RFC 7254 INFORMATIONAL IDENTIFIERS · MOBILE EQUIPMENT · URN

GSMA IMEI URN: A Uniform Resource Name Namespace for the Global System for Mobile Communications Association (GSMA) and the International Mobile station Equipment Identity (IMEI)

A standard web-style name for the serial number that identifies a mobile phone.

On rfc-editor.org ↗
PUBLISHED
May 2014
AUTHORS
M. Montemurro, A. Allen, D. McDonald, P. Gosden
STREAM
IETF
IMEI LENGTH
15 decimal digits
IMEISV LENGTH
16 decimal digits
TYPE ALLOCATION CODE (TAC)
8 digits, identifies model
SERIAL NUMBER (SNR)
6 digits, unique per TAC
NAMESPACE ID (NID)
gsma
NAMESPACE SPECIFIC STRING (NSS)
imei
DOI
10.17487/RFC7254
ERRATA
Reported errata

RFC text

Contents
Original text · RFC Editor View on rfc-editor.org ↗
Internet Engineering Task Force (IETF)                M. Montemurro, Ed.
Request for Comments: 7254                                      A. Allen
Category: Informational                                       Blackberry
ISSN: 2070-1721                                              D. McDonald
                                                                  Eircom
                                                               P. Gosden
                                                         GSM Association
                                                                May 2014


                   A Uniform Resource Name Namespace
   for the Global System for Mobile Communications Association (GSMA)
     and the International Mobile station Equipment Identity (IMEI)

Abstract

   This specification defines a Uniform Resource Name (URN) namespace
   for the Global System for Mobile Communications Association (GSMA)
   and a Namespace Specific String (NSS) for the International Mobile
   station Equipment Identity (IMEI), as well as an associated parameter
   for the International Mobile station Equipment Identity and Software
   Version number (IMEISV).  The IMEI and IMEISV were introduced as part
   of the specification for the GSM and are also now incorporated by the
   3rd Generation Partnership Project (3GPP) as part of the 3GPP
   specification for GSM, Universal Mobile Telecommunications System
   (UMTS), and 3GPP Long Term Evolution (LTE) networks.  The IMEI and
   IMEISV are used to uniquely identify Mobile Equipment within these
   systems and are managed by the GSMA.  URNs from this namespace almost
   always contain personally identifiable information and need to be
   treated accordingly.

Status of This Memo

   This document is not an Internet Standards Track specification; it is
   published for informational purposes.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Not all documents
   approved by the IESG are a candidate for any level of Internet
   Standard; see Section 2 of RFC 5741.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc7254.

Copyright Notice

   Copyright (c) 2014 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

   This document may contain material from IETF Documents or IETF
   Contributions published or made publicly available before November
   10, 2008.  The person(s) controlling the copyright in some of this
   material may not have granted the IETF Trust the right to allow
   modifications of such material outside the IETF Standards Process.
   Without obtaining an adequate license from the person(s) controlling
   the copyright in such materials, this document may not be modified
   outside the IETF Standards Process, and derivative works of it may
   not be created outside the IETF Standards Process, except to format
   it for publication as an RFC or to translate it into languages other
   than English.

Table of Contents

   1. Introduction ....................................................3
   2. Terminology .....................................................4
   3. Namespace Registration Template .................................4
   4. Specification ...................................................8
      4.1. IMEI Parameters ............................................8
      4.2. IMEI Format ................................................9
           4.2.1. Type Allocation Code (TAC) ..........................9
           4.2.2. Serial Number (SNR) .................................9
           4.2.3. Spare ..............................................10
           4.2.4. Binary Encoding ....................................10
      4.3. IMEISV Format .............................................10
           4.3.1. Type Allocation Code (TAC) .........................10
           4.3.2. Serial Number (SNR) ................................11
           4.3.3. Software Version Number (SVN) ......................11
           4.3.4. Binary Encoding ....................................11
   5. Community Considerations .......................................11
   6. Namespace Considerations .......................................12
   7. IANA Considerations ............................................12
   8. Security and Privacy Considerations ............................12
   9. Acknowledgements ...............................................14
   10. References ....................................................14
      10.1. Normative References .....................................14
      10.2. Informative References ...................................15

1.  Introduction

   This specification defines a Uniform Resource Name (URN) namespace
   for the Global System for Mobile Communications Association (GSMA)
   and a Namespace Specific String (NSS) for the International Mobile
   station Equipment Identity (IMEI), as well as an associated parameter
   for the International Mobile station Equipment Identity and Software
   Version number (IMEISV) as per the namespace registration requirement
   found in RFC 3406 [1].  The Namespace Identifier (NID) 'gsma' is for
   identities used in GSM, Universal Mobile Telecommunications System
   (UMTS), and Long Term Evolution (LTE) networks.  The IMEI and the
   IMEISV are managed by the GSMA, so this NID is managed by the GSMA.
   While this specification currently defines only the 'imei' NSS under
   the 'gsma' NID, additional NSS under the 'gsma' NID may be specified
   in the future by the GSMA, using the procedure for URN NSS changes
   and additions (currently through the publication of future
   Informational RFCs approved by IETF consensus).

