Combined control
IMEI–IMSI Duplets
Links the device with the IMSI and exempts the legitimate holder of a cloned IMEI.
Mobile identity governance
Sx-EIR applies to every IMEI, IMSI and MSISDN the response the operator sets
Sx-EIR answers every IMEI check the network sends it and grows by modules. Each module is added according to the project scope.
What it is
The platform for mobile identity governance: IMEI, IMSI and MSISDN
Physical or virtual core that applies the lists and the rules of the active modules. It scales in proportion to the resources allocated (virtualized, containers or physical server).
Mobile identity governance
For every IMEI, IMSI and MSISDN, the response the operator sets.
Sx-EIR answers every query with one of six responses, according to the rule the operator sets, and records every execution.
In the network · the status the switch receives
- Allow
- ObserveExample: Foreign IMSI without a roaming agreement or in permanent roaming (IMSI)Based on: Operator rule
- RestrictblockingExample: Device reported as stolen (IMEI)Based on: Authority order
- Legitimate-holder exceptionarrives as “allowed”Example: Repeated IMEI with a verified holder (IMEI + IMSI)Based on: Operator rule
Outside the network · what the operator does
- Alertfraud deskExample: IMEI rotating through many IMSIs (IMEI + IMSI)Based on: Operator rule
- Notifysubscriber noticeExample: Subsidized device with an IMSI from the operator's own network that the contract does not authorize (IMEI + authorized duplet)Based on: Service contract
For an IMSI, “observe” means detection and measurement. The response by MSISDN is resolved through IMSI–MSISDN mapping, with the IMSI present in the query.
Response examples
| Situation (illustrative) | Pillar | Response | Source |
|---|---|---|---|
| Device reported as stolen | IMEI | Restrict | Authority order |
| Repeated IMEI with a verified holder | IMEI + IMSI | Legitimate-holder exception | Operator rule |
| Foreign IMSI without a roaming agreement or in permanent roaming | IMSI | Observe (detection and measurement); then restrict with notice | Operator rule |
| IMEI rotating through many IMSIs | IMEI + IMSI | Alert the fraud desk | Operator rule |
| MSISDN blocking order | MSISDN | Restrict, through IMSI–MSISDN mapping with the IMSI present in the query | Authority order |
| Subsidized device with an IMSI from the operator's own network that the contract does not authorize | IMEI + authorized duplet | Notify; restrict according to the contract and the country's legal framework | Service contract |
The service cycle
Step 1: Diagnostic
Interfaces, IMSI presence and IMSI–MSISDN mapping are confirmed. List sources and the legal framework are reviewed. Sizing and review are provided at no cost.
Step 2: Rules
Each pillar receives its rules, with their source of authority and their assigned response.
Step 3: Response
Allowed, observed or blocked in the network; alert and notice outside it. A rule can start in observation and move to restriction when the operator so decides.
Step 4: Evidence
Every transaction is recorded. Sx-EIR Analytics shows what happens by area; Sx-EIR Integrity estimates the protected value with the operator's billing.
Step 5: Adjustment
Rules are adjusted with the operator based on the evidence: they are extended to new keys or withdrawn.
Step 5 returns to step 2 while the service is in force. The operator manages its rules with severity-based support from ATC, or ATC operates the cycle continuously under a service level agreement. The rules and the decisions remain the operator's.
Data domains
Control by IMEI, by IMSI and by MSISDN, separately or combined
Each module acts on one or more domains. Sx-EIR CORE applies the response in the network.
| Domain | Allow, observe or restrict | Link · legitimate-holder exception | Alert |
|---|---|---|---|
| IMEIDevice serial number | IMEI-CONTROLLists by IMEI and by type-approved model (TAC), national and international | IMEI–IMSI–MSISDN linkLegitimate holder protection when an IMEI is repeated; subsidized and financed devices linked to their subscription | SIM-BOX DEFENDERCloning indications prioritized for the fraud desk |
| IMSISIM chip | IMSI-CONTROL · ROAM-GUARDBy list or by operator range (MCC-MNC); permanent roaming and operator ranges without an agreement | IMEI–IMSI–MSISDN linkIMEI–IMSI duplets; IMEI–IMSI–MSISDN triplets with Sx-EIR One Control | SIM-BOX DEFENDER · COMMISSION-GUARDIMSI rotation in module farms; IMSIs activated without usage |
| MSISDNPhone numberRelated platform: Sx-NpX | Restrict onlyMSISDN-CONTROLMSISDN blocking orders, through IMSI–MSISDN mapping | Sx-EIR One ControlIMEI–IMSI–MSISDN triplets | Not applicable |
| Cross-cutting | Base: Sx-EIR CORE applies in the network: allowed, observed or blocked. · Alert: reappearance of blocked IMEIs and IMSIs, IMEI and IMSI fraud indicators and dashboards by area. · Measure: Sx-EIR Analytics and Sx-EIR Integrity. · Connect: integration and migration, APIs, subscriber notice through the operator's channels and list migration. · Operate: operations and service. | ||
Products by pillar
Products in each pillar
First the data being controlled; then the product that addresses it. Each product runs in an Sx-EIR module.
