The IMSI (E.212: MCC + MNC + MSIN) identifies the subscriber and lives on the SIM; the IMEI (TAC + serial + check digit) identifies the physical device. Authentication uses the secret key Ki, temporary identities TMSI/GUTI protect the IMSI over the air, and the HLR maps the public MSISDN to the IMSI.
Subscriber identity vs device identity
Mobile networks separate who the subscriber is from what the device is, using two independent identifiers. The IMSI (International Mobile Subscriber Identity) identifies the subscription and is stored securely on the SIM; it moves with the SIM between handsets. The IMEI (International Mobile Equipment Identity) identifies the physical handset and is burned into the device; it stays with the phone regardless of which SIM is inserted. Keeping these separate lets a subscriber change devices without changing subscription, lets a network block a stolen handset by IMEI without touching the subscription, and lets charging and mobility follow the subscriber (IMSI) while equipment policy follows the device (IMEI).
| Identity | Standard | Identifies | Stored on |
|---|---|---|---|
| IMSI | E.212 / TS 23.003 | Subscriber (subscription) | SIM / USIM / eUICC |
| MSISDN | E.164 / TS 23.003 | Dialable directory number | HLR/HSS (not the SIM) |
| IMEI | TS 23.003 | Physical device | Device hardware |
| Ki | 3GPP security | Authentication master key | SIM + AuC (never transmitted) |
| TMSI / GUTI | TS 23.003 | Temporary subscriber identity | Assigned by VLR/MME per area |
IMSI structure
The IMSI is at most 15 digits and, per E.212 and TS 23.003, is built from three fields: the Mobile Country Code (MCC, 3 digits), the Mobile Network Code (MNC, 2 or 3 digits) and the Mobile Subscriber Identification Number (MSIN, the remainder, up to 9–10 digits). The MCC+MNC opens the IMSI and names the home PLMN, so any node reading the IMSI knows which operator to route to; the MSIN identifies the individual subscription within that operator. Because the IMSI is the long-term secret-adjacent identity, networks avoid sending it in the clear and instead use temporary identities once a subscriber is known.
IMSI = 234151234567890
│ │ │
│ │ └─ MSIN (subscription within the operator)
│ └──── MNC (15, operator — 2-digit MNC in this country)
└─────── MCC (234, United Kingdom)
IMSI = MCC + MNC + MSINIMEI structure and the device
The IMEI is a 15-digit device identity comprising the Type Allocation Code (TAC, 8 digits, which identifies the make and model), a 6-digit serial number unique within that TAC, and a single check digit computed with the Luhn algorithm. The IMEISV variant replaces the check digit with a 2-digit Software Version. Networks screen IMEIs against the Equipment Identity Register (EIR), which classifies a device as white-listed, grey-listed or black-listed, so a reported-stolen handset can be denied service across operators. The TAC also lets the network infer device capabilities, which feeds provisioning and analytics independent of the subscription.
| Field | Length | Meaning |
|---|---|---|
| Type Allocation Code (TAC) | 8 digits | Make and model of the device |
| Serial Number | 6 digits | Unique unit within the TAC |
| Check Digit | 1 digit | Luhn checksum over the preceding 14 |
| (IMEISV) Software Version | 2 digits | Replaces check digit in the SV form |
Authentication: Ki and the key hierarchy
Authentication anchors on a shared secret, the Ki, provisioned identically into the SIM and the operator's Authentication Centre (AuC) and never transmitted over any interface. The network authenticates the subscriber with a challenge–response: the AuC generates a RAND, and both sides compute a response and session keys from Ki and RAND using the operator's algorithm (Milenage/TUAK). In GSM this yields a triplet, in UMTS a quintet, and in LTE the EPS-AKA vector (RAND, XRES, AUTN, KASME) fetched over Diameter S6a. Because Ki never leaves the SIM or the AuC, an attacker who intercepts signalling still cannot derive the keys — the security of the whole mobile identity model rests on that secret staying local.
Temporary identities: TMSI and GUTI
To avoid broadcasting the permanent IMSI over the air, the network assigns temporary identities that are meaningful only locally and rotated frequently. In 2G/3G the VLR allocates a TMSI (Temporary Mobile Subscriber Identity) valid within a location area; in LTE/5G the MME/AMF allocates a GUTI (Globally Unique Temporary Identity) that embeds the serving core identity plus a temporary subscriber number. After the first contact the device is addressed by TMSI/GUTI rather than IMSI, so a passive listener cannot easily track a subscriber. The mapping between the temporary identity and the real IMSI is held only in the serving node, and it is refreshed on mobility and periodically for privacy.
SIM, USIM, eSIM and the MSISDN↔IMSI mapping
The IMSI and Ki physically live on a Universal Integrated Circuit Card. The classic SIM application became the USIM on UICCs for 3G onward, and the eSIM is the same USIM running on an embedded, remotely-provisioned eUICC rather than a removable card — the identity model is unchanged, only the form factor and provisioning differ. Crucially, the MSISDN is not stored on the card: the dialable number lives in the HLR/HSS, which holds the authoritative MSISDN↔IMSI mapping. A call or message addressed to an MSISDN is resolved by an HLR query to the subscriber's IMSI and current serving network, which is exactly what an HLR lookup exposes for number validation and least-cost routing.
Message → MSISDN (+CC NDC SN, E.164)
│ HLR/HSS lookup (MSISDN → IMSI + serving network)
▼
IMSI (MCC+MNC+MSIN, E.212) ── authenticate via Ki ──►
│
▼
serving MSC/MME → deliver to device (IMEI)Frequently asked
What is the difference between IMSI and IMEI?
The IMSI identifies the subscriber (subscription) and lives on the SIM, moving with the SIM between handsets. The IMEI identifies the physical device and is burned into the hardware, staying with the phone regardless of SIM. One tracks who the subscriber is; the other tracks what the equipment is.
How is an IMSI structured?
An IMSI is at most 15 digits: a 3-digit Mobile Country Code, a 2- or 3-digit Mobile Network Code, and the remaining Mobile Subscriber Identification Number (MSIN). The MCC+MNC names the home network; the MSIN identifies the subscription within that operator.
What is inside an IMEI?
Fifteen digits: an 8-digit Type Allocation Code identifying the make and model, a 6-digit serial number unique within that TAC, and a single Luhn check digit. The IMEISV variant replaces the check digit with a 2-digit software version. Networks screen IMEIs against the Equipment Identity Register to block stolen devices.
What is the Ki and why is it never transmitted?
The Ki is the secret authentication key provisioned identically into the SIM and the operator's Authentication Centre. Authentication is a challenge–response that derives session keys from Ki and a random RAND, so Ki itself never crosses any interface. Because it stays local, intercepting signalling does not reveal the keys.
What are TMSI and GUTI?
They are temporary subscriber identities that replace the permanent IMSI over the air for privacy. The VLR assigns a TMSI in 2G/3G within a location area; the MME/AMF assigns a GUTI in LTE/5G. The serving node holds the mapping to the real IMSI, and the temporary identity is rotated on mobility and periodically.
Is the MSISDN stored on the SIM?
No. The SIM/USIM stores the IMSI and Ki; the dialable MSISDN lives in the HLR/HSS, which holds the authoritative MSISDN↔IMSI mapping. A message addressed to an MSISDN is resolved by an HLR query to the subscriber's IMSI and current serving network — the resolution an HLR lookup exposes.
Source specifications
The published standards this page is grounded in. Opens in a new tab.