Network Working Group F. Dupont Internet-Draft Point6 Expires: October 27, 2005 L. Nuaymi GET/ENST Bretagne April 25, 2005 IMEI-based universal IPv6 interface IDs draft-dupont-ipv6-imei-09.txt Status of this Memo By submitting this Internet-Draft, each author represents that any applicable patent or other IPR claims of which he or she is aware have been or will be disclosed, and any of which he or she becomes aware will be disclosed, in accordance with Section 6 of BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on October 27, 2005. Copyright Notice Copyright (C) The Internet Society (2005). Abstract The IPv6 addressing architecture defines a modified EUI-64 format for interface identifiers. These interface identifiers may have global scope when a global token is available (e.g., IEEE 802 48-bit MAC or IEEE EUI-64 identifiers). Such a global token, the IMEI (International Mobile station Equipment Identity), is defined for GSM and UMTS terminals and has the same properties than identifiers based on IEEE standards. Dupont & Nuaymi Expires October 27, 2005 [Page 1] Internet-Draft IMEI-based interface IDs April 2005 This document explains the construction of a global IPv6 interface identifier from an IMEI. 1. Modified EUI-64 Interface Identifiers The modified EUI-64 format defined by [1] is required for all unicast addresses, except those that start with binary value 000. Two bits have a special role in IEEE EUI-64 and in modified EUI-64: the "u" bit, one means global scope, zero local scope, and the "g" bit which is the "individual/group" in IEEE standards and is always set to zero for any modified EUI-64 identifier derived from an IEEE 802 identifier. So when both the "u" and "g" bits are set to one, a modified EUI-64 identifier has a global scope (i.e. is universal) and is not derived from an IEEE identifier. 2. IMEIs The IMEI (International Mobile station Equipment Identities) is 14 decimal digit number attached to the hardware of any GSM [2], [3] or UMTS [4] terminal. It is usually written on a label in the battery compartment of the handset, displayed when dialing the code *#06# (it can come with a spare digit and/or the software version number), returned by the AT+CGSN command [6] , etc. The Mobile Station Equipment is uniquely defined by the IMEI. The EIR (Equipment Identity Register) is the database of all IMEIs, it can be used in order to block or trace stolen terminals even only some operators currently check IMEIs. The IMEI has been divided into a Type Approval Code (which begins by a country code) on 6 decimal digits followed by a Final Assembly Code on 2 decimal digits and the Serial Number on 6 decimal digits since 1/1/2003, and is now divided into a Type Allocation Code and the Serial Number, both on 6 decimal digits [7]. The IMEI has the same properties than an IEEE MAC-48 address, it is attached to the hardware and reveals only basic information like the producer and the model of the hardware (this is not always true for ESN (Electronic Serial Numbers) which are used in some USA mobile phone networks). IMEIs are globally unique, two different equipments can be assumed to have different IMEIs and when this is not true (manufacturer error, hardware problem, cloning) the problem can cause damage at a higher level than interface identifier collision, exactly as a MAC address collision is a very serous incident which has nothing in common with an interface identifier collision. Dupont & Nuaymi Expires October 27, 2005 [Page 2] Internet-Draft IMEI-based interface IDs April 2005 3. MEIDs CDMA2000 is adopting 3G Mobile Equipment Identifiers (MEIDs) [8] which are syntactically consistent with IMEIs. Both IMEIs and MEIDs use 56 bit identifier structure. MEIDs consist of a manufacturer code of 8 hexadecimal digits and a serial number of 6 hexadecimal digits. This document can be directly applied to MEIDs as proposed in [9]. 4. IMEI/MEID-based Interface Identifiers This document defines a method to create an interface identifier in the modified EUI-64 format from an IMEI or a MEID. The first octet is 03 in hexadecimal ("u" and "g" bits set to one, others to zero) followed by the 14 decimal digits of the IMEI in BCD (Binary Coded Decimal), i.e. with each decimal digit mapped to its value on 4 bits. Or 03 in hexadecimal followed by the 14 hexadecimal digits of the MEID. The IMEI 330001 53 007826 gives the 0333:0001:5300:7826 (usually written 333:1:5300:7826) interface identifier. 5. IMEI/MEID-based DHCPv6 Unique Identifiers DHCPv6 specifications [5] define unique and stable identifiers (DUIDs) for clients and servers. When a device has no other network interface than the mobile phone one, the IMEI/MEID seems to be the best choice for a hardware attached identifier. Unfortunately there is currently no provision for DUIDs derived from this kind of hardware attached identifiers, so our proposal is to use vendor-based DUIDs (DUID-EN, section 9.3, type 2) with the enterprise number assigned to the vendor or manufacturer of the device, or, when there is none, with by default the ETSI enterprise number (13019 [10]). 