Mobile Equipment Identifier

A Mobile Equipment Identifier (MEID)
is a globally unique
number identifying a physical piece of CDMA
mobile station equipment. The number format
is defined by the 3GPP2 report S.R0048
but in
practical terms it can be seen as an IMEI
but with hexadecimal
digits.

An MEID is 56 bits
long (14 hex digits). It consists of three fields, including an 8-bit
regional code (RR), a 24-bit manufacturer code, and a 24-bit
manufacturer-assigned serial number. The check digit (CD) is not
considered part of the MEID.

The MEID was created to replace ESNs
, whose virgin form was
exhausted in November 2008 [1]
. As of TIA/EIA/IS-41
Revision D and TIA/EIA/IS-2000 Rev C, the ESN is still a required field
in many messages—for compatibility, devices with an MEID can use a
pseudo ESN (pESN), which is a manufacturer code of 0x80 (formerly
reserved) followed by the least significant 24 bits of the SHA-1
hash
of the MEID.^[
1]

[edit
]
Administration

The separation between International Mobile Equipment Identifiers
(IMEIs) used by GSM/UTMS and MEIDs is based on the number ranges. There
are two administrators: the Global Decimal Administrator (GDA) for IMEIs
and the Global Hexadecimal Administrator (GHA).

As of August 2006, the TIA acts as the Global Hexadecimal
Administrator (GHA) to assign MEID code prefixes (0xA0 and up), and the
GSM Association acts as the Global Decimal Administrator. http://www.babt.com/gsm-imei-number-allocation.asp

The middle ground between IMEIs and MEIDs is for inter-standard
"worldphone" devices. These devices will have all decimal digits and can
be allocated by any administration. Since they must have all decimal
digits the GHA has opened up the range '99' for these assignments. IMEI
administrators can just assign numbers for dual-technology phones out of
their existing ranges.

[edit
]
Display formats

There are two standard formats for MEIDs, and both can include an
optional check-digit. This is defined by 3GPP2 standard X.S0008
.

The hexadecimal form is specified to be 14 digits grouped together. A
check-digit can be calculated using a modified (base 16) Luhn
algorithm and appended to the end. The
check-digit is never transmitted or stored. It is intended to detect
most (but not all) input errors, it is not intended to be a checksum or
CRC to detect transmission errors. Consequently it may be printed on
phones or their packaging in case of manual entry of an MEID (e.g.
because there is no bar code or the bar code is unreadable).

The decimal form is specified to be 18 digits grouped in a 5 5 4 4
pattern and is calculated by converting the manufacturer code portion
(32 bits) to decimal and padding on the left with '0' digits to 10
digits and separately converting the serial number portion to decimal
and padding to 8 digits. A check-digit can be calculated from the result
using the standard base 10 Luhn
algorithm and appended to the
end.

[edit
]
pESN conflicts

Because the pESN is formed by a hash on the MEID there is the
potential for hash collisions. These will cause an extremely rare
condition known as a 'collision' on a pure ESN-only network as the ESN
is used for the calculation of the Public Long Code Mask (PLCM) used for
communication with the base-station. Two mobiles using the same pESN
within the same base-station area (operating on the same frequency) can
result in call setup and page failures.

The probability of a collision has been carefully examined ^[
2]


.
Roughly, it is estimated that even on a heavily loaded network the
frequency of this situation is closer to 1 out of 1 million calls than
to 1 out of 100 000.

3GPP2 specification C.S0072
provides a solution to
this problem by allowing the PLCM to be established by the base station.
It is easy for the base station to ensure that all PLCM codes are
unique when this is done. This specification also allows the PLCM to be
based on the MEID or IMSI
.

A different problem occurs when ESN codes are stored in a database
(such as for OTASP
). In this situation, the risk of at least
two phones having the same pseudo-ESN can be calculated using the birthday paradox
and works out to about
a 50 per cent probability in a database with 4,800 pseudo-ESN entries.
3GPP2 specifications C.S0016
(Revision C or higher)
and C.S0066
have been modified to
allow the replacement MEID identifier to be transmitted, resolving this
problem.

Another problem is that messages delivered on the forward paging
channel using the pESN as an address could be delivered to multiple
mobiles seemingly randomly. This problem can be avoided by using MIN
or IMSI
based addressing instead.

[edit
]
Code to convert

This short Python
script will convert an
MEID to a pESN.

import
 hashlib


meid = raw_input
(
"Enter an MEID: "
)
.upper
(
)



s = hashlib.sha1
(
meid.decode
(
'hex'
)
)

#decode the hex MEID (convert it to binary!)



pesn = "80"
 + s.hexdigest
(
)
[
-6
:]
.upper
(
)

#put the last 6 digits of the hash after 80


print
 "pESN: "
 + pesn

[edit
]
References

1. ^
   
   http://www.spirentcom.com/documents/3997.pdf
2. ^
   
   http://www.tiaonline.org/standards/resources/esn/documents/Collisions_pESN_wp.pdf
   Pellegrino G, Quick F. White Paper on Pseudo-ESN Collisions. TIA. 2005
   May 26.

[edit
]
External links

• Official TIA Resource Page for MEID
• PhoneScoop MEID article
• CDMA Development Group MEID resource page