   The IMEI is 15 decimal digits long and includes a Type Allocation
   Code (TAC) of 8 decimal digits and a Serial Number (SNR) of 6 decimal
   digits plus a Spare decimal digit.  The TAC identifies the type of
   the Mobile Equipment and is chosen from a range of values allocated
   to the Mobile Equipment manufacturer in order to uniquely identify
   the model of the Mobile Equipment.  The SNR is an individual serial
   number that uniquely identifies each Mobile Equipment device within
   the TAC.  The Spare digit is used as a Check digit to validate the
   IMEI and is always set to the value 0 when transmitted by the Mobile
   Equipment.

   The IMEISV is 16 decimal digits long and includes the TAC and SNR,
   same as for the IMEI, but also includes a 2 decimal digit Software
   Version Number (SVN), which is allocated by the Mobile Equipment
   manufacturer to identify the software version of the Mobile
   Equipment.

   The information here is meant to be a concise guide for those wishing
   to use the IMEI and IMEISV as URNs.  Nothing in this document should
   be construed to override 3GPP Technical Specification (TS) 23.003
   [2], which specifies the IMEI and IMEISV.

   The GSMA is a global trade association representing nearly 800 mobile
   phone operators across 220 territories and countries of the world.
   The primary goals of the GSMA are to ensure that mobile phones and
   wireless services work globally and are easily accessible.  Further
   details about the GSMA's role in allocating the IMEI and the IMEISV,
   as well as the IMEI and IMEISV allocation guidelines, can be found in
   GSMA Permanent Reference Document (PRD) TS.06 [3].

2.  Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in RFC 2119 [4].

3.  Namespace Registration Template

   Namespace ID:  'gsma'

   Registration Information:

   Registration version number:  1

   Registration date:  2014-01-12
   Declared registrant of the namespace:

   Registering organization:

   Name:  GSM Association

   Address:  1st Floor, Mid City Place,

      71 High Holborn, London, England

   Designated contact person:

   Name:  Paul Gosden

   Coordinates:  pgosden@gsma.com

   Declaration of syntactic structure:

      The identifier is expressed in American Standard Code for
      Information Interchange (ASCII) characters and has a hierarchical
      structure expressed using the Augmented Backus-Naur Form (ABNF)
      defined in RFC 5234 [5], as follows:

         gsma-urn              = "urn:" gsma-NID ":" gsma-NSS
         gsma-NID              = "gsma"
         gsma-NSS              = imei-specifier / future-gsma-specifier
         imei-specifier        = "imei:" ( imeival / ext-imei )
                                              [ ";" sw-version-param ]
                                              [ ";" imei-version-param ]
         ext-imei = gsma-defined-nonempty ;GSMA defined and
                                          ;IETF consensus
                                          ;required
         sw-version-param      = "svn=" software-version
         imei-version-param    = "vers=" imei-version-val
         software-version      = 2DIGIT
         imei-version-val      = DIGIT
         future-gsma-specifier = future-specifier
                                           *( ";" future-param )
         future-specifier      = gsma-defined-nonempty ;GSMA defined

         future-param          = par-name [ EQUAL par-value ]
         par-name              = gsma-defined-nonempty
         par-value             = gsma-defined-nonempty
         EQUAL                 = "="
         gsma-defined-nonempty = 1*gsma-urn-char
         gsma-urn-char         = ALPHA / DIGIT
                                 / "-" / "." / "_" / "%" / ":"

      An NSS for the IMEI is defined under the 'gsma' NID.

      An IMEI is an identifier under the 'gsma' NID that uniquely
      identifies the mobile devices used in the GSM, UMTS, and LTE
      networks.

      The representation of the IMEI is defined in 3GPP TS 23.003 [2].
      To accurately represent an IMEI received in a cellular signaling
      message (see 3GPP TS 24.008 [6]) as a URN, it is necessary to
      convert the received binary (Binary Coded Decimal (BCD)) encoded
      bit sequence to a decimal digit string representation.  Each field
      has its representation for humans as a decimal digit string with
      the most significant digit first.

      The following ABNF includes the set of core rules in RFC 5234 [5];
      the core rules are not repeated here.

