Identity & Addressing

CDMA2000 uses several overlapping identity systems — hardware identification, subscriber identity, network addressing, and privacy.

Identity Types

ESN — Electronic Serial Number

The ESN is a 32-bit hardware identifier burned into the mobile device at manufacturing. It uniquely identifies the physical device, independent of any subscriber or carrier.

• Used as a primary identifier on the reverse link (MSID_TYPE 001)
• Available for forward-link addressing when an IMSI address is unavailable
• Stored in the HLR and used to correlate a device to a subscriber
• Analogous to IMEI in GSM, but shorter (32-bit vs. 15 digits)

pESN (pseudo-ESN): Devices with a MEID instead of a native ESN generate a pseudo-ESN by hashing the MEID. The pESN is not guaranteed unique and should not be used alone for identification — it must be paired with the MEID or IMSI.

IMSI — International Mobile Subscriber Identity

The IMSI identifies the subscriber (the SIM/account), not the device. It follows the standard ITU E.212 structure but is encoded differently over the CDMA2000 air interface than in GSM/LTE.

Structure

The HLR stores IMSI as an authoritative decimal string, not as raw CDMA2000 bit fields. 1xBTS validates configured subscriber IMSIs as 10-15 decimal digits and derives the over-the-air IMSI_S fields when it needs to match access-channel identities or compute paging slots.

The full IMSI is up to 15 decimal digits:

MCC (3 digits) + MNC (2-3 digits) + MSIN (up to 10 digits)

For example: 310260123456789 = MCC 310 (USA) + MNC 260 + MSIN 123456789.

Over-the-Air Encoding

CDMA2000 splits the IMSI into binary fields for air interface transmission:

The combination IMSI_S = IMSI_M_S1 (24 bits) + IMSI_M_S2 (10 bits) = 34 bits represents the subscriber-specific part and is the most commonly used form for paging and registration. 1xBTS derives IMSI_S from the last 10 digits of the authoritative IMSI string using the C.S0005-E decimal-field encoding.

IMSI Classes

• Class 0 — Includes MCC and IMSI_11_12, but either field may be omitted over the air when it equals the current Extended System Parameters overhead.
• Class 1 — Shorter home-network form using IMSI_S, with class-specific treatment of MCC and IMSI_11_12.

MIN — Mobile Identification Number

The MIN is a 10-digit number derived from the mobile’s phone number assignment. In practice, MIN is encoded into the IMSI_S fields (IMSI_M_S1 + IMSI_M_S2) for over-the-air signaling.

MIN has two parts:

In modern CDMA2000 networks, MIN and IMSI_S are typically the same — the MIN is just the IMSI expressed as a phone-number-like format. 1xBTS stores subscriber IMSIs as decimal strings and derives the CDMA2000 IMSI_M_S1/IMSI_M_S2 fields when it needs the IMSI_S paging and access identity.

MDN — Mobile Directory Number

The MDN is the phone number — the 10-digit number that people dial to reach the subscriber. Unlike the other identifiers, the MDN is never transmitted over the air interface. It exists only in the network:

• Stored in the HLR subscriber record
• Used for SMS routing (lookup destination by MDN)
• Used in the web dashboard and API for human-readable identification
• Can be changed without affecting the device or IMSI

The MDN and MIN are often the same digits, but they don’t have to be. The MDN is a routing/directory concept; the MIN/IMSI is an air interface identity.

MEID — Mobile Equipment Identifier

The MEID is the 56-bit successor to the ESN, introduced when the 32-bit ESN space started running out.

Key rules for MEID handling:

• Sent on the reverse link as an Extended MSID (MSID_TYPE 100, EXT_MSID_TYPE 000)
• Cannot be used for forward-link addressing — per C.S0004-E 3.1.2.2.2, the base station must use the ESN or IMSI that accompanies the MEID instead
• Devices with a MEID generate a pseudo-ESN (pESN) for backwards compatibility
• When a mobile sends MEID, it typically also includes IMSI and/or ESN alongside it

TMSI — Temporary Mobile Station Identity

The TMSI provides privacy by replacing the permanent IMSI with a temporary, network-assigned identifier. This prevents tracking a subscriber by their IMSI over the air.

