A Uniform Resource Name Namespace for the GSM Association (GSMA) and the International Mobile station Equipment Identity (IMEI)
draft-montemurro-gsma-imei-urn-13

quot; / gsma-specifier-defined-string
       gsma-specifier-defined-string  = gsma-approved-nonempty-string
       gsma-specifier-defined-substring  = gsma-approved-nonempty-string
       gsma-specifier-defined-param-name  = gsma-approved-nonempty-string
       gsma-specifier-defined-param-val = gsma-approved-string
       gsma-specifier-param =
                       "svn" "=" software-version-string /
                       "vers" "=" gsma-format-version-string /
                       gsma-specifier-defined-param-name "="
                       gsma-specifier-defined-param-val
       software-version-string = 2DIGIT
       gsma-format-version-string = DIGIT
       gsma-approved-string = *unreserved
       gsma-approved-nonempty-string = 1*unreserved
       unreserved  = ALPHA / DIGIT / "-" / "." / "_"

Montemurro, et al.       Expires August 17, 2013                [Page 5]
Internet-Draft            The GSMA and IMEI URN            February 2013

      The GSMA namespace includes a predefined namespace for IMEI and
      may be in the future extended to include other identifiers used by
      Mobile Equipment used in GSM, UMTS or LTE networks or future
      networks deployed by members of the GSMA.

      An IMEI is an identifier under the GSMA namespace that uniquely
      identifies Mobile Equipment used in GSM, UMTS and LTE networks.

      The internal representation of a IMEI is a specific sequence of
      bits in memory, as described in 3GPP TS 23.003 [2].  To accurately
      represent a IMEI as a URN, it is necessary to convert the BCD bit
      sequence to a string representation.  Each field BCD bit sequence
      has its value printed as a decimal digit string with the most
      significant digit first.

      The following augmented Backus-Naur Form (ABNF) includes the set
      of core rules in RFC 5234 [8], and are not repeated here.

      A URN with the "imei" gsma-specifier contains exactly one gsma-
      specifier-defined-substring, and its formal definition is provided
      by the following ABNF [8]:

      IMEI =  tac "-" snr "-" spare
      tac      = 8DIGIT
      snr      = 6DIGIT
      spare    = 1DIGIT
      For example:
         urn:gsma:imei:90420156-025763-0;vers=0

      The optional "vers" parameter is included for extensibility of the
      namespace, for example if the IMEI format is extended in the
      future (such as with additional digits or using hex digits).  A
      value of "vers" equal to 0 or the absence of the "vers" parameter
      means the URN format is compliant with the format specified here.
      Any change to the format specified here requires the publication
      of a future informational RFC.

      The IMEISV is an identifier that uniquely identifies Mobile
      Equipment and associated software versions used in GSM and UMTS
      networks.  The internal representation of a IMEISV is a specific
      sequence of bits in memory, as described in 3GPP TS 23.003 [2]
      To represent the IMEISV the URN parameter "svn" is appended to the
      IMEI URN and set equal to the decimal string representation of the
      two software version number (svn) bits in the IMEISV and the spare
      digit in the IMEI gsma-specifier-defined-substring is set to zero.

Montemurro, et al.       Expires August 17, 2013                [Page 6]
Internet-Draft            The GSMA and IMEI URN            February 2013

      For example:
         urn:gsma:imei:90420156-025763-0;svn=42

      The <gsma-specifier>, <gsma-specifier-defined-string>, <gsma-
      specifier-defined-substring>, <gsma-specifier-defined-param-name>
      and <gsma-specifier-defined-param-val> can comprise any ASCII
      characters compliant with the above ABNF.  The exclusion of the
      colon from the list of other characters means that the colon can
      only occur as a delimiter between string values.  The exclusion of
      the semicolon from the list of other characters means that the
      semicolon can only occur as a delimiter for parameter values.  The
      exclusion of the "=" character from the list of other characters
      means that the "=" character can only occur as an operator for
      parameter values.

      The GSMA will take responsibility for the gsma-specifier "imei"
      and manage the URNs in its sub-namespace.

      Additional gsma-specifiers may be added in the future through
      informational RFCs.

   Relevant ancillary documentation:
      See IMEI Allocation and Approval Guidelines [3] and 3GPP TS 23.003
      [2].