      A URN with the 'imei' NSS contains one 'imeival', and its formal
      definition is provided by the following ABNF (RFC 5234) [5]:

      imeival  =  tac "-" snr "-" spare

      tac      = 8DIGIT

      snr      = 6DIGIT

      spare    = DIGIT

      <future-gsma-specifier> and <gsma-defined-nonempty> can comprise
      any ASCII characters compliant with the above ABNF.

      The GSMA will take responsibility for the 'gsma' namespace,
      including the 'imei' NSS.

      Additional NSS may be added for future identifiers needed by the
      GSMA, at their discretion.  Only URNs with the 'imei' NSS are
      considered to be "GSMA IMEI URNs", and use in IETF protocols of
      other NSS that might be defined in the future will require IETF
      consensus.

   Relevant ancillary documentation:

      See IMEI Allocation and Approval Guidelines (GSMA PRD TS.06) [3]
      and 3GPP TS 23.003 [2].

   Identifier uniqueness considerations:

      Identifiers under the 'gsma' NID are defined and assigned by the
      GSMA after ensuring that the URNs to be assigned are unique.
      Uniqueness is achieved by checking against the IANA registry of
      previously assigned names.

      Procedures are in place to ensure that each IMEI is uniquely
      assigned by the Mobile Equipment manufacturer so that it is
      guaranteed to uniquely identify that particular Mobile Equipment
      device.

      Procedures are in place to ensure that each IMEISV is uniquely
      assigned by the Mobile Equipment manufacturer so that it is
      guaranteed to uniquely identify that particular Mobile Equipment
      device and the specific software version installed.

   Identifier persistence considerations:

      The GSMA is committed to maintaining uniqueness and persistence of
      all resources identified by assigned URNs.

      As the NID sought is 'gsma' and "GSMA" is the long-standing
      acronym for the trade association that represents the mobile phone
      operators, the URN should also persist indefinitely (at least as
      long as there is a need for its use).  The assignment process
      guarantees that names are not reassigned.  The binding between the
      name and its resource is permanent.

      The TAC and SNR portions of the IMEI and IMEISV are permanently
      stored in the Mobile Equipment, so they remain persistent as long
      as the Mobile Equipment exists.  The process for TAC and SNR
      assignment is documented in GSMA PRD TS.06 [3], and once assigned,
      the TAC and SNR values are not reassigned to other Mobile
      Equipment devices.  The SVN portion of the IMEISV may be modified
      by software when new versions are installed but should be
      persistent for the duration of the installation of that specific
      version of software.

   Process of identifier assignment:

      The GSMA will manage the <NSS> (including 'imei') and
      <future-gsma-specifier> identifier resources to maintain
      uniqueness.

      The process for IMEI and IMEISV assignment is documented in GSMA
      PRD TS.06 [3].

   Process for identifier resolution:

      Since the 'gsma' NSS is not currently globally resolvable, this is
      not applicable.

   Rules for Lexical Equivalence:

      Two GSMA IMEI URNs are equivalent if they have the same 'imeival'
      value, and the same parameter values in the same sequential order,
      with the exception that the 'vers=0' parameter is to be ignored
      for the purposes of comparison.  All of these comparisons are to
      be case insensitive.

      Any identifier in the 'gsma' NSS can be compared using the normal
      mechanisms for percent-encoded UTF-8 strings (see RFC 3629 [7]).

   Conformance with URN Syntax:

      The string representation of the 'gsma' NID and of the 'imei' NSS
      is fully compatible with the URN syntax (see RFC 2141 [8]).

   Validation mechanism:

      The IMEI can be validated using the mechanism defined in Annex B
      of 3GPP TS 23.003 [2].  There is no mechanism defined to validate
      the SVN field of the IMEISV.

   Scope:  The GSMA URN is global in scope.

4.  Specification

4.1.  IMEI Parameters

   The optional 'vers' parameter and the 'ext-imei' field in the ABNF
   are included for extensibility of the 'imei' NSS -- for example, if
   the IMEI format is extended in the future (such as with additional
   digits or using hex digits).  In this case, the 'vers' parameter
   would contain a non-zero value and the 'ext-imei' would be further
   defined to represent the syntax of the extended IMEI format.  A value
   of the 'vers' parameter equal to 0 or the absence of the 'vers'
   parameter means the URN format is compliant with the format specified
   here.

   Any change to the format of the 'imei' NSS requires the use of the
   procedure for URN NSS changes and additions (currently through the
   publication of future Informational RFCs approved by IETF consensus).
   The use of the 'vers' parameter was chosen for extensibility instead
   of defining a new NSS (e.g., 'imei2') because it is likely that many
   applications will only need to perform string compares of the
   'imeival'.  So, even if the format or length of the 'imeival' changes
   in the future, such applications should continue to work without
   having to be updated to understand a new NSS.

