1. Rev.01 UIM, ESN and Equipment Identifiers Source: Bob Plunkett Chair, UIM AdHoc, TSG-S 3GPP2 Fujitsu Network Communications (972) 479-2084 bobplunkett@sprintmail.com Copyright Statement The contributor grants a free, irrevocable license to 3GPP2 and its Organizational Partners to incorporate text or other copyrightable material contained in the contribution and any modifications thereof in the creation of 3GPP2 publications; to copyright and sell in Organizational Partner's name any Organizational Partner's standards publication even though it may include portions of the contribution; and at the Organizational Partner's sole discretion to permit others to reproduce in whole or in part such contributions or the resulting Organizational Partner's standards publication. The contributor must also be willing to grant licenses under such contributor copyrights to third parties on reasonable, non-discriminatory terms and conditions, as appropriate. Notice Permission is granted to 3GPP2 participants to copy any portion of this contribution for the legitimate purpose of the 3GPP2. Copying this contribution for monetary gain or other non-3GPP2 purpose is prohibited.

2. Rev.02 What is ESN Used For? zRegistration yOptionally used in most air interface standards as part of registration messages. zFraud Control yMany existing systems use ESN - MIN/IMSI matching for purposes of fraud control. zAuthentication yUsed in the generation of SSD and AuthR. zEmbedded in IMSI yUsed in some of the IMSI formats. zCDMA Reverse Traffic Channel Encoding yProvides MS specific channel separation/isolation based on a unique ESN.

3. Rev.03 ESN Treatment Scenarios zScenario 1 - Substituting UIM_ID for ESN (32 bit). yA 32 bit UIM_ID would be used wherever ESN is used today. zScenario 2 - Continue to use the ESN in the MS. yThe 32 bit ESN of the terminal would continue to be used in all existing procedures. zScenario 3 - ESN stays in the MS but a new number called SSN for authentication procedures. yInvolves a hybrid solution whereby ESN is used in legacy networks, SSN in networks capable of direct UIM support.

4. Rev.04 #1: Substituting UIM_ID for ESN (32 bit) zUIM_ID is substituted for the Mobile Station ESN in all procedures. zTransparent to existing networks and permits UIM roaming on legacy networks without impact. zNew networks could be upgraded to support separate UIM and Terminal identifiers. zMay require a regulatory change yIt needs to be clarified if this scenario requires a regulatory change. One possible interpretation is that the ESN would continue to exist in the terminal. It would simply no longer be used. zAuthentication would execute in the UIM.

5. Rev.05 #1 - Issues zSize of Term_ID yA new Term_ID would be required. Note that this could be the existing MS ESN but could be larger to accommodate future growth. zSize of UIM_ID yThe UIM_ID could remain the same size as the existing ESN or it could be increased to some larger number. If a larger size was chosen, existing procedures would use a 32 bit subset of the number. yBy using a subset number there are some issues with ESN uniqueness. zNew Messages to query full Term_ID and UIM_IDs. yNew messages would be needed to extract both the Term_ID and the UIM_ID over the air Interface since the ESN would no longer be used in existing procedures and only a subset of the UIM_ID would be used in the procedures.

6. Rev.06 #1 - Some more issues zCould create a commercial grade cloning platform. yWithout additional security procedures between a UIM and the terminal, it would be possible to build an interface to the terminal that permitted easy cloning of MIN/ESNs. yHow long do we protect networks that have not implemented authentication? zRF Fingerprinting based on ESN would be lost. yRF Fingerprinting networks would need access to the new terminal identifier.

7. Rev.07 #1 - UIM_ID Subsetting Issues zOn occasion (very rarely) you may get two subscribers with the same 32 bit subset. yNon-unique in the network - 2 subscribers - 1 ESN. yMay require some changes to existing networks. zCould cause problems on the reverse channel. yVery, very rarely. yCould be mitigated by some small changes to the Air Interface. zProblems can be mitigated by ESN assignment management.

8. Rev.08 #2 - Continue to use the ESN in the MS  The terminal ESN could continue to be used in all procedures.  Relies upon the fact that the ESN is transferred from the phone to the network as part of the Authentication procedures.  The network Authentication procedures would then have to take into account the current ESN identified and discard any previously used values.  Authentication would execute in the UIM (A-Key is in the UIM).  New messages are still required for UIM_ID.

9. Rev.09 #2 Issues  Still a limited number space if the 32 bit ESN continues to be used.  This approach requires a manual update of MIN/ESN for non-authenticating networks where the UIM transfer between terminals occurred between networks.  Customer and Customer Service Impacting.  Network Authentication implementations may assume MIN/ESN binding.  May require changes to existing networks.  IMSI/TIMSI includes the ESN in some instances.  Dynamic binding of the ESN to the IMSI/TIMSI must be supported by the networks.  Is there also an issue with SSD sharing here as well?

10. Rev.010 #3 - SSN Hybrid Solution zESN stays in the MS and uses a new number called SSN for authentication procedures. zDecouples ESN from Authentication procedures and from subscription in general. zSSN is known only to the UIM manufacturer and the operator. zThe approach would not permit SSD sharing without IS-41 changes. zRequires IS-41 changes to support SSN transfers. zNew messages are still required for UIM_ID.