   Identifier uniqueness considerations:
      Identifiers in the "gsma" namespace are defined and assigned in
      the requested namespace by the GSMA after ensuring that the URNs
      to be assigned are unique.  Uniqueness is achieved by checking
      against the registry of previously assigned names.

      Procedures are in place to ensure that each IMEI is uniquely
      assigned by the Mobile Equipment manufacturer so that it is
      guaranteed to uniquely identify that particular Mobile Equipment.
      Procedures are in place to ensure that each IMEISV is uniquely
      assigned by the Mobile Equipment manufacturer so that it is
      guaranteed to uniquely identify that particular Mobile Equipment
      and the specific software version installed.

   Identifier persistence considerations:
      The GSMA is committed to maintaining uniqueness and persistence of
      all resources identified by assigned URNs.

      As the NID sought is "gsma" and GSMA is the long standing acronym
      for the trade association that represents the mobile phone
      operators the URN should also persist indefinitely (at least as
      long as there is a need for its use).  The assignment process
      guarantees that names are not reassigned.  The binding between the

Montemurro, et al.       Expires August 17, 2013                [Page 7]
Internet-Draft            The GSMA and IMEI URN            February 2013

      name and its resource is permanent.

      The TAC and SNR portions of IMEISVs are stored in the Mobile
      Equipment so they remain persistent.  The SVN may be modified by
      software when new versions are installed but should be persistent
      for the duration of the installation of that specific version of
      software.

   Process of identifier assignment:
      GSMA will manage the <gsma-specifier> (including "imei"), <gsma-
      defined-string>, <gsma-specifier-defined-substring>, <gsma-
      specifier-param>, <gsma-specifier-defined-param-name> and <gsma-
      specifier-defined-param-val> identifier resources to maintain
      uniqueness.

      The process for IMEI and IMEISV assignment is documented in GSMA
      TS 06[3]

   Process for identifier resolution:
      Since the GSMA namespace is not globally resolvable, this is not
      applicable.

   Rules for Lexical Equivalence:
      Two IMEI URNs are equivalent if the single gsma-defined-substrings
      in the two URNs are the same, and the sequences of gsma-specifier-
      params are the same and in the same order, with the exception that
      the gsma-specifier-param "vers=0" is to be ignored for purposes of
      comparison.  All of these comparisons are to be case-insensitive.

      Any identifier in GSMA namespaces can be compared using the normal
      mechanisms for percent-encoded UTF-8 strings.

   Conformance with URN Syntax:
      The string representation of the GSMA URN and of the IMEI sub-
      namespace is fully compatible with the URN syntax.

   Validation Mechanism:
      The IMEI can be validated using the mechanism defined in Annex B
      of 3GPP TS 23.003 [2].  There is no mechanism defined to validate
      the SVN field of the IMEISV.

   Scope:  GSMA URN is global in scope.

Montemurro, et al.       Expires August 17, 2013                [Page 8]
Internet-Draft            The GSMA and IMEI URN            February 2013

4.  Specification

4.1.  IMEI Format

   The IMEI format is 15 decimal digits encoded in 8 octets using BCD as
   defined in 3GPP TS 24.008 [5].  The most significant digit is coded
   in the most significant bits of octet 1.  The least significant digit
   is coded in the least significant bits of octet 8.

       14 13 12 11 10  9  8  7  6  5  4  3  2  1  0  Decimal Digits
      +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
      |                       |                 | S|
      |            T          |          S      | p|
      |            A          |          N      | a|
      |            C          |          R      | r|
      |                       |                 | e|
      +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
         1     2     3     4     5     6     7     8  Octets

4.1.1.  Type Allocation Code (TAC)

   The TAC is a 8 decimal digit value.  The TAC identifies the type of
   the Mobile Equipment and is chosen from a range of values allocated
   to the Mobile Equipment manufacturer in order to uniquely identify
   the model of the Mobile Equipment.

4.1.2.  Serial Number (SNR)

   The SNR is a 6 decimal digit value.  The SNR is an individual serial
   number that uniquely identifies each Mobile Equipment within the TAC.

