service disruptions and
authentication issues. This problem is exacerbated by the lack of standardized protocols for identity sharing across
diverse network infrastructures. Consequently, users may experience difficulties accessing services or maintaining
consistent authentication status when transitioning between networks. The absence of efficient identity roaming
mechanisms not only impacts user experience but also complicates network management and security enforcement
across multiple domains. Addressing this issue requires developing robust, interoperable solutions that can securely and
efficiently propagate identity information across various network boundaries while maintaining user privacy and
adhering to regulatory requirements.
5.7 Key Issue#6: Dynamic/On-demand network access and
service onboarding
Currently devices without subscription credentials, are given default credentials by the device manufacturer and are
used to facilitate initial network access for onboarding. The network operator (e.g. a hosting network) holds service
level agreements with the device manufacturers to allow such devices to access (on-board) the network using the default
credentials for authentication purpose. Upon successful onboarding, a device will be provisioned with the actual
network operators' subscription credentials to allow connection with the network. Since the devices comes with static
default credentials, if such credentials are compromised (e.g. in the supply chain) they are susceptible to serious threats
such as device hijack, service hijack (by using cached credentials) and others. Other scenarios that require on-demand
network access can include localized network service at large sports event/cultural festivals/short travel, where the
rd
network operator provides operator/3 party services using a hosting network that the user has no network subscription
to. E.g. a user landing at an airport for business visit or going on a cruise for vacation requires a short-term network
subscription to access the network services [i.5]. In such scenarios, using the legacy Know Your Customer (KYC)
rd
verification will be time consuming and prone to sensitive identity document data leakage risk at 3 party premise
during the identity verification process for KYC [i.6]. In such scenarios, blockchain can play a significant role in
establishing the initial trust between the UE and the network service provider. E.g. the principles of electronic
Identification, Authentication and Trust Services (eIDAS) framework can be leveraged to allow the user to create a
digital identifier and corresponding service-specific access credentials in real-time to enable onboarding to the network
[i.4], [i.7] and [i.8]. Therefore, it is mandatory to enable sufficient user-controlled privacy approaches such as
user-controlled identifier and credentials generation that can be used for secure onboarding to the network. As Digital
identities and credentials can be generated in a user-controlled manner and used based on user demand, decentralized
identification and authentication becomes a promising enabler for authentication during dynamic network service
onboarding and on demand network service provisioning.
ETSI
13 ETSI GS PDL 027 V1.1.1 (2025-05)
5.8 Summary
Given the key issues listed above, telecom networks require a new/enhanced identity system with the following key
features as a minimum:
1) A multi-party trust platform: Traditional telecommunications network identities are created by operators
and issued to users, such as SUPI provisioned in a UICC card, resulting in trust being established solely
between users and their contracted operators. Instead, a decentralized trust foundation based on a consortium
(possibly using PDL technology) is required where the consortium consists of organizations such as operators,
service providers, device vendors, SIM card vendors, and social institutions. Identities issued by one
consortium participant can be authenticated by other participants in the consortium in a peer-to-peer manner,
enabling users' identities to be universally (or rather consortium-wide) recognized and authenticated.
2) Identity definition extension: User identity cannot be just a string label (identifier); instead, an identity has to
be able to digitally characterize and represent a subject behind its identity. This means that an identity needs to
correspond to description data which can be uniquely identified (e.g. with an identifier). The description data
contains a range of Verifiable Credentials (VCs). These VCs have to be easily identifiable and verifiable.
3) User-controlled: Users retain control over their identity information, which can be managed and maintained
using a digital asset container (e.g. a digital wallet). With an asset container, a user has multiple ways to create
one or more identities that are under its full control, each of which includes both a unique identifier string label
and a description with attributes of the subject behind the identity. These identities can be used selectively for
diff
...