Are you implementing an IoT system that requires you to identify many connected devices? This post reviews different types of IDs and provides some technical details to help you decide if any of these are appropriate for your application.

UUIDs

UUIDs (Universally Unique Identifiers) are often used in distributed software systems where multiple distributed systems create objects that must be uniquely identified. UUIDs are typically 128-bit numbers represented in a 36-character format that might look like: d50ae174-b65f-4ab9-b938-5f99b67ac50b. Base64 encoded UUIDs can be as short as 22 characters and look like: 1QrhdLZfSrm5OF-ZtnrFCw. UUIDs are typically constructed using the time and the MAC address of the device generating the UUID.

These IDs are attractive because no central organization or database is required to prevent conflicts – they can be created anywhere at will with a statistically insignificant possibility that there will ever be a collision. However, these IDs are large and best processed by machines, not humans.

MAC Address/EUI-48

Network devices use a MAC (Media Access Control) address, also called (EUI-48), to uniquely identify a device on a network. These are 48-bit numbers typically displayed as 12 hexadecimal digits and grouped into 6 pairs (00:1A:2B:3C:4D:5E). The first half of the MAC address is called the OUI (Organizationally Unique Identifier). IEEE is the registration authority for MAC address blocks. You can purchase 4K, 1M, and 16M size blocks; the cost ranges from $1,080 to $3,680 at the time of writing.

You can also purchase EEPROM integrated circuits, like the 24AA02E48 from Microchip, that have a EUI-48 number already programmed into it. This is a nice option for lower volume products where you don’t want to mess around with managing the EUI-48 numbers.

One advantage of using a MAC address is that it may already be programmed into the device you are using, so it does not require any extra effort to allocate and program the ID.

IPv6/EUI-64

IPv6/EUI-64 addresses are a 64-bit number commonly used in IPv6 and typically displayed as 8 groups of four hexadecimal digits: 2001:0db8:85a3:0000:0000:8a2e:0370:7334. Consecutive groups of zeros can be replaced with a double colon. For example, 2001:0db8:0000:0000:0000:0000:0000:0001 can be shorted to 2001:0db8::1. Note, leading zeros in the group are also omitted. IPv6 address blocks are assigned by the Internet Assigned Numbers Authority (IANA), which allocates large blocks of addresses to Regional Internet Registries (RIRs). These RIRs then distribute smaller blocks to Internet Service Providers (ISPs) and other organizations. The ARIN (American Registry for Internet Numbers) provides blocks of IPv6 addresses. The annual fee for a 3X-Small block (2⁸⁸ addresses) is $262.50 at the time of writing.

There are also EEPROM and other ICs that have EUI-64 numbers preprogrammed, such as the Microchip 24AA02E64.

QR Codes

QR codes provide the opportunity to easily read a UUIDs or some other long ID on every device using a phone camera. This relieves some of the complexity of humans having to deal with long IDs.

Entering a known device in the field into an application is easy with QR codes. However, finding a device (one among many) in the field can be difficult unless the application has a feature designed just for this.

SNMP/Private Enterprise Numbers (PEN)

A SNMP Private Enterprise Number (PEN) is a unique identifier assigned by the Internet Assigned Numbers Authority (IANA) to organizations, individuals, or entities. It is primarily used in network management protocols like Simple Network Management Protocol (SNMP) to identify objects defined by an enterprise within the Management Information Base (MIB) structure.

PENs are part of the Object Identifier (OID) hierarchy under the prefix 1.3.6.1.4.1, which corresponds to .iso.org.dod.internet.private.enterprise. This prefix ensures that each PEN is globally unique.

Any entity can request a PEN assignment from IANA at no cost.

