Identity & Addressing

CDMA2000 uses several overlapping identity systems — hardware identification, subscriber identity, network addressing, and privacy.

Identity Types

ESN — Electronic Serial Number

The ESN is a 32-bit hardware identifier burned into the mobile device at manufacturing. It uniquely identifies the physical device, independent of any subscriber or carrier.

• Used as a primary identifier on the reverse link (MSID_TYPE 001)
• Preferred for forward-link addressing when available
• Stored in the HLR and used to correlate a device to a subscriber
• Analogous to IMEI in GSM, but shorter (32-bit vs. 15 digits)

pESN (pseudo-ESN): Devices with a MEID instead of a native ESN generate a pseudo-ESN by hashing the MEID. The pESN is not guaranteed unique and should not be used alone for identification — it must be paired with the MEID or IMSI.

IMSI — International Mobile Subscriber Identity

The IMSI identifies the subscriber (the SIM/account), not the device. It follows the standard ITU E.212 structure but is encoded differently over the CDMA2000 air interface than in GSM/LTE.

Structure

The HLR stores IMSI as an authoritative decimal string, not as raw CDMA2000 bit fields. 1xBTS validates configured subscriber IMSIs as 10-15 decimal digits and derives the over-the-air IMSI_S fields when it needs to match access-channel identities or compute paging slots.

The full IMSI is up to 15 decimal digits:

MCC (3 digits) + MNC (2-3 digits) + MSIN (up to 10 digits)

For example: 310260123456789 = MCC 310 (USA) + MNC 260 + MSIN 123456789.

Over-the-Air Encoding

CDMA2000 splits the IMSI into binary fields for air interface transmission:

The combination IMSI_S = IMSI_M_S1 (24 bits) + IMSI_M_S2 (10 bits) = 34 bits represents the subscriber-specific part and is the most commonly used form for paging and registration. 1xBTS derives IMSI_S from the last 10 digits of the authoritative IMSI string using the C.S0005-E decimal-field encoding.

IMSI Classes

• Class 0 — Includes MCC and IMSI_11_12, but either field may be omitted over the air when it equals the current Extended System Parameters overhead.
• Class 1 — Shorter home-network form using IMSI_S, with class-specific treatment of MCC and IMSI_11_12.

MIN — Mobile Identification Number

The MIN is a 10-digit number derived from the mobile’s phone number assignment. In practice, MIN is encoded into the IMSI_S fields (IMSI_M_S1 + IMSI_M_S2) for over-the-air signaling.

MIN has two parts:

In modern CDMA2000 networks, MIN and IMSI_S are typically the same — the MIN is just the IMSI expressed as a phone-number-like format. 1xBTS stores subscriber IMSIs as decimal strings and derives the CDMA2000 IMSI_M_S1/IMSI_M_S2 fields when it needs the IMSI_S paging and access identity.

MDN — Mobile Directory Number

The MDN is the phone number — the 10-digit number that people dial to reach the subscriber. Unlike the other identifiers, the MDN is never transmitted over the air interface. It exists only in the network:

• Stored in the HLR subscriber record
• Used for SMS routing (lookup destination by MDN)
• Used in the web dashboard and API for human-readable identification
• Can be changed without affecting the device or IMSI

The MDN and MIN are often the same digits, but they don’t have to be. The MDN is a routing/directory concept; the MIN/IMSI is an air interface identity.

MEID — Mobile Equipment Identifier

The MEID is the 56-bit successor to the ESN, introduced when the 32-bit ESN space started running out.

Key rules for MEID handling:

• Sent on the reverse link as an Extended MSID (MSID_TYPE 100, EXT_MSID_TYPE 000)
• Cannot be used for forward-link addressing — per C.S0004-E 3.1.2.2.2, the base station must use the ESN or IMSI that accompanies the MEID instead
• Devices with a MEID generate a pseudo-ESN (pESN) for backwards compatibility
• When a mobile sends MEID, it typically also includes IMSI and/or ESN alongside it

TMSI — Temporary Mobile Station Identity

The TMSI provides privacy by replacing the permanent IMSI with a temporary, network-assigned identifier. This prevents tracking a subscriber by their IMSI over the air.

