2

Advisory

"This Nortel Plan of Record lists possible, not committed features, functionality and other products that Nortel may or may not offer to its customers in the future. It is provided for informational and illustrative purposes only. Nortel is under no obligation to provide any of the listed features, functionality or products in this Plan of Record, and it should not be relied upon in making a purchasing decision. If and when these features, functionality and products are offered for sale by Nortel, they will be sold at competitive prices and under agreed upon terms and conditions."

3

Overview of MEID Solution

CDMA Marketing and Product Line Management

Version 2.0

April 2007

4

• MEID stands for Mobile Equipment IDentifier and addresses mobile Electronic Serial Number (ESN) exhaustion

• MEID replaces ESN as an unique identifier in CDMA mobiles

• Estimated depletion of ESN probable to occur in the 2nd half of 2007

• Provides unique identifier for billing, fraud detection, inventory and activation in carrier’s back office system

• MEID solution is not mandatory for call processing

• Differences between MEID and ESN

What is MEID?

MEID resolves ESN shortage to uniquely identify the mobile

• MEID is 7 bytes/56 bits long

• MEID comprises of:• 4-byte manufacturer code • 3-byte Serial Number

• ESNs is 4 bytes/32 bits long

• ESN comprises of:• 1-byte manufacturer code • 3-byte serial number

5

• Pseudo ESN (pESN) enables MEID capable mobiles to interact with the network

• pESN is an ESN derived from the MEID using SHA-1 industry algorithm

• All MEID phones use pESN instead of ESN in all IS-2000 messages

• pESNs are not unique (only 16.7 million) and can collide between MEID mobiles

• Pseudo ESNs have manufacturer code set to 0x80 and can never collide with real ESN mobile

• MEID solution provides alternate methods of Public Long Code Mask (PLCM) assignment

• PLCM is used to uniquely identify the mobile data in reverse direction

• Multiple PLCM algorithms supported:• ESN-derived PLCM is default PLCM after network upgrade

• As pESNs are not unique, there is possibility of call collisions

• MEID derived PLCM helps prevent call collisions and addresses additional security concerns

• BS-assigned PLCM completely prevents call collisions

What is Pseudo ESN?

6

• Initial industry planned to provide MEID solution in IS-2000 rev D

• With ESN exhaustion issues next year, industry plans to provide interim solution to resolve the issue

• Interim MEID solution• Enables MEID to be retrieved from IS-2000 0/A/B/C mobiles• Allows alternate methods to derive PLCM to minimize collisions• Support added to ANSI-41, IOS 5.0.1 and IS-683D (OTA)• pESN provides work-around for MEID mobiles to access non-MEID compliant

network

• Potential future plans• Little or no momentum in the industry for supporting IS-2000 rev D • Interim solution provides all required capabilities and resolves all ESN

exhaustion issues

Industry Roadmap for MEID solution

MEID capable mobiles to start shipping in mid-2006

7

• MEID functionality• Support MEID for CDMA 2000 solution in MTX release 14

• Support MEID, BS assigned or ESN derived PLCM

• Support MEID for Nortel EVDO solution in EVDO release 4.0 • Based on configuration, RNC can send pseudo-ESN or MEID or both across A11 interface to PDSN

• Pseudo ESN functionality• Support pESN for CDMA 2000 solution in all MTX releases

• pESN is treated like existing ESNs for authentication, validation, billing, etc

• Use of pESN for ESN-based MTX Electronic Surveillance not permitted

• Nortel Authentication Center supports pESN beginning MTX14

• Support pESN for Nortel EVDO solution from EVDO release 3.0.x• Enhanced to provide pseudo-ESN across A11 interface to the PDSN