   RFC 7255 [10] specifies how the GSMA IMEI URN can be used as an
   instance ID as specified in RFC 5626 [11].  Any future value of the
   'vers' parameter other than 0, or the definition of additional
   parameters that are intended to be used as part of an instance ID,
   will require an update to RFC 7255 [10].

   For example:

      urn:gsma:imei:90420156-025763-0;vers=0

   The IMEISV is an identifier that uniquely identifies mobile devices
   and their associated software versions used in the GSM, UMTS, and LTE
   networks.  The representation of the IMEISV is defined in 3GPP TS
   23.003 [2].

   To represent the IMEISV, the URN parameter 'svn' is appended to the
   GSMA IMEI URN and set equal to the decimal string representation of
   the two software version number (svn) digits in the IMEISV, and the
   Spare digit in the IMEI 'imeival' is set to zero.

   For example:

      urn:gsma:imei:90420156-025763-0;svn=42

4.2.  IMEI Format

4.2.1.  Type Allocation Code (TAC)

   The TAC is an 8 decimal digit value.  The TAC identifies the type of
   the Mobile Equipment and is chosen from a range of values allocated
   to the Mobile Equipment manufacturer in order to uniquely identify
   the model of the Mobile Equipment.

4.2.2.  Serial Number (SNR)

   The SNR is a 6 decimal digit value.  The SNR is an individual serial
   number that uniquely identifies each Mobile Equipment device within
   the TAC.

4.2.3.  Spare

   The Spare is a single decimal digit.  When the IMEI is stored on the
   Mobile Equipment and network equipment, it contains a value that is
   used as a Check digit and is intended to avoid manual reporting
   errors (e.g., when customers register stolen mobiles at the
   operator's customer care desk) and also to help guard against the
   possibility of incorrect entries being provisioned in the network
   equipment.  The Spare is always set to zero when transmitted by the
   Mobile Equipment (including when in the IMEI URN format).  Annex B of
   3GPP TS 23.003 [2] specifies a mechanism for computing the actual
   Check digit in order to validate the TAC and SNR.

4.2.4.  Binary Encoding

   When included in a cellular signaling message, the IMEI format is 15
   decimal digits encoded in 8 octets, using BCD as defined in 3GPP TS
   24.008 [6].  Figure 1 is an abstract representation of a BCD-encoded
   IMEI stored in memory (the actual storage format in memory is
   implementation specific).  In Figure 1, the most significant digit of
   the TAC is coded in the least significant bits of octet 1.  The most
   significant digit of the SNR is coded in the least significant bits
   of octet 5.  The Spare digit is coded in the least significant bits
   of octet 8.  When included in an identity element in a cellular
   signaling message, the most significant digit of the TAC is
   included in digit 1 of the identity element in Figure 10.5.4 of
   3GPP TS 24.008 [6].

       14 13 12 11 10  9  8  7  6  5  4  3  2  1  0  Decimal Digits
      +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
      |                       |                 | S|
      |            T          |          S      | p|
      |            A          |          N      | a|
      |            C          |          R      | r|
      |                       |                 | e|
      +--+-----+-----+-----+--+--+-----+-----+--+--+
         1     2     3     4     5     6     7     8  Octets

                           Figure 1: IMEI Format

4.3.  IMEISV Format

4.3.1.  Type Allocation Code (TAC)

   The TAC is the same as the TAC in the IMEI (see Section 4.2.1).

4.3.2.  Serial Number (SNR)

   The SNR is the same as the SNR in the IMEI (see Section 4.2.2).

4.3.3.  Software Version Number (SVN)

   The Software Version Number is allocated by the mobile device
   manufacturer to identify the software version of the mobile device.

4.3.4.  Binary Encoding

   When included in a cellular signaling message, the IMEISV format is
   16 decimal digits encoded in 8 octets using BCD as defined in 3GPP TS
   24.008 [6].  Figure 2 is an abstract representation of a BCD-encoded
   IMEISV stored in memory (the actual storage format in memory is
   implementation specific).  In Figure 2, the most significant digit of
   the TAC is coded in the most significant bits of octet 1.  The most
   significant digit of the SNR is coded in the most significant bits of
   octet 5.  The most significant digit of the SVN is coded in the most
   significant bits of octet 8.  When included in an identity element in
   a cellular signaling message, the most significant digit of the TAC
   is included in digit 1 of the identity element in Figure 10.5.4 of
   3GPP TS 24.008 [6].

