1. 1 A Proposal on MEID requirement April 15, 2002 Masaaki Koga (koga@kddi.com) KDDI Corporation

2. 2 ESN Related Information JEM(Joint Expert Meeting) on equipment identity was established for the purpose of –introduction of a common equipment identity among GSM, UMTS, and cdmaOne/cdma2000. –IMEI of GSM/UMTS and MEID of 3GPP2/TIA have the same number of digits, 56 bits. The JEM activity influenced TIA TR-45 ESN Adhoc, which started working on MEID requirements as –the solution of ESN exhaust. According to ESN administrator’s estimate, we are likely to use up ESN in 3 years.

3. 3 ESN Duplication in CDMA In cdmaOne and CDMA2000, the key elements of –long code mask –voice privacy mask Use the ESN (or UIMID) and some other data as their fundamental constituents Therefore, duplicate ESNs will cause cross talk in the RF uplink if a duplicate ESN makes a call in the same CDMA FA of the same sector at a cell site.

4. 4 Phased MEID deployment Two problems (1) ESN Exhaust (2) Japanese special ESN situation KDDI considers that the transition to MEID is the good timing to solve those problems. KDDI has a proposal for the transition phase. Now Transition Phase Future Terminal ID on the air interface ESN Pseudo ESN MEID

5. 5 Current MEID Requirement in TIA The requirement says that the MS shall send the H’80ZZZZZZ in the transition phase, called Pseudo ESN, as the ESN, where Z corresponds to a 24 bit hash of the MEID. No impact on the legacy infrastructure. However, nothing is included in TIA requirement to guard against CDMA long code mask duplication

6. 6 Likelihood of ESN Collision and Cross-Talk Assumptions: Based on TIA MEID requirement (Pseudo ESN = 80ZZZZZZ) –That is, there are 16 millions Pseudo ESN patterns. All the handsets in all the coverage area support the Pseudo ESN and are 800M/1.9G dual-band handsets with random distribution. 30 subscribers are making a call in a CDMA FA at any one time in the busiest hour. Using the birthday problem calculation, percentage where cross talk won’t happen in a carrier is 99.997%. There are 20000 Omni-cell/sectors. There are 5 CDMA carriers on average in the Omni-cell or sector. Percentage where cross talk won’t happen anywhere in the network –6.6%

7. 7 KDDI’s CONCERN Cross talk is quite likely. Such cross talk will continue until either of two users moves to the next cell or sector. When two users retry the call, the land parties will keep hearing the same two users’ voice, repeatedly It will raise customer’s suspicion of a “security hole” It may also be reported to Government and news as a failure statistic –Like FCC Network Reliability Reporting requirements Such kind of incident, will extremely degrade cdmaOne/cdma2000 reputation KDDI thinks solutions should be prepared to avoid the incident happening.  KDDI thinks solutions should be prepared to avoid the incident happening.

8. 8 Special Japan ESN Situation Japanese 800MHz frequency band is different from other countries. Japan has a unique ESN assignment among all TIA areas –inherited from the TACS ESN format because Japanese CDMA began with the dual mode with the TACS. Position of TACS ESN manufacturer code is opposite from TIA ESN. –Manufacturer code of the TACS ESN is located in the end. Dual-band Roaming handset changed the situation. AU Sanyo dual band handset, for J-800MHz and N.Am-800, contains –TIA manufacturer code in the upper bits and –a value from a block of empty Japan manufacturer codes in the lower bits. Current 3GPP2/TIA ESN/UIMID assignment does NOT consider possibility of –Duplication of ordinary lower bits with –Japanese manufacturer codes in lower bits, à la TACS Although NO R-UIM-capable handset supporting the Japanese frequency band has been introduced… KDDI expects that such handset will be introduced earlier than TIA ESN exhaust.

9. 9 SOLUTIONS KDDI thinks that there are following three solutions. (1) Use of private long code mask (2) Use of the voice privacy mask based on TMSI or GSM procedure (3) Addition of the new filler value of public long code mask (1) and (2) do not require a standards change. Implementation of private long code mask requires the support of the home network as to the generation of SSD_B. Unless a serving network supports private long code mask, a roaming-in handset will cause the duplication of long code mask. Although the voice privacy mask based on TMSI or GSM procedure was included in the Release C, this feature may not be widely implemented by operators. KDDI thinks that intensive exploration of (3) should be pursued. [see next page]

10. 10 Explanation of (3) Current filler of public long code mask = 1100011000 Assumption –If both handset and base station are P_REV_7 (Release A) or the later P_REV, they will use another filler of public long code mask. Effectiveness –CDMA industry can reuse the ESN value from P_REV_7 without the concern of cross talk. Remarks –Inclusion of this standard change is recommended although it is difficult to include this standard change in the Release A because it is already released. –Although a handset can identify its CDMA2000 Release, a UIM is independent of the Release. That is why UIMID should continue to be unique. –Base station should support the backward compatibility for legacy handset.

11. 11 KDDI’s Proposal (1) KDDI proposes to add the following item to the MEID requirement. 1.Cross-talk caused by the duplicated ESN/ Pseudo ESN, and UIMID, should be avoided. (2) KDDI proposes the pseudo ESN format below as the MEID requirement. 1.No impact on the current JEM report 2.The pseudo ESN is directly derived from MEID to guarantee its uniqueness. 3.Third to Sixth HEX digits of the MEID manufacturer code don’t need to be used until all the pseudo ESN is used up. (3) KDDI proposes the intensive exploration of the addition of the new filler value of public long code mask. Pseudo ESN MEID