6. Security Considerations The security considerations of IMEI-based interface identifiers are exactly the same than for IEEE EUI-64, EUI-48 or MAC-48 based interface identifiers. The concerns about traceability and/or privacy are addressed in [11] and its current revision [12]. The IMEI is supposedly used to report stolen terminals to telecom operators. It seems common sense that these operators are to perform Dupont & Nuaymi Expires October 27, 2005 [Page 3] Internet-Draft IMEI-based interface IDs April 2005 some additional owner's identity verification before accepting such kind of report. Somebody capable of intercepting the IMEI of a terminal cannot easily report it as stolen. 7. Acknowledgments The idea came during an E-mail exchange about Marcelo Bagnulo's draft [13] on random generation of interface identifiers. Our GSM expert, Xavier Lagrange, provides in some seconds all the GSM and 3GPP references and the (real) IMEI of the example. The same idea was developed in the EU project "Moby Dick" [14] (signaled by Michelle Wetterwald). Pierre Dupont from Motorola warned about the format change. Bruno Stevant from Cyberte project gave the AT command to retrieve the IMEI. Wassim Haddad from Ericsson Canada proposed to extend the document to new 3GPP2's MEIDs. Thanks to Lila Madour for supporting the idea [15] and to Ultan Mulligan for discussion about the possible usage in DHCPv6 DUIDs of the ETSI enterprise number. 8. Changes from Previous Drafts The Security Considerations section was updated to answer to a concern raised at the 53th IETF at Minneapolis in March 2002. A reference to a conference paper which includes this idea was added in the Informative References section. The document was updated to take the IMEI format change into account. The AT command was added. Some suggested presentation changes [15] were integrated but more is scheduled for the next version near the end of year. 9. References 9.1 Normative References [1] Hinden, R. and S. Deering, "Internet Protocol Version 6 (IPv6) Addressing Architecture", RFC 3513, April 2003. [2] ETSI, "Digital cellular telecommunications system: Numbering, addressing and identification", ETS 300 927, GSM 03.03, November 1999. [3] ETSI, "Digital cellular telecommunications system: International Mobile station Equipment Identities (IMEI)", GSM 02.16, February 2000. [4] 3GPP, "3rd Generation Partnership Project: Technical Dupont & Nuaymi Expires October 27, 2005 [Page 4] Internet-Draft IMEI-based interface IDs April 2005 Specification Group Core Network; Numbering, addressing and identification (Release 1999)", 3GPP TS 23.003, June 2001. [5] Droms, R., Ed., Bound, J., Volz, B., Lemon, T., Perkins, C., and M. Carney, "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)", RFC 3315, July 2003. 9.2 Informative References [6] ETSI, "Digital cellular telecommunications system (Phase 2+): AT command set for GSM Mobile Equipment (ME)", GSM 07.07, July 1996. [7] GSM Association, "IMEI Allocation and Approval Guidelines", PRD TW.06, September 2002. [8] 3GPP2, "3G Mobile Equipment Identifier (MEID)", 3GPP2 S.R0048-A v3.0, September 2004. [9] Haddad, W., "Using Mobile Equipment Identifier (MEID) to configure IPv6 address in 3G terminals (private communication)", December 2003. [10] Mulligan, U., "(private communication)", April 2005. [11] Narten, T. and R. Draves, "Privacy Extensions for Stateless Address Autoconfiguration in IPv6", RFC 3041, January 2001. [12] Narten, T., Draves, R., and S. Krishnan, "Privacy Extensions for Stateless Address Autoconfiguration in IPv6", draft-ietf-ipv6-privacy-addrs-v2-00.txt (work in progress), September 2004. [13] Bagnulo, M., Soto, I., Garcia-Martinez, A., and A. Azcorra, "Random generation of interface identifiers", draft-soto-mobileip-random-iids-00.txt (work in progress), January 2002. [14] Liebsch, M., Perez, X., Schmitz, R., Sarma, A., Jaehnert, J., Tessier, S., Wetterwald, M., and I. Soto, "Solutions for IPv6- based mobility in the EU project Moby Dick", WTC 2002, Paris, September 2002. [15] Madour, L., "(private communication)", 2004. Dupont & Nuaymi Expires October 27, 2005 [Page 5] Internet-Draft IMEI-based interface IDs April 2005 Authors' Addresses Francis Dupont Point6 c/o GET/ENST Bretagne 2 rue de la Chataigneraie CS 17607 35576 Cesson-Sevigne Cedex France Fax: +33 2 99 12 70 30 Email: Francis.Dupont@enst-bretagne.fr Loutfi Nuaymi GET/ENST Bretagne 2 rue de la Chataigneraie CS 17607 35576 Cesson-Sevigne Cedex France Fax: +33 2 99 12 70 30 Email: Francis.Dupont@enst-bretagne.fr Dupont & Nuaymi Expires October 27, 2005 [Page 6] Internet-Draft IMEI-based interface IDs April 2005 Intellectual Property Statement The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79. Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org. Disclaimer of Validity This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Copyright Statement Copyright (C) The Internet Society (2005). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. Acknowledgment Funding for the RFC Editor function is currently provided by the Internet Society. Dupont & Nuaymi Expires October 27, 2005 [Page 7]