4.1.3.  Spare

   The Spare is a single decimal digit.  When the IMEI is stored on the
   Mobile Equipment and network equipment it contains a value that is
   used as a Check Digit and is intended to avoid manual reporting
   errors, (e.g. when customers register stolen mobiles at the
   operator's customer care desk) and also to help guard against the
   possibility of incorrect entries being provisioned in the network
   equipment.  The Spare is always set to zero when transmitted by the
   Mobile Equipment, (including when in the IMEI URN format).  Annex B
   of 3GPP TS 23.003 [2] defines a mechanism for computing the actual
   check digit in order to validate the TAC and SNR.

Montemurro, et al.       Expires August 17, 2013                [Page 9]
Internet-Draft            The GSMA and IMEI URN            February 2013

4.2.  IMEISV Format

   The IMEISV format is 16 decimal digits encoded in 8 octets using BCD
   as defined in 3GPP TS 24.008 [5].  The most significant digit is
   coded in the most significant bits of octet 1.  The least significant
   digit is coded in the least significant bits of octet 8.

       15 14 13 12 11 10  9  8  7  6  5  4  3  2  1  0  Decimal Digits
      +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
      |                       |                 |     |
      |            T          |          S      |  S  |
      |            A          |          N      |  V  |
      |            C          |          R      |  N  |
      |                       |                 |     |
      +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
            1     2     3     4     5     6     7     8  Octets

4.2.1.  Type Allocation Code (TAC)

   The TAC is the same as for the IMEI in Section 5.1.1.

4.2.2.  Serial Number (SNR)

   The SNR is the same as for the IMEI in Section 5.1.2.

4.2.3.  Software Version Number (SVN)

   The Software Version Number is allocated by the Mobile Equipment
   manufacturer to identify the software version of the Mobile
   Equipment.

5.  Community considerations

   GSM, UMTS and LTE mobile devices will be interoperating with Internet
   devices for a variety of voice and data services.  To do this, they
   need to make use of Internet protocols that will operate end to end
   between devices in GSM/UMTS/LTE networks and those in the general
   internet.  Some of these protocols require the use of URN's as
   identifiers.  Within the GSM/UMTS/LTE networks, mobile devices are
   identified by their IMEI and IMEISV.  Internet users will need to be
   able to receive and include the GSMA URN in various Internet protocol
   elements to facilitate communication between pure internet based
   devices and GSM/UMTS/LTE mobile devices.  Thus the existence and
   syntax of these namespaces needs to be available to the general
   internet community and the namespace needs to be reserved with IANA
   in order to guarantee uniqueness and prevent potential namespace

Montemurro, et al.       Expires August 17, 2013               [Page 10]
Internet-Draft            The GSMA and IMEI URN            February 2013

   conflicts both within the internet and within GSM/UMTS/LTE networks.
   Conversely, Internet implementations will not generally possess IMEI
   identifiers.  The identifiers generated by such implementations will
   typically be URNs within namespaces other than "gsma," and may,
   depending on context, even be non-URN URIs.  Implementations are
   advised to be ready to process URIs other than "gsma"-namespaced
   URNs, so as to aid in interoperability.

6.  Namespace considerations

   A URN was considered the most appropriate URI to represent the IMEI
   and IMEISV as these identifiers may be used and transported similarly
   to the Universally Unique Identifier (UUID)which is defined as a URN
   in [9].  Since specifications for protocols that are used to
   transport device identifiers often require the device identifier to
   be globally unique and in the URN format it is necessary that the URN
   formats are defined to represent the IMEI and IMEISV.

7.  IANA considerations

   In accordance with BCP 66 [1], IANA is asked to register the Formal
   URN Namespace 'GSMA' in the Registry of URN Namespaces, using the
   registration template presented in Section 3 of this document.

8.  Security considerations

   IMEIs (but with the Spare value set to the value of the Check Digit)
   are displayable on most Mobile Equipment; therefore, they must not be
   used as security capabilities (identifiers whose mere possession
   grants access), for example.

   Revealing the specific software version of the terminal might make
   the terminal more vulnerable to attacks against software that is
   known to contain security holes.  Care therefore SHOULD be taken
   regarding use of the IMEISV as it could help a malicious device
   identify Mobile Equipment running software that is known to be
   vulnerable to certain attacks.  This is a similar concern to the use
   of the User-Agent header in SIP as specified in RFC 3261 [10].  It is
   therefore RECOMMENDED that the IMEISV (that is, the IMEI URN with svn
   parameter) is not delivered to devices that are not trusted.
   Further, because IMEIs can be loosely correlated to a user, they need
   to be treated as any other personally identifiable information.  In
   particular, the IMEI URN MUST NOT be included in messages intended to
   convey any level of anonymity.