       15 14 13 12 11 10  9  8  7  6  5  4  3  2  1  0  Decimal Digits
      +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
      |                       |                 |     |
      |            T          |          S      |  S  |
      |            A          |          N      |  V  |
      |            C          |          R      |  N  |
      |                       |                 |     |
      +-----+-----+-----+-----+-----+-----+-----+-----+
            1     2     3     4     5     6     7     8  Octets

                          Figure 2: IMEISV Format

5.  Community Considerations

   GSM, UMTS, and LTE mobile devices will be interoperating with
   Internet devices for a variety of voice and data services.  To do
   this, they need to make use of Internet protocols that will operate
   end to end between devices in GSM/UMTS/LTE networks and those in the
   general Internet.  Some of these protocols require the use of URNs as
   identifiers.  Within the GSM/UMTS/LTE networks, mobile devices are
   identified by their IMEI or IMEISV.  Internet users will need to be
   able to receive and include the GSMA URN in various Internet protocol
   elements to facilitate communication between pure Internet-based
   devices and GSM/UMTS/LTE mobile devices.  Thus, the existence and
   syntax of these namespaces need to be available to the general
   Internet community, and the namespace needs to be reserved with IANA
   in order to guarantee uniqueness and prevent potential namespace
   conflicts both within the Internet and within GSM/UMTS/LTE networks.
   Conversely, Internet implementations will not generally possess IMEI
   identifiers.  The identifiers generated by such implementations will
   typically be URNs within namespaces other than 'gsma' and may,
   depending on context, even be non-URN URIs.  Implementations are
   advised to be ready to process URIs other than 'gsma' namespaced
   URNs, so as to aid in interoperability.

6.  Namespace Considerations

   A URN was considered the most appropriate URI to represent the IMEI
   and IMEISV, as these identifiers may be used and transported
   similarly to the Universally Unique Identifier (UUID), which is
   defined as a URN in RFC 4122 [12].  Since specifications for
   protocols that are used to transport device identifiers often require
   the device identifier to be globally unique and in the URN format, it
   is necessary that the URN formats are defined to represent the IMEI
   and IMEISV.

7.  IANA Considerations

   In accordance with BCP 66 (RFC 3406) [1], IANA has registered the
   Formal URN Namespace 'gsma' in the "Uniform Resource Names (URN)
   Namespaces" registry, using the registration template presented in
   Section 3 of this document.

8.  Security and Privacy Considerations

   IMEIs (but with the Spare value set to the value of the Check digit)
   are displayable on most mobile devices and in many cases are printed
   on the case within the battery compartment.  Anyone with brief
   physical access to the mobile device can therefore easily obtain the
   IMEI.  Therefore, IMEIs MUST NOT be used as security capabilities
   (identifiers whose mere possession grants access).  Unfortunately,
   there are currently examples of some applications that are using the
   IMEI for authorization.  Also, some service provider's customer
   service departments have been known to use knowledge of the IMEI as
   "proof" that the caller is the legitimate owner of the mobile device.
   Both of these are inappropriate uses of the IMEI.

   While the specific software version of the mobile device only
   identifies the lower-layer software that has undergone and passed
   certification testing, and not the operating system or application
   software, the software version could identify software that is
   vulnerable to attacks or is known to contain security holes.

   Therefore, the IMEISV MUST only be delivered to trusted entities
   within carrier networks and not provided to the Internet at large, as
   it could help a malicious device identify that the mobile device is
   running software that is known to be vulnerable to certain attacks.
   This concern is similar to concerns regarding the use of the
   User-Agent header in the Session Initiation Protocol (SIP) as
   specified in RFC 3261 [13].  Therefore, the IMEISV (that is, the IMEI
   URN with a 'svn' parameter) MUST NOT be delivered to devices that are
   not trusted.  IMEIs are almost always personally identifiable
   information, and so these URNs MUST be treated as personally
   identifiable information in all cases.  In order to prevent violating
   a user's privacy, the IMEI URN MUST NOT be included in messages
   intended to convey any level of anonymity.

   Since the IMEI is permanently assigned to the mobile device and is
   not modified when the ownership of the mobile device changes (even
   upon a complete software reload of the device), the IMEI URN MUST NOT
   be used as a user identifier or user address by an application.
   Using the IMEI to identify a user or as a user address could result
   in communications destined for a previous owner of a device being
   received by the new device owner or could allow the new device owner
   to access information or services owned by the previous device owner.

   Additionally, since the IMEI identifies the mobile device, it
   potentially could be used to identify and track users for the
   purposes of surveillance and call data mining if sent in the clear.

