3IWF is located in the same PLMN as the 3GPP access. However, if the UE is connected to the 3GPP access network of a PLMN and if it selects an N3IWF which is located in a different PLMN, then the UE will be served separately by two PLMNs. The UE is registered with two separate AMFs. The PDU ses- sions over 3GPP access are served by the visiting SMFs which are different from the ones serving the PDU sessions over the non-3GPP access. The UE establishes an IPsec tunnel 148 Chapter 1 with N3IWF in order to attach to the 5G core network over the untrusted non-3GPP access and is authenticated by and attached to the 5G core network during the IPsec tunnel estab- lishment procedure [3]. The network identifiers in 5G system are divided into subscriber identifiers and UE identi- fiers. Each subscriber in the 5G system is assigned a 5G subscription permanent identifier (SUPI) to use within the 3GPP system. The 5G system treats subscription identification independent of the UE identification. In that sense, each UE accessing the 5G system is assigned a permanent equipment identifier (PEI). The 5G system assigns a temporary identi- fier (5G-GUTI) to the UE in order to protect user confidentiality. The 5G network identi- fiers can be summarized as follows [3]: 5G Subscription Permanent Identifier is a global unique identifier that is assigned to each subscriber in the 5G system, which is provisioned in the UDM/UDR. The SUPI is used only within 3GPP system. The previous generations' IMSI68 and network access identifier (NAI)69 can still be used in 3GPP Rel-15 as SUPI. The use of generic NAI makes the use of non-IMSI-based SUPIs possible. The SUPI must contain the address of the home network in order to enable roaming scenarios. For interworking with the EPC, the SUPI allocated to the 3GPP UE is based on the IMSI. Furthermore, 5GS defines a subscription concealed identifier (SUCI) which is a privacy preserving identi- fier containing the concealed SUPI. Permanent Equipment Identifier is defined for a 3GPP UE accessing the 5G sy