The TMSI (Temporary Mobile Subscriber Identity) is a temporary identity created by the VLR and sent back encrypted to the phone; it replaces the IMSI in over-the-air exchanges and changes when the phone switches base station, preventing third parties from building a movement profile.

How it works:

1. The IMSI is required only at first registration with a base station (the network has to know who you really are once)
2. Afterward, the VLR (Visitor Location Register) assigns a TMSI — created locally, then encrypted and sent back to the mobile
3. When the phone changes base station, the TMSI changes too

The privacy payoff: because the over-the-air identity keeps changing and never reveals the permanent IMSI, a passive eavesdropper cannot link successive appearances to the same subscriber — no movement profile.

The weakness this implies: the protection only holds if the IMSI is truly sent rarely. An attacker who can force a phone to reveal its IMSI (by pretending to be a base station that "doesn't recognize" the TMSI) defeats the whole scheme — that is exactly what an IMSI catcher does.

Go deeper:

• Fangespielen mit IMSI-Catchern — oshie (CCC Camp 2019) — the practical attack that defeats TMSI privacy by forcing the phone to reveal its IMSI (German, English audio track available).
• IMSI-catcher (Wikipedia) — how a fake base station forces a phone to surrender its IMSI instead of the TMSI, defeating exactly this privacy scheme.

The arc is one long migration from circuit-switched, voice-only, multi-box networks toward a flat, all-IP, software-defined core — driven by the explosion of data traffic and the need for efficiency.

* 2G to 5G: from circuit-switched voice toward an all-IP, cloud-native core. *

A narration you could give out loud, generation by generation:

The "why" behind each step (the part that really matters):

• 2G→2.5G: the internet arrived. Operators needed packet data but couldn't afford to rip out their voice switches, so they ran a parallel packet network (SGSN/GGSN).
• 2.5G→3G: demand for faster data + better spectral efficiency drove a new radio (WCDMA). The core stayed two-domain because voice still needed guaranteed circuits.
• 3G→4G: data dwarfed voice. Reserving circuits for voice was wasteful, so everything went all-IP — even voice (VoLTE). The radio was flattened (RNC removed, its job pushed into the eNodeB) to cut latency, and control plane was separated from user plane so each can scale independently.
• 4G→5G: the core itself became cloud-native software (a service-based architecture, an SDN/NFV idea), enabling network slicing (virtual networks per use-case) and URLLC (ultra-reliable low latency). NSA reuses the 4G core for a fast start; SA delivers the full vision.

Two through-lines to remember: (1) transport steadily moved circuit→packet→all-IP; (2) the architecture steadily flattened and softwarized — fewer dedicated boxes, more general-purpose IP and cloud, control split from data.

Go deeper:

• Harald Welte — What happens on a protocol level when I switch on my phone? (CCC, 2018) — a live walk through the 2G/3G attach procedure that makes the early-generation network boxes concrete (the left half of this table).
• 5G Core — design principles, network elements & service-based architecture (WinInk) — picks up where the CCC talk stops, showing how the 4G→5G step turns the core into cloud-native software (the SBA / control-user-plane idea in the last table row).