   Since the IMEI is personally identifiable information, uses of the
   IMEI URN with IETF protocols require a specification and IETF Expert
   Review [14] in order to ensure that privacy concerns are
   appropriately addressed.  Protocols carrying the IMEI URN SHOULD at a
   minimum use channels that are strongly hop-by-hop encrypted, and it
   is RECOMMENDED that end-to-end encryption be used.

   Additional security considerations are specified in 3GPP TS 22.016
   [9].  Specifically, the IMEI is to be incorporated in a module that
   is contained within the terminal.  The IMEI SHALL NOT be changed
   after the terminal's production process.  It SHALL resist tampering,
   i.e., manipulation and change, by any means (e.g., physical,
   electrical, and software).

9.  Acknowledgements

   This document draws heavily on the 3GPP work on Numbering,
   Addressing, and Identification in 3GPP TS 23.003 [2] and also on the
   style and structure used in RFC 4122 [12].  The authors would like to
   thank Cullen Jennings, Lisa Dusseault, Dale Worley, Ivo Sedlacek,
   Atle Monrad, James Yu, Mary Barnes, Tim Bray, S. Moonesamy, Alexey
   Melnikov, Martin Duerst, John Klensin, Paul Kyzivat, Christer
   Holmberg, Barry Leiba, and Stephen Farrell for their help and
   comments.

10.  References

10.1.  Normative References

   [1]  Daigle, L., van Gulik, D., Iannella, R., and P. Faltstrom,
        "Uniform Resource Names (URN) Namespace Definition Mechanisms",
        BCP 66, RFC 3406, October 2002.

   [2]  3GPP, "Numbering, addressing and identification", 3GPP TS 23.003
        (Release 8), March 2014, <ftp://ftp.3gpp.org/Specs/
        archive/23_series/23.003/>.

   [3]  GSM Association, "IMEI Allocation and Approval Guidelines", PRD
        TS.06 (DG06) Version 6.0, July 2011,
        <http://www.gsma.com/newsroom/wp-content/uploads/2012/06/
        ts0660tacallocationprocessapproved.pdf>.

   [4]  Bradner, S., "Key words for use in RFCs to Indicate Requirement
        Levels", BCP 14, RFC 2119, March 1997.

   [5]  Crocker, D. and P. Overell, "Augmented BNF for Syntax
        Specifications: ABNF", STD 68, RFC 5234, January 2008.

   [6]  3GPP, "Mobile radio interface Layer 3 specification; Core
        network protocols; Stage 3", 3GPP TS 24.008 (Release 8), June
        2013, <ftp://ftp.3gpp.org/Specs/archive/24_series/ 24.008/>.

   [7]  Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD
        63, RFC 3629, November 2003.

   [8]  Moats, R., "URN Syntax", RFC 2141, May 1997.

   [9]  3GPP, "International Mobile station Equipment Identities
        (IMEI)", 3GPP TS 22.016 (Release 8), December 2009,
        <ftp://ftp.3gpp.org/Specs/archive/22_series/22.016/>.

10.2.  Informative References

   [10] Allen, A., Ed., "Using the International Mobile station
        Equipment Identity (IMEI) Uniform Resource Name (URN) as an
        Instance ID", RFC 7255, May 2014.

   [11] Jennings, C., Mahy, R., and F. Audet, "Managing Client-
        Initiated Connections in the Session Initiation Protocol (SIP)",
        RFC 5626, October 2009.

   [12] Leach, P., Mealling, M., and R. Salz, "A Universally Unique
        IDentifier (UUID) URN Namespace", RFC 4122, July 2005.

   [13] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A.,
        Peterson, J., Sparks, R., Handley, M., and E.  Schooler, "SIP:
        Session Initiation Protocol", RFC 3261, June 2002.

   [14] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA
        Considerations Section in RFCs", BCP 26, RFC 5226, May 2008.

Authors' Addresses

   Michael Montemurro (editor)
   Blackberry
   4701 Tahoe Dr.
   Mississauga, Ontario  L4W 0B4
   Canada

   EMail: mmontemurro@blackberry.com


   Andrew Allen
   Blackberry
   1200 Sawgrass Corporate Parkway
   Sunrise, Florida  33323
   USA

   EMail: aallen@blackberry.com


   David McDonald
   Eircom

   EMail: David.McDonald@meteor.ie


   Paul Gosden
   GSM Association
   1st Floor, Mid City Place, 71 High Holborn
   London
   England

   EMail: pgosden@gsma.com

ISO Plain Language

On this page
PROBLEMEvery mobile phone has a fifteen-digit serial number that cellular networks use to identify it, but Internet protocols that need to name a device have no agreed way to write it.
MECHANISMThe RFC reserves a Uniform Resource Name namespace for the mobile industry and defines how the device identifier is written inside it, with an optional parameter for the software version.
THE CATCHThe document warns that these names are personal information and must be handled carefully. It says they must not be used as a password, as a user address, or in messages meant to be anonymous.

