How to identify a smartphone?

Question

Mobile development

There is an online service, with corresponding client applications for Android and iOS.
The log files on the server store data about the activity of clients, in particular, there is a "hardware_id" column. In this column, for some devices, the IMEI of a mobile phone (tablet) is stored, and for devices using an iOS application, a number is stored in the form FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF, consisting of hexadecimal digits, the same kind of id is stored for some Android devices. In principle, this information is enough for the server to work, comparing this number with the previous one, the server understands that the client has connected from the same device and additional authentication is not required. However, there is a need to identify the device, in case, for example, unauthorized access to the customer's account. The question is how exactly to set the IMEI of this device?
I assume that operating systems do not give the IMEI application in its pure form, but only give its hash? Or is it another identification number that is not associated with IMEI and only the manufacturer can set the IMEI? If it's hashing, is the hash function known?
Questions like a reference character, but I did not find answers to them on the Internet, I myself am not engaged in professional development of applications for mobile devices.

Answer 1

FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF

this is GUID
https://ru.wikipedia.org/wiki/GUID

I assume that operating systems do not give the application a pure IMEI

this is not true. it is enough to google mobile development request IMEI and other request options, in particular for specific OS

There is an online service, with corresponding client applications for Android and iOS.

are these your applications? or third parties? if you want to collect statistics on manufacturers and models, or something like that - in any case, this is a question for the application developer, the
question of what is given as a GUID is there. and it's definitely not a hash. GUIDs are inherently generated in a way that virtually guarantees uniqueness. but from iron it takes only the MAC address . See the GUID link above for details.
for example, in Windows this is how SID is generatedfor each installation of Windows, and for each newly created user profile. but this does not allow identifying hardware in any way, only a copy of Windows and a user account. and with the same acronis, a system with unique SIDs can be transferred to other hardware, and even legally reactivated. this will change the MAC (and it can also be changed programmatically). but SIDs cannot be changed

Answer 2

There should be no authorization purely by hwid, and even more so by imei, these parameters change so easily that binding to them is approximately equal to binding to the browser user agent.