Video narration
When your phone joins a network, how does it identify you without sending your permanent identity in the clear? The network needs to find your subscription, but that does not mean your SUPI, your permanent subscriber identity, must travel openly. With a non-null protection scheme, the UE uses the home network's public key to create a SUCI, a concealed form of the SUPI. At the home network, the UDM's SIDF, its identity-recovery function, uses the matching private key to recover the SUPI. That private key belongs to the home network, not the UE. A null protection scheme is also possible, so concealment is not guaranteed. And SUCI is not authentication: it conceals identity, but does not prove who is using the phone. So what does your phone send? A SUCI formed with the home network's public key; its SIDF recovers the SUPI with the matching private key.