TMSI assignment and zone configuration is controlled by the Extended System Parameters Message:

• USE_TMSI — Enable/disable TMSI addressing
• TMSI_ZONE_LEN — Zone identifier length
• TMSI_ZONE — Zone value
• PREF_MSID_TYPE — Preferred identity type (0=ESN, 1=IMSI, 2=TMSI)

Reverse-Link Identification (MSID_TYPE)

When a mobile transmits on the access channel (registration, origination, page response), it includes an MSID_TYPE field that tells the base station which identity format follows:

Extended MSID Types

When MSID_TYPE = 100, a secondary EXT_MSID_TYPE field specifies the extended identity:

Forward-Link Addressing (ADDR_TYPE)

When the base station needs to address a specific mobile on the forward link (paging, directed messages), it uses the ADDR_TYPE field:

Address priority: MEID is never used for forward-link addressing. When a class-0 IMSI is available, 1xBTS keeps the resolved MCC and IMSI_11_12 with the runtime address and lets the encoder choose the shortest valid OTA form against current overhead. Otherwise it falls back to ESN and then IMSI_S when available.

Paging Slot Computation

CDMA2000 uses slotted paging to save mobile battery life. Each mobile monitors only specific slots on the paging channel, determined by a hash of its IMSI_S:

PGSLOT = hash(IMSI_M_S1, IMSI_M_S2) mod 2048

The hash function is defined in C.S0005-E Section 2.6.7.1. The result is a slot number from 0 to 2047. The base station must page the mobile in its assigned slot for the page to be received.

The slot cycle index (SCI) controls how frequently the mobile wakes up to check its slot — higher values mean longer sleep periods and better battery life, at the cost of increased paging latency.

Identity Resolution in 1xBTS

A subscriber identity requires IMSI plus ESN or MEID. IMSI alone does not establish a subscriber match. When all three are received, every hardware field provisioned on the matching identity must agree. A record provisioned with IMSI+MEID can match without a stored ESN.

On software BTS cells, MEID-capable handsets may initially report only IMSI and a pseudo-ESN. If that does not resolve the subscriber, the network requests MEID before completing registration, call setup, or access-channel SMS processing. Discovery does not require an authentication response. A cached identity avoids repeating discovery. If IMSI+ESN already matches, service proceeds and MEID can be requested afterward.

Learning MEID updates the observed device identity. It does not create a subscriber, change the provisioned identity, or install authentication credentials. A handset can therefore appear in Mobiles without an associated subscriber.

Registration bindings record the matched subscriber and serving base station. MT calls and subscriber-number SMS use that registration to locate the handset. Paging uses IMSI or ESN and the handset’s assigned paging slot, never MEID. A Status Request that acknowledges a current access can use the handset’s active listening window. Idle queries and retries wait for its paging slot.

For subscriber setup, MEID discovery, and A-key provisioning, see Authentication & Voice Privacy.

Identity Relationships

Device (hardware)
  ├── Native ESN (32-bit)
  └── MEID (56-bit)
        └── pESN (derived from MEID, not unique)

Subscriber (account)
  ├── MDN (phone number, network-only)
  └── Provisioned identities (one selected as primary)
        ├── IMSI + ESN
        ├── IMSI + MEID
        └── IMSI + ESN + MEID

Radio addressing
  └── IMSI or ESN, never MEID
        └── IMSI_S derived from IMSI for paging

A subscriber can have multiple provisioned identities. Each identity combines IMSI with ESN or MEID, and one identity is selected as primary. Learning a device’s MEID does not add or change these provisioned identities. The HLR validates IMSI strings before storing them.