Montemurro, et al.       Expires August 17, 2013               [Page 11]
Internet-Draft            The GSMA and IMEI URN            February 2013

   Additional security considerations are specified in 3GPP TS 22.016
   [6].  Specifically the IMEI is to be incorporated in a module which
   is contained within the terminal.  The IMEI SHALL NOT be changed
   after the terminal's production process.  It SHALL resist tampering,
   i.e. manipulation and change, by any means (e.g. physical, electrical
   and software).

9.  Acknowledgements

   This document draws heavily on the 3GPP work on Numbering, Addressing
   and Identification in 3GPP TS 23.003 [2] and also on the style and
   structure used in RFC 4122 [9].  The authors would like to thank
   Cullen Jennings, Lisa Dusseault, Dale Worley, and Ivo Sedlacek for
   their help and comments.

10.  References

10.1.  Normative references

   [1]   Daigle, L., van Gulik, D., Iannella, R., and P. Faltstrom,
         "Uniform Resource Names (URN) Namespace Definition Mechanisms",
         BCP 66, RFC 3406, October 2002.

   [2]   3GPP, "TS 23.003: Numbering, addressing and identification
         (Release 8)", 3GPP 23.003, December 2012,
         <ftp://ftp.3gpp.org/Specs/archive/23_series/23.003/>.

   [3]   GSMA Association, "IMEI Allocation and Approval Guidelines",
         PRD TS.06 (DG06) version 6.0, July 2011, <http://www.gsma.com/
         newsroom/wp-content/uploads/2012/06/
         ts0660tacallocationprocessapproved.pdf>.

   [4]   Bradner, S., "Key words for use in RFCs to Indicate Requirement
         Levels", BCP 14, RFC 2119, March 1997.

   [5]   3GPP, "TS 24.008: Mobile radio interface Layer 3 specification;
         Core network protocols; Stage 3 (Release 8)", 3GPP 24.008,
         December 2012,
         <ftp://ftp.3gpp.org/Specs/archive/24_series/24.008/>.

   [6]   3GPP, "TS 22.016: International Mobile station Equipment
         Identities (IMEI)(Release 7)", 3GPP 22.016, May 2007,
         <ftp://ftp.3gpp.org/Specs/archive/22_series/22.016/>.

   [7]   Moats, R., "URN Syntax", RFC 2141, May 1997.

Montemurro, et al.       Expires August 17, 2013               [Page 12]
Internet-Draft            The GSMA and IMEI URN            February 2013

10.2.  Informative references

   [8]   Crocker, D. and P. Overell, "Augmented BNF for Syntax
         Specifications: ABNF", STD 68, RFC 5234, January 2008.

   [9]   Leach, P., Mealling, M., and R. Salz, "A Universally Unique
         IDentifier (UUID) URN Namespace", RFC 4122, July 2005.

   [10]  Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A.,
         Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP:
         Session Initiation Protocol", RFC 3261, June 2002.

Authors' Addresses

   Michael Montemurro (editor)
   Research in Motion (RIM)
   4701 Tahoe Dr
   Mississauga, Ontario  L4W 0B4
   Canada

   Phone: unlisted
   Fax:   unlisted
   Email: mmontemurro@rim.com

   Andrew Allen
   Research in Motion (RIM)
   1200 Sawgrass Corporate Parkway
   Sunrise, Florida  33323
   USA

   Phone: unlisted
   Fax:   unlisted
   Email: aallen@rim.com

   David McDonald
   unaffiliated

   Phone: unlisted
   Fax:   unlisted
   Email: mcdonalddm@hotmail.com

Montemurro, et al.       Expires August 17, 2013               [Page 13]
Internet-Draft            The GSMA and IMEI URN            February 2013

   Paul Gosden
   GSM Association
   1st Floor, Mid City Place, 71 High Holborn,
   London
   England

   Phone: unlisted
   Fax:   unlisted
   Email: pgosden@gsm.org

Montemurro, et al.       Expires August 17, 2013               [Page 14]