Mobile equipment identifier

A mobile equipment identifier (MEID) is a globally unique number identifying a physical piece of CDMA mobile station equipment. The number format is defined by the 3GPP2 report S.R0048 but in practical terms, it can be seen as an IMEI but with hexadecimal digits.

An MEID is 56 bits long (14 hex digits). It consists of three fields, including an 8-bit regional code (RR), a 24-bit manufacturer code, and a 24-bit manufacturer-assigned serial number. The check digit (CD) is not considered part of the MEID.

The MEID was created to replace ESNs, whose virgin form was exhausted in November 2008.^[1] As of TIA/EIA/IS-41 Revision D and TIA/EIA/IS-2000 Rev C, the ESN is still a required field in many messages—for compatibility, devices with an MEID can use a pseudo ESN (pESN), which is a manufacturer code of 0x80 (formerly reserved) followed by the least significant 24 bits of the SHA-1 hash of the MEID.^[2]

Administration

The separation between international mobile equipment identifiers (IMEIs) used by GSM/UMTS and MEIDs is based on the number ranges. There are two administrators: the global decimal administrator (GDA) for IMEIs and the global hexadecimal administrator (GHA).

As of August 2006, the TIA acts as the GHA to assign MEID code prefixes (0xA0 and up), and the GSM Association acts as the global decimal administrator. http://www.babt.com/gsm-imei-number-allocation.asp

The TIA also allocates IMEI codes, specifically destined for dual-technology phones, out of the RR=99 range. Other administrators working under GSMA may also allocate any IMEI for use in dual-technology phones. Every IMEI can also be used as an MEID in CDMA2000 devices (as well as in single-mode devices designed with GSM or other 3GPP protocols) but MEID codes may also contain hexadecimal digits and this class of MEID codes cannot be used as an IMEI.

Display formats

There are two standard formats for MEIDs, and both can include an optional check-digit. This is defined by 3GPP2 standard X.S0008.

The hexadecimal form is specified to be 14 digits grouped together and applies whether all digits are in the decimal range or whether some are in the range 'A'-'F'. In the first case, all digits are in the range '0'-'9', the check-digit is calculated using the normal base 10 Luhn algorithm, but if at least one digit is in the range 'A'-'F' this check digit algorithm uses base 16 arithmetic. The check-digit is never transmitted or stored. It is intended to detect most (but not all) input errors, it is not intended to be a checksum or CRC to detect transmission errors. Consequently, it may be printed on phones or their packaging in case of manual entry of an MEID (e.g. because there is no bar code or the bar code is unreadable).

The decimal form is specified to be 18 digits grouped in a 5 5 4 4 pattern and is calculated by converting the manufacturer code portion (32 bits) to decimal and padding on the left with '0' digits to 10 digits and separately converting the serial number portion to decimal and padding on the left to 8 digits. A check-digit can be calculated from the 18 digit result using the standard base 10 Luhn algorithm and appended to the end. Note that to produce this form the MEID digits are treated as base 16 numbers even if all of them are in the range '0'-'9'.

pESN conflicts

Because the pESN is formed by a hash on the MEID there is the potential for hash collisions. These will cause an extremely rare condition known as a 'collision' on a pure ESN-only network as the ESN is used for the calculation of the Public Long Code Mask (PLCM) used for communication with the base-station. Two mobiles using the same pESN within the same base-station area (operating on the same frequency) can result in call setup and page failures.

The probability of a collision has been carefully examined.^[3] Roughly, it is estimated that even on a heavily loaded network the frequency of this situation is closer to 1 out of 1 million calls than to 1 out of 100 000.

3GPP2 specification C.S0072 provides a solution to this problem by allowing the PLCM to be established by the base station. It is easy for the base station to ensure that all PLCM codes are unique when this is done. This specification also allows the PLCM to be based on the MEID or IMSI.

A different problem occurs when ESN codes are stored in a database (such as for OTASP). In this situation, the risk of at least two phones having the same pseudo-ESN can be calculated using the birthday paradox and works out to about a 50 per cent probability in a database with 4,800 pseudo-ESN entries. 3GPP2 specifications C.S0016 (Revision C or higher) and C.S0066 have been modified to allow the replacement MEID identifier to be transmitted, resolving this problem.

Another problem is that messages delivered on the forward paging channel using the pESN as an address could be delivered to multiple mobiles seemingly randomly. This problem can be avoided by using mobile identification number (MIN) or IMSI based addressing instead.

Code to convert

This short Python script will convert an MEID to a pESN.

import hashlib
 
meid = raw_input("Enter an MEID: ").upper()
 
s = hashlib.sha1(meid.decode('hex'))
    #decode the hex MEID (convert it to binary!)
 
pesn = "80" + s.hexdigest()[-6:].upper()
    #put the last 6 digits of the hash after 80
 
print "pESN: " + pesn

The CDG also provides a javascript calculator with more conversion options.

References

1. ↑ "ESN Migration to MEID - Milestones & Timeline", The Telecommunications Industry Association (TIA), November 30, 2011
2. ↑ CDG Resources on MEID and EUIMID
3. ↑ Pellegrino G, Quick F. White Paper on Pseudo-ESN Collisions. TIA. 26 May 2005.

External links

• Official TIA Resource Page for MEID
• PhoneScoop MEID article
• CDMA Development Group MEID resource page