IMEI · Device serial number
IMEI pillar
IMEI Control
IMEI-CONTROL
Allows, observes or blocks by IMEI and by TAC range, with white, grey and black lists from national and international sources.
AvailableView product IMEI pillarClone Control
Detects duplicate IMEIs through simultaneous use on the network. Legitimate holder protection relies on duplets or triplets.
AvailableView product IMEI pillarSubsidized Devices
Restricts a subsidized device used with an IMSI the contract does not authorize, where regulations permit.
AvailableView productIMSI · SIM chip
IMSI pillar
IMSI Control
IMSI-CONTROL
Allows, observes or restricts subscriptions by IMSI, by list or by operator range (MCC-MNC).
AvailableView product IMSI pillarRoaming Control
ROAM-GUARD
Identifies and controls foreign IMSIs from out-of-agreement operator ranges and in permanent roaming, with a certainty scale.
AvailableView product IMSI pillarSIM-box Control
SIM-BOX DEFENDER
Identifies module farms and SIM-boxes by IMSI rotation, cadence and model, and delivers prioritized candidates to the fraud desk.
AvailableView product IMSI pillarCommission Control
COMMISSION-GUARD
Detects IMSIs activated without usage and their concentration by distributor and by batch.
AvailableView productMSISDN · Phone number
Combined
Combined control
IMEI–IMSI–MSISDN Triplets
Links the IMEI, IMSI and MSISDN, and preserves the legitimate holder's service even if the IMSI changes.
Available modules
Available modules
Sx-EIR COREPhysical or virtual core that applies the lists and the rules of the active modules. It scales in proportion to the resources allocated (virtualized, containers or physical server).
1 · Respond in the network
IMEI-CONTROLIMEI blocking and controlWhich devices may operate on the network.IMSI-CONTROLIMSI blocking and controlIncludes roaming control · ROAM-GUARD functionWhich subscriptions, domestic or foreign, may operate on the network.MSISDN-CONTROL · with Sx-EIR One ControlMSISDN blocking and IMEI–IMSI–MSISDN linkWhether a device, an IMSI and an MSISDN are authorized to operate together.2 · Alert and measure
SIM-BOX DEFENDER · COMMISSION-GUARDIMEI and IMSI fraud indicatorsWhich devices, which IMSIs and which distributors show fraud patterns.Sx-EIR AnalyticsDashboards by areaWhat happens in the network, as seen by each area of the operator.Sx-EIR IntegrityProtected valueHow much value the active controls protect.Each module is added according to the project scope.
Technical dossier under confidentiality
Configuration, interface and deployment detail, in a document for your team
Configurations, interface requirements per module, reference architecture, sizing, the migration plan and the compliance table for tender pre-qualification are delivered in a dossier under a confidentiality agreement, after a first conversation with the ATC team.
Coverage
The platform runs where the operator needs it
Sx-EIR is deployed at one site, at several sites in the country or in several countries. Capacity scales in proportion to the resources allocated (virtualized, containers or physical server).
One site or one city, with every critical function duplicated.
Questions
Operator questions
Lists are migrated with a planned window and a rollback plan, and go-live is accepted at a milestone signed by both parties.
MAP in GSM and UMTS, and Diameter S13 in LTE. The platform also offers the 5G SA interface, according to the project scope.
Capacity scales in proportion to the resources allocated (virtualized, containers or physical server). Sizing for each operator is provided at no cost.
On the infrastructure the operator designates and under its control, in accordance with applicable data protection regulations.
Each module is added on the same core, according to the project scope and subject to validation with the operator's network.
Next step
Data is processed on the infrastructure the operator designates, under its control.
ATC reviews the platform the operator prioritizes and proposes the appropriate configuration. Sizing and review are provided at no cost.
- Review of the platform and the network interfaces
- Sizing according to the operator's infrastructure
- Staged proposal: module, platform or delegated operation
3GPPGSMAITU-TTM Forum
No-cost review and sizing, without access to production.