Observed IMEI Ticket

Description

The Observed IMEI Ticket is a term defined in 3GPP specifications, particularly in TS 32.240, 32.250, 32.272, and 32.295, which cover charging management and related aspects. It refers to a record that describes an event relevant to the Equipment Identity Register (EIR). The EIR is a database used to manage and control mobile equipment identities, such as IMEIs, to prevent stolen or unauthorized devices from accessing the network. The Observed IMEI Ticket captures information about such events, for example, when a blacklisted or blocklisted IMEI is observed on the network.

In the architecture of mobile networks, the EIR interacts with the core network, particularly with the Mobility Management Entity (MME) in LTE or the Access and Mobility Management Function (AMF) in 5G, to check the status of a device when it attempts to attach or register. When a device with a blacklisted IMEI is detected, the network may deny service or log the event. The Observed IMEI Ticket is the record generated in such cases, typically for charging, auditing, or security monitoring purposes. It may include details such as the IMEI, the timestamp, the location, and the action taken.

The ticket is part of the charging and management infrastructure defined in 3GPP TS 32 series. These specifications define how charging data records (CDRs) are generated and processed. The Observed IMEI Ticket may be used to create CDRs for billing or for reporting to authorities. In some cases, it might be used to trigger alerts or to update the EIR database. The term was introduced in Release 8, coinciding with the evolution of LTE and the need for enhanced security and management of device identities.

Operationally, the Observed IMEI Ticket is generated by the EIR or by network nodes that query the EIR. When a device is detected, the network element (e.g., MME) sends a request to the EIR to check the IMEI status. If the status indicates a blacklisted or blocklisted device, the EIR may respond with a specific cause code, and the network element may generate a ticket. This ticket is then forwarded to the charging system or management system for further processing. The ticket's format and contents are standardized to ensure interoperability between different vendors and operators.

The term's definition has seen a notable change in Release 17, where the wording was updated from 'blacklisted IMEI' to 'blocklisted IMEI' to align with modern inclusive language. This reflects a broader trend in 3GPP to use more neutral terminology. Despite this wording change, the technical meaning remains the same: a record of an EIR-relevant event involving a restricted IMEI.

Purpose & Motivation

The Observed IMEI Ticket was introduced to provide a standardized way to record and manage events related to the Equipment Identity Register (EIR). The EIR is a critical component for network security, allowing operators to blacklist stolen or unauthorized devices. However, the mere act of checking an IMEI against the EIR generates events that need to be logged for various purposes, including charging, auditing, and security analysis. The Observed IMEI Ticket solves the problem of how to represent these events in a consistent format across different network elements and vendors.

Before the introduction of this concept in Release 8, there was no standardized term for such records, leading to potential inconsistencies in how different systems logged EIR-related events. This could hinder interoperability and make it difficult to correlate data across networks. The Observed IMEI Ticket provides a clear, standardized definition that can be used in charging and management specifications, ensuring that all stakeholders understand what information is being captured and how it should be processed.

Moreover, the ticket supports regulatory and law enforcement requirements. In many countries, operators are required to report the presence of stolen devices on their networks. The Observed IMEI Ticket facilitates this by providing a structured record that can be easily extracted and shared with authorities. It also helps operators monitor the effectiveness of their EIR policies and detect patterns of unauthorized device usage.