§1What the Document Defines

The document defines a Uniform Resource Name namespace for the Global System for Mobile Communications Association and a namespace specific string for the International Mobile station Equipment Identity, together with an associated parameter for the International Mobile station Equipment Identity and Software Version number, following the namespace registration requirements of the URN rules.

The namespace identifier is gsma, for identities used in GSM, Universal Mobile Telecommunications System and Long Term Evolution networks. The device identifiers are managed by the association, so the namespace is managed by it too. Only the imei string is defined under the gsma namespace at present, though the association may define others later through future Informational RFCs.

The IMEI is 15 decimal digits long: a type allocation code of 8 digits, a serial number of 6 digits, and one spare digit. The type allocation code identifies the type of the mobile equipment, and is chosen from a range of values allocated to the manufacturer in order to identify the model uniquely. The serial number is an individual number that identifies each device within that code. The spare digit is used as a check digit to validate the whole number, and is always set to zero when the equipment transmits it. The IMEISV is 16 digits long: the same code and serial number, plus a two-digit software version number allocated by the manufacturer.

The information here is meant to be a concise guide for anyone wishing to use the two identifiers as URNs. Nothing in the document overrides the 3GPP specification that actually defines them. The association itself is a global trade association representing nearly 800 mobile phone operators across 220 territories and countries.

The number is not one piece. The first eight digits say what model of handset it is, the next six say which one, and the last digit is a checksum that catches typing mistakes.

§3How the Name Is Written

The identifier is written in ASCII characters with a hierarchical structure expressed in Augmented Backus-Naur Form. The overall shape is urn: followed by the namespace identifier, a colon, and the namespace specific string. The namespace specific string is either the imei specifier or a future specifier. The imei specifier is the word imei, a colon, and then either the ordinary value or an extended value, optionally followed by a software version parameter and then optionally an IMEI version parameter.

The ordinary value is three fields separated by hyphens: the type allocation code of eight digits, the serial number of six digits, and the spare digit. The software version parameter is svn= followed by two digits, and the IMEI version parameter is vers= followed by one digit. The future specifier and the extended value are left for the association to define, within the character set allowed, which is letters, digits and the characters hyphen, full stop, underscore, per cent sign and colon.

Two examples are given. The first is an ordinary identifier with the version parameter set to zero: urn:gsma:imei:90420156-025763-0;vers=0. The second is the same device with a software version appended, in which case the spare digit is set to zero: urn:gsma:imei:90420156-025763-0;svn=42.

The written form is ordinary: a prefix saying whose number it is, the three groups of digits separated by hyphens, and any extra information after a semicolon.

EXAMPLE GSMA IMEI NAMES
GSMA IMEI URNs
urn:gsma:imei:90420156-025763-0;vers=0
urn:gsma:imei:90420156-025763-0;svn=42

§4.1Versioning, Equivalence and Validation

The optional version parameter and the extended value are there for extensibility. If the format of the identifier were ever extended, with more digits or with hexadecimal digits for instance, the version parameter would carry a non-zero value and the extended value would be defined to describe the new syntax. A version of zero, or no version parameter at all, means the name is compliant with the format given here. Any change to the format needs the same process used for adding or changing a namespace specific string, which is publication of a future Informational RFC approved by IETF consensus.

The version parameter was chosen instead of defining a second namespace specific string, such as imei2, because many applications will do nothing more than compare the ordinary value as a string. Even if the format or the length of that value changes later, those applications should keep working without being updated to understand a new name.

Two GSMA IMEI names are equivalent when they have the same ordinary value and the same parameter values in the same order, except that a version parameter of zero is ignored for comparison. All such comparisons are case insensitive. The identifier can be validated using the mechanism in the 3GPP specification, but there is no mechanism for validating the software version field. The namespace is global in scope, and it is not currently globally resolvable, so the question of how to resolve a name to a resource does not apply.

If the format of these numbers ever changes, the same name keeps working, with a version number saying which format is in use. That way old software does not break.

§4.2The Two Number Formats

When the IMEI travels inside a cellular signalling message it is 15 decimal digits encoded in 8 octets using Binary Coded Decimal, as defined in the 3GPP signalling specification. The figure in the RFC is an abstract representation; the actual storage format in memory is implementation specific. In that representation the most significant digit of the type allocation code sits in the least significant bits of the first octet, the most significant digit of the serial number in the least significant bits of the fifth octet, and the spare digit in the least significant bits of the eighth octet.

