Technical Trends: MEID Struggles

by L. Bryant Underwood

Reverse Logistics Magazine, May/June 2008

(WARNING very technical content this month-but should be very helpful)

Several years ago the CDMA side of the cellphone business announced that they would be moving away from the ESN structure for mobile unit identification. The replacement structure would closely approximate the GSM IMEI structure and would be called MEID. In order to ensure easy roaming and backward compatibility, the phones would also be identified by a pseudo-ESN (pESN) in addition to the MEID. This pESN would be generated based on a cryptographic algorithms and a manf portion of the pESN would have be set to a unique value (80). Although there was some concern about collisions and billing, all in all, the program has worked well, right? Yes, except for repair.

In the last few weeks, I have had a number of friends in the cellphone repair business tell me of the problems they have been having with MEID and pESNs. These problems have only recently come to light as more and more of the CDMA cellphones began shipping with MEIDs rather than ESNs. There are two reasons this MEID issue is causing so many problems for repair operations;

1. The test equipment used in repair will often only echo back to the operator the pESN, not the MEID. So if you need to verify labeling, you have no way of knowing the unit’s MEID.
2. The algorithm used to make the pESN is a “hash” called SHA-1. The programming of this function is really more optimized for implementation at the FPGA/micro-controller level. Your basic SQL (structured query language—very common database language) programmer working at a repair site will really have a tough challenge in getting this working for a shop floor control database.

So now, I know you have a few questions. First, “what is a hash?” and “if we know the pESN, why can’t I just do some magic math and get the MEID?” Both are good questions—let me explain. A “hash” is a logical function that will give you a fixed length string that will have a low likelihood of duplication as an output after it “digests” a larger string. For example, the text ("The quick brown fox jumps over the lazy dog") will always equal the SHA-1 hash of 2fd4e1c6 7a2d28fc ed849ee1 bb76e739 1b93eb12.

The reason this is useful and the main way a hash is typically used is in generating a signature of a document. If you type a letter or a contract and generate a hash value for that document, and then if you only change a single character in 1,000 pages of text—the value of the hash will change to a totally different value and that value cannot be easily predicted. So hash functions are great to link data or to verify information is unchanged. This is why a hash was used as the algorithm to generate the pESNs from MEIDs. The problem is that for repair, if your test equipment only gives you the pESN for a cellphone and you need the MEID, there is no way to get from one to the other. In addition, the pESN is not printed on the label of the unit, only the MEID. What repair operations need is an easy way to scan an MEID and generate the pESN and load that into their shop floor control systems.

What people have been telling me is that by and large the solution that many are using is having receiving staff perform duplicate data entry. First, they will collect the pESN from a public web page that will generate the hash (L4 Digital’s is one of the more popular tools) and then copy and paste the pESN into their shop floor system—clearly not an acceptable or scalable solution. Friends, I feel your pain and have done some work on this problem and there is a much easier solution.

In the Windows API there are a host of ‘library’ files. These are typically called DLLs (dynamic link library) and these files serve to provide various functions that can then be called and drive standardization across platforms. One of these libraries that is very helpful to this task is called “advapi32.dll.” This file has a host of cool functions. The one function this DLL provides that we want is the SHA-1 hash. Using this DLL, a programmer need only to;

• Declare the DLL and the variables to expose the functionality
• Convert the MEID from ASCI to its binary value
• Send the MEID to the DLL to be digested
• Take the returned data, lop off the lsb digits
• Add the (80) prefix for the manf code and viola—you have the elusive pESN!

The process is pretty straightforward; the only quirk is the conversion from ASCII to binary. The reason for this is in SQL the symbol “1” is represented as the ASCII value (49). Sending (49) to the hash algorithm and expecting it to treat it as (1) is not a good idea and it will always give you bogus output.

To further help the process along I have included what should be a very clear and simple piece of VFP source code that will do the conversion automatically—free for download from RLA (reverselogisticsassociation.org/pesnmeid). Download this file and shoot it over to your database programmer and they should have no problem getting your pESN/MEID troubles behind you. If you have any struggles, feel free to email me your questions—I will help as my available time permits.

L. Bryant Underwood is Director, North Americas Service at Foxconn Technology Group. Bryant’s past positions include GM, Director and VP level assignments in support of Operations, CRM, Materials and IT.

Reverse Logistics Magazine, May/June 2008