• Supports inter-RNC dormant handoff for MEID based access terminals

• POI Candidates for upcoming releases• MEID validation based on 3GPP2 X.S0008

• A10-A11 1xRTT PCU-PDSN interface based on IOS 5.0.1

• EVDO RNC enhancement to send ESN or MEID across A12 to the AN-AAAs

Nortel Roadmap for MEID solution

Nortel MEID solution available in MTX14 and EVDO 4.0 release

8

MEID Query Call Flow

H.248

CDMAAccess

BSC

MGW

MGW

OAM

GWC

LAN

OAM

GWC

LAN

MRF

GWC

SGWH.248

Call flow for first MEID M-M call with Query MEID office parm set to call only

MEID is queried only once and saved in VLR for future calls

Mobile Origination message with MEID Info available set in

SCM parameter

CPU RAN

SGW

LPP

Nortel MGCF (Packet

MSC)

CDMAAccess

BSC

MSC sets up the traffic channel with the mobile. MSC

also checks VLR for MEID information, if unavailable

MSC saves MEID in VLR for future queries and

completes the call

After traffic channel is established, MSC

send Status Request message to

mobile

Mobile sends Status Response with

MEID information

MSC pages mobile and page response from

mobile has MEID Info available set in SCM

parameter

After traffic channel is established, MSC

send Status Request message to

mobile

Mobile sends Status Response with

MEID information

9

MEID Call Processing Enhancements• MEID Query

• CDG compliant mobiles use bit 4 of Station Class Mark (SCM) to indicate MEID support• If mobile is MEID-capable, then MSC queries MEID based on new office parameter

• Configurable options to query MEID: Never, Registrations only, Calls only, Registration & Calls

• MEID queried from the mobile is stored in VLR for subsequent calls• MEID is *not* queried on SMS

• Introduce new Over the Air messages• MEID Enhanced Channel Assignment Message (MECAM) to support PLCM types• MEID Universal Handoff Direction Message (MUHDM) to support PLCM types

• Public Long Code Mask (PLCM) enhancements • New PLCMTypeConfig attribute introduced on BSC to configure PLCM algorithm• Supports existing ESN-derived PLCM• Introduce MEID-derived PLCM and proprietary BS-assigned PLCM• Enhance ANSI-41 hard handoff messages to pass PLCM and/or MEID between source and target

• pESN handling• Modifications to Authentication Center to accommodate duplicate pESNs• Provisioning of pESN for ESN-based MES (CALEA) is blocked

10

MEID Billing Enhancements•CDR and SMS CDR Enhancements

• Existing Serial Number fields are expanded to 19 nibbles/digits to accommodate the new 56-bit (hex) MEID

• Serial number fields in Voice CDR are: CLLNGSER, CALLDSER, and BLLNGSER• Serial number fields in SMS CDR are: CLLNGSER and CALLDSER

• When MEID is available, MEID is populated in serial number field• Serial Number field comprises of 18 digit MEID followed by 1 trailing #B filler digit

• When MEID is unavailable, then Pseudo ESN populates serial number field• Pseudo-ESN values presented similar to ESN, with manufacturer code set to 0x80• Serial Number field comprises of 11 digit ESN followed by 8 trailing #B filler digits

•MEID is not reported in UDRs in MTX14 and only pseudo ESN is reported

Manufacturer's Code (MC) Unit Number Filler Digits (#B)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

Manufacturer's Code (MC) Serial NumberFiller(#B)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

11

MEID OAM Enhancements

• Performance Management Enhancements• OM registers on MTX to collect statistics for true ESN and MEID capable mobiles• OM registers on BTS to collect MECAM message statistics on paging channel• OM registers on BSC to track BS-assigned, ESN and MEID derived PLCM

• Logging Enhancements• Enhanced diagnostic logs at MTX

• MTXT 139 log to report invalid combination of ESN and MEID support indicator in SCM• AUTH 206 log to address possibility of pESN duplication for MEID-capable mobiles

• Enhanced diagnostic logs at BTS • PgMessageTypeCount and PgMessageDiscardCount to account for new MECAM messages

• Enhanced call summary logs at BSC to include three new PLCM types, SCM and PLCM collision with EBID information

