EIR (Equipment Identity Register)

The Equipment Identity Register is the database of mobile-device identities (IMEIs) in a mobile network, classified into white (allowed), grey (monitored), and black (blocked) lists. The MSC, SGSN, MME, or AMF queries the EIR during attach to enforce equipment policy, refusing service to stolen, cloned, or non-type-approved devices. EIRs feed and are fed by industry-shared blocklists (e.g. GSMA IMEI Database) to deter device theft across operators.

Categories: Core NetworkIdentity and SubscriberProtocols and Standards

EIR in context

The mobile core is where subscriber sessions, mobility and policy live. In 4G it is the EPC (MME, HSS, S/PGW); in 5G it is the Service-Based Architecture with AMF, SMF, UPF, AUSF, UDM and the NRF. Core exposure is the difference between a single-subscriber leak and a fleet-wide breach.

Subscriber identifiers (IMSI, SUPI, MSISDN, IMEI) are the anchor for authentication, charging, lawful interception and fraud analytics. Any protocol or interface that leaks a permanent identifier is treated as a serious privacy defect, which is why 5G introduced SUCI concealment on the air interface.

To place EIR in the wider telecom-security picture, review TAC, SAS, Encryption, GSMA, IAMF and TMSI.

Related terms

Equipment

Equipment identity registers (EIR, 5G-EIR, CEIR)

Related topic hubs

  • Diameter Security 4G/LTE Diameter threats across IPX/roaming and DEA defenses.
  • 5G Security 5G SBA, SEPP, SUCI, 5G-AKA, N32 and service-based interface security.
  • NAS Security Non-Access Stratum security, integrity and ciphering algorithms.
  • Routing Area Update GPRS/UMTS RAU procedure and attack surface.

More from the TelcoSec Glossary

Browse the full TelcoSec Glossary, the Ultimate Guide to Mobile Network Security, or the P1 Arsenal of telecom-security tools.