TMSI assignment and zone configuration is controlled by the Extended System Parameters Message:

• USE_TMSI — Enable/disable TMSI addressing
• TMSI_ZONE_LEN — Zone identifier length
• TMSI_ZONE — Zone value
• PREF_MSID_TYPE — Preferred identity type (0=ESN, 1=IMSI, 2=TMSI)

Reverse-Link Identification (MSID_TYPE)

When a mobile transmits on the access channel (registration, origination, page response), it includes an MSID_TYPE field that tells the base station which identity format follows:

Extended MSID Types

When MSID_TYPE = 100, a secondary EXT_MSID_TYPE field specifies the extended identity:

Forward-Link Addressing (ADDR_TYPE)

When the base station needs to address a specific mobile on the forward link (paging, directed messages), it uses the ADDR_TYPE field:

Address priority: MEID is never used for forward-link addressing. When a class-0 IMSI is available, 1xBTS keeps the resolved MCC and IMSI_11_12 with the runtime address and lets the encoder choose the shortest valid OTA form against current overhead. Otherwise it falls back to ESN and then IMSI_S when available.

Paging Slot Computation

CDMA2000 uses slotted paging to save mobile battery life. Each mobile monitors only specific slots on the paging channel, determined by a hash of its IMSI_S:

PGSLOT = hash(IMSI_M_S1, IMSI_M_S2) mod 2048

The hash function is defined in C.S0005-E Section 2.6.7.1. The result is a slot number from 0 to 2047. The base station must page the mobile in its assigned slot for the page to be received.

The slot cycle index (SCI) controls how frequently the mobile wakes up to check its slot — higher values mean longer sleep periods and better battery life, at the cost of increased paging latency.

Identity Resolution in 1xBTS

When a mobile registers or originates a call, 1xBTS resolves its identity through the HLR:

1. Access channel — Mobile sends Registration/Origination Message with MSID_TYPE and identity payload
2. BSC decodes — Extracts ESN, IMSI fields, or MEID depending on MSID_TYPE
3. IMSI derivation — If the access message only carries CDMA2000 IMSI fields, BSC reconstructs a full decimal IMSI when MCC and IMSI_11_12 are present or implied by overhead
4. HLR lookup — BSC queries the HLR by ESN, full IMSI, or by deriving IMSI_S from stored subscriber IMSIs
5. Binding update — HLR stores the authoritative IMSI string, ESN, MOB_P_REV, PGSLOT, slot-cycle index, and registration timestamps
6. Paging slot — Computed from IMSI_M_S1/IMSI_M_S2 and stored for efficient paging

When the network needs to reach the mobile later (MT call, SMS delivery), the BSC uses the live mobile registry’s forward/page address and the computed paging slot. The HLR binding is the subscriber registration record; it is not the raw forward-link page record.

The registration identity and the subscriber binding are intentionally shown separately in the dashboard. A registration may expose a complete over-the-air IMSI, partial IMSI fields, ESN, MEID, or MIN-style identity depending on the mobile and message type. For class-0 IMSI identities, omitted MCC or IMSI_11_12 means “same as overhead”; 1xBTS resolves those values before building class-0 forward and page addresses. The HLR binding records the matched subscriber relationship and authoritative IMSI/ESN state; it should not be treated as a verbatim copy of every registration field.

Identity Relationships

Device (hardware)
  └── ESN (32-bit) or MEID (56-bit)
        └── pESN (derived from MEID, not unique)

Subscriber (account)
  └── IMSI (10-15 decimal digits, authoritative in HLR)
  │     └── IMSI_S = IMSI_M_S1 + IMSI_M_S2 (34-bit, over-the-air)
  │     └── MCC + IMSI_11_12 (Class 0 only)
  └── MDN (phone number, network-only)
  └── MIN (10-digit, encoded as IMSI_S)

Temporary
  └── TMSI (assigned by network, replaces IMSI on air)

A single subscriber can be associated with multiple identities, including IMSI and ESN, and a device can be re-associated with a different subscriber. The HLR maintains these relationships, validates IMSI strings before storing them, and tracks which identity is currently primary.