The spare digit is a single decimal digit. When the IMEI is stored on the equipment and in network equipment it holds a value used as a check digit, intended to avoid manual reporting errors, such as when a customer registers a stolen phone at the operator's customer care desk, and to help guard against incorrect entries being provisioned into the network. It is always set to zero when the equipment transmits it, including in the URN form. The 3GPP specification gives a mechanism for computing the actual check digit in order to validate the code and the serial number.

The IMEISV is 16 decimal digits in 8 octets, also Binary Coded Decimal. Its type allocation code and serial number are the same as for the IMEI, and it adds a software version number allocated by the manufacturer. In its octet representation the most significant digit of the code sits in the most significant bits of the first octet, the serial number in the most significant bits of the fifth, and the software version in the most significant bits of the eighth.

On the air, these numbers are packed two digits to a byte. The check digit is filled in when the number is stored and sent as a zero, which is why the written form normally ends in a zero.

THE PARTS OF THE TWO NUMBERS
PartLengthWhat it identifies
Type Allocation Code8 digitsThe model of the equipment, from a range allocated to the manufacturer
Serial Number6 digitsThe individual device within that model
Spare1 digitA check digit, sent as zero and used to catch typing errors
Software Version Number2 digitsThe software version, in the IMEISV only

§5Why the Internet Needs This

Mobile devices interoperate with Internet devices for voice and data services, and to do that they need Internet protocols that work end to end between devices in the cellular networks and devices in the general internet. Some of those protocols require URNs as identifiers. Within the cellular networks, devices are identified by their IMEI or IMEISV, and internet users need to be able to receive and include the name in various protocol elements. The namespace therefore has to be registered with IANA, to guarantee uniqueness and to prevent conflicts both inside the internet and inside the cellular networks.

The reverse is also true. Internet implementations will not generally hold IMEI identifiers, and the identifiers they generate will typically be URNs in other namespaces or, depending on the context, may not be URNs at all. Implementations are advised to be ready to process names other than those in the gsma namespace, so that they interoperate.

A URN was chosen as the most appropriate kind of name, because these identifiers are used and transported much like the Universally Unique Identifier, which is itself defined as a URN. Because the specifications of protocols that carry device identifiers often require the identifier to be globally unique and in URN form, the URN formats for these two identifiers had to be defined. IANA has registered the formal URN namespace gsma in the registry of Uniform Resource Name namespaces, using the registration template given in the document.

A phone on a cellular network and a server on the internet sometimes need to refer to the same device, so both have to agree on how the device is named. Registering the name with IANA is what stops two different industries inventing the same one.

§8Privacy Rules for These Names

IMEIs, with the spare value set to the check digit, are displayable on most mobile devices and in many cases are printed on the case inside the battery compartment. Anyone with brief physical access to the device can easily obtain the IMEI. The document is therefore emphatic that IMEIs must not be used as security capabilities, that is, as identifiers whose mere possession grants access. Unfortunately there are currently examples of applications that use the IMEI for authorisation, and some service providers' customer service departments have been known to treat knowledge of the IMEI as proof that the caller is the legitimate owner of the handset. Both are inappropriate uses.

The software version identifies only the lower-layer software that has passed certification testing, not the operating system or the applications, but it could still identify software known to be vulnerable. The IMEISV must therefore be delivered only to trusted entities inside carrier networks and not to the internet at large, and must not be delivered to devices that are not trusted. This is a similar concern to the one about the User-Agent header in SIP.

IMEIs are almost always personally identifiable information, so these names must be treated as such in all cases. The IMEI name must not be included in messages intended to convey any level of anonymity. Because the IMEI is permanently assigned to the device and does not change when ownership changes, even across a complete software reload, the IMEI name must not be used as a user identifier or a user address by an application, since that would let the new owner of a device receive the previous owner's traffic or reach the previous owner's services. The identifier could also be used to track people if sent in the clear. Uses of the IMEI name with IETF protocols require a specification and IETF Expert Review, protocols carrying it should at a minimum use channels that are strongly encrypted hop by hop, and end-to-end encryption is recommended.

Anyone holding a phone can read its number off the screen. So it must never be treated as a secret, never used to stand for a user, and never sent where it is not needed.

THE RULES FOR HANDLING THESE NAMES
  • Never a passwordThe number is readable by anyone holding the phone, so it must not grant access.
  • Not a user addressIt belongs to the device, not the person, and does not change when the phone is sold.
  • Personal dataTreat these names as personally identifiable information in every case.
  • Keep the version inside the carrierThe software version may reveal a vulnerable release, so it must not go out to the internet.
  • Encrypt the channelSend it over a channel that is encrypted hop by hop, and end to end where possible.

§7References