Automobile VIN

The modern 17-character Vehicle Identification Number (VIN) format was first conceptualized and standardized by the United States National Highway Traffic Safety Administration (NHTSA) in 1981. This standardization aimed to unify the previously inconsistent vehicle identification practices across manufacturers and facilitate more effective tracking of recalls, registrations, and thefts. The VIN system introduced by NHTSA was later adopted globally and is now governed by the International Organization for Standardization (ISO), specifically under ISO 3779 (content and structure) and ISO 4030 (location and attachment)

An example of an automobile VIN (Vehicle Identification Number) is:

1P8ZA1279SZ215470

VINs are always 17 characters long and use a combination of capital letters and digits. Each section of the VIN provides specific information about the vehicle:

• The first three characters (World Manufacturer Identifier) indicate the manufacturer and country of origin.
• Characters 4–8 describe features such as model, body type, and engine.
• The 9th character is a check digit for security.
• The 10th character indicates the model year (e.g., “S” for 1995, “R” for 1994 or 2024).
• The 11th character shows the assembly plant.
• The last six characters are a unique serial number for that vehicle.

KNX Serial Number

KNX is a popular building automation standard. The KNX serial numbers follow the following format:

Length: The KNX serial number is always 6 bytes (octets) long.

• Manufacturer Code:
  • Octets 6 and 5 (the first two bytes, when read from left to right) contain the official KNX Manufacturer Code assigned to each manufacturer by the KNX Association.
• Device-Specific Portion:
  • Octets 4 to 1 (the remaining four bytes) are managed by the manufacturer.
  • This part may encode information such as production site, date, series, batch, or simply a sequential unique number.

BACnet

BACnet Device IDs, also known as Device Object Identifiers or Device Instance Numbers, are unique numerical values assigned to each BACnet device on a network to identify them distinctly.

The Device ID is a 22-bit unsigned integer ranging from 0 to 4,194,302 (decimal). The value 4,194,303 (0x3FFFFF) is reserved and cannot be used as a valid Device ID.

This Device ID corresponds to the object instance number portion of the BACnet Device Object’s Object_Identifier property.

The full Object_Identifier is a 32-bit value composed of:

• Object Type (10 bits): For a Device object, this is fixed as 8.
• Object Instance (22 bits): The Device ID itself.

BACnet IDs are not assigned during manufacturing, but rather during setup/installation.

Matter

Matter devices include a Device Attestation Certificate (DACs) generated through a hierarchical Public Key Infrastructure (PKI) process, ensuring each device is uniquely authenticated. Each device is cryptographically verified, making spoofing difficult.

The DAC is part of a chain of trust:

1. Product Attestation Authority (PAA):
   • Root certificate issued by the Connectivity Standards Alliance (CSA) or an approved third party.
   • Stored in the Distributed Compliance Ledger (DCL), a global registry of trusted certificates.
2. Product Attestation Intermediate (PAI):
   • Intermediate certificate signed by the PAA.
   • Typically includes the manufacturer’s Vendor ID (VID).
3. Device Attestation Certificate (DAC):
   • Unique per-device certificate signed by the PAI.
   • Contains the device’s VID, Product ID (PID), public key, and serial number.

Additionally, devices use rotating keys, which makes tracking difficult and preserves privacy. End users scan a QR code to onboard devices.

Matter attempts to be:

• Authentic (not counterfeit)
• Secure (resistant to hacking)
• Private (resistant to tracking)
• Interoperable (works with any ecosystem)

Serial Numbers

Other custom serial numbers take many different forms. Some examples are shown below:

Systemd network interfaces

Systemd’s predictable network interface name encodes the physical path of the device. Example of how enp0s13f0u2c2 is constructed:

• en: Ethernet device (prefix for Ethernet interfaces).
• p0: PCI bus 0
• s13: PCI slot 13 (device 13 on the bus)
• f0: PCI function 0
• u2: USB port 2 (the device is connected via USB, possibly a USB Ethernet adapter)
• c2: USB configuration or child port 2 (sometimes used to indicate a specific port or configuration on a USB hub)

Summary

I’m sure there are many other examples — please leave a comment if you’d like to share other interesting formats. In a future post, we’ll explore a new standard for device IDs that is optimized for human interaction in the field. Subscribe below to stay informed of the latest developments.