• Fault Management• Introduces MTX Downgraded alarm on MTX MO• Alarm generated when MTX is downgraded lower than 14.0 release• Alarm requires operator to change PLCMTypeConfig attribute on BSC to

ESN_Preferred

12

MEID Configuration Changes

• Datafill changes on MTX:• Introduces office parameter QUERY_MEID to configure when MEID is queried from MEID

capable mobile

• Authentication Center – table ACDATA modified to accept the direct association of MIN with ESN and A-key for pESN and regular ESN

• MTX Electronic Surveillance Command Interface -- provisioning of pESN for ESN-based surveillances is blocked

• Datafill changes on BSC/EBSC:• Introduces PLCMTypeConfig attribute on SystemSelectorSubsystem MO to derive PLCM

value from either ESN, MEID or BS assigned

• Datafill changes on BTS:• Three attributes added on BTSCallProcessing MO to control BS-assigned PLCM prefix

• BSAssignedPLCMPrefixConfigMethod attribute configures method to derive BS-assigned PLCM prefix

• Automatic: BTS automatically generates a prefix value guaranteed to be unique across all BTSs in a network

• User-configurable: Allows operator to assign unique value as prefix

• BSAssignedPLCMPrefix attribute allows operator to datafill BS-assigned PLCM prefix

• BSAssignedPLCMPrefixInUse attribute allows operator to get the value of PLCM prefix in use

13

MEID IOS Enhancements•IOS 5.0.1 provides support for MEID mobiles

•IOS specific call processing enhancements• Station Class Mark (SCM) parameter enhanced to support MEID indicator bit

sent by the mobile• Classmark Info Type 2 IE carries the SCM field in Location Updating Request

(registration), CM Service Request (origination), Paging Response (termination) messages

• Status Request and Status Response messages are enhanced to query MEID from the mobile. Once MEID is available, it is stored in VLR for future calls

• MTX→BSC MEID notification enhancements• When MEID is available in VLR, MEID is sent from MTX to BSC in Assignment

Request and Paging Request messages.

• Handoff messages enhancements to pass PLCM and MEID information to allow PLCM setup on the target side

• Following messages have been updated: Handoff Command, Handoff Request, Handoff Request Acknowledgement, Handoff Required

14

MEID EvDO Enhancements•EVDO 3.0.x

• RNC supports ATs with a HardwareID type of MEID within the network.• RNC sends pseudo-ESN across the A11 interface to the PDSN.• If no AN-AAA is configured in the network, RNC generates pseudo-IMSI from MEID.• RNC transfers the HardwareID from the source RNC to target RNC during an inter-

RNC dormant handoff.• Stale session detection extended to handle duplicate MEID values.• Basic OM and EMS support added.

•EVDO 4.0• RNC sends pseudo-ESN or MEID or both across A11, depending on operator

configuration.• Single step lookup of session/connection information using HardwareID and IMSI.

•EVDO 5.0 POI• RNC includes HardwareID, ESN or MEID, depending on the type of AT, across A12 to

the AN-AAA.• RNC OMs extended to assist identification of stale session.• Minor EMS and CLI extensions.

Complete EvDO MEID solution delivered across multiple releases.

15

MEID Capacity Impacts

•MEID query• Querying for MEID it is an additional set of

status Request/Response messages• MEID queried for all voice and data calls,

except SMS

•Factors influencing MEID capacity impact• Percentage of MEID-capable mobiles• Subscriber mobility i.e. out-of-VLR

registrations• Configuration settings for Query_MEID

parameter• Call Model of voice/data/SMS calls in network

Call Model for Analysis: - 580k BHCA - 20% MEID mobiles - 90% Voice, 10% Data

CM CAU CIU ACE BSC/BTS

Query MEID set to Never

No Impact

No Impact

No Impact

No impact

No Impact

Query MEID set to CALL_ONLY

0.06% 1.02% 0.93% 1.69% Negligible Impact

Query MEID set to REG_ONLY

0.06% 1.40% 1.30% 2.02% Negligible Impact

Query MEID set to REG_CALL

0.12% 1.45% 1.35% 2.11% Negligible Impact

• Results:

