The question (preemptive maybe) is that "Can one use an IMEI number in a security system ?"
Yes. If you apply your mind to it. My current solution is as follows (this forum is a good place to find all the items mentioned below)
I have a CKVS server setup, as well as jRDC2 and MQTT and a MySQL server (all on the same machine - they run harmoniously next to each other)
I do not have a library to do this - just some well tried and tested code.
For a new user: I get the IMEI number from the device, interrogate my MySQL server via jRDC2 to see if the user has not perhaps been registered before. If not then I register them and send them a token/membership number and immediately change a CKVS entry "IsAMember" to "Yes".
If the user now opens the app a second time, I first look if the user "IsAMember" - if they are - then proceed (usually I don't even present them with a login screen) - if not then follow the New User routine above.
This can be expanded to actually track the phone by using a Service in Android for example to periodically place lat/long in the MySQL Database via jRDC2 or in CKVS - the choice is yours and your design dependent. Slightly different for an iPhone/iPad - but not impossible.
If you now wish to do update an item or something in the app - well - there is MQTT that you can send a jSON with, then there is Data Push Notifications, then there is Firebase - the choice are legion and all of them have examples or tutorials on this forum.
Enjoy !!