• Querying on registration is more expensive that querying during a call

• At 100% MEID mobile penetration with Query MEID set to REG_CALL• CM impact is minimal• About 7% impact to CAU and CIU capacity, but still below engineering limits• Call setup time can rise by as much as ~2%• At engineering limits, access channel and paging channel capacity loss are estimated at ~30% and

~20%

16

MTX15: MEID Validation Feature

17

Overview of MEID Validation Feature

• MEID Validation Feature:• Provides enhancement to existing MEID feature to validate mobile MEID• Based on standards TIA-928-2 and 3GPP2 X.S0008-0 v2.0• Validate MEID for mobiles with inactive authentication• Involves MEID provisioning in the HLR and MSC provisioning for feature

activation

• Validate MEID Functionality:• On initial access, MEID is queried from mobile and sent to HLR in ANSI-41

REGNOT message• HLR compares MEID in REGNOT message to MEID provisioned in the

HLR database• Successful comparison results in MEID_Validated parameter included in regnot• Failed comparison results in AUTHDEN parameter with “Invalid Serial Number”

• After successful HLR-based validation, each subsequent access queries the mobile for its MEID and executes local VLR-based MEID validation

18

MEID Validation Feature

Key provisioning changes:• Feature activation in MSC:

• Office Parameter MEID_VALIDATE turns on/off the overall validation capability (Range: N/Y, Default: N)

• Office Parameter MEID_VALIDATE_STAT_RESP_TIMEOUT sets the timeout value (in seconds) for receiving the MEID query Status Response message (Range: 0-44, Default: 10)

• New field “MEID_VAL_CAPABLE” in table SERVCHNG to activate the HLR Validation functionality for a range of mobiles

• MEID provisioning in HLR:• Office Parameter MEID_VALIDATE is used to turn on/off validation at the HLR

(Range: N/Y, Default: N)• New Table HLRMEID associates a DN with an MEID

• Value Proposition:• Ability to quickly and efficiently validate mobile by validating MEID in HLR/VLR

19

Summary

20

Summary• Advantages of Nortel MEID Solution:

• Allows overcome ESN exhaustion problem • Enhances operators’ network to efficiently work with MEID capable mobiles• Avoid collision and cross-talk between mobiles in the reverse direction • Ability to customize PLCM algorithms • Ability to reduce capacity impact by configuring scenarios to query MEID• MEID information in CDRs helps uniquely identify the mobile• Ability to validate MEID mobiles for all calls

• Program dates:• MTX14 Generally Available• MTX15

• Customer Ready (CuR) planned: 2007wk20• Channel Ready (ChR) planned: 2007wk38

• IOT with mobile vendors• Completed IOT with Samsung, Motorola, and LG mobiles

Nortel delivers MEID solution in MTX14 (ChR 4Q2006)

21

Abbreviations and DefinitionsAbbreviation Definition

ANSI American National Standards Institute

BS Base Station

BSC Base Station Controller

BSS Base Station Subsystem

BTS Base Transceiver System

CALEA Communications Assistance Law Enforcement Act

CDG CDMA Development Group

CDR Call Detail Record

CellID Cell Identifier

EBID Extended Base ID

ESN Electronic Serial Numbers

ID IDentifier

IOT Interop Testing

HLR Home Location Register

MECAM MEID Enhanced Channel Assignment Message

MEID Mobile Equipment Identifier

MES MTX Electronic Surveillance

MO Managed Object

MSC Mobile Switching Center

Abbreviation Definition

MTX Mobile Telephone Exchange

MUHDM MEID Universal Handoff Direction Message

NID Network Identifier

OAM Operation, Administration and Maintenance

OM Operational Measurement

pESN Pseudo Electronic Serial Number

PLCM Public Long Code Mask

P-MSC Packet Mobile Switching Center

SCM Station Class Mark

TIA Telecommunications Industry Association

UDR Usage Detail Record

VLR Visitor Location Register