Device Identifier Meeting Minutes 2024-02-09

Attendees & Representation

Agenda

• Review of previous meeting minutes

  • Approved

• Review of Device Identifier API status

• Discussion on requirements for IMEI Fraud

• AOB

Review of Device Identifier API status

• Current "work in progress" version can be found here

PRs

• New PRs:

  • None

• Existing PRs:

  • None

• Closed PRs:

  • PR #54: Update API to match common schema definitions

    • Updates Device schema to match that in CAMARA_common.yaml 

    • Identifying device by IPv6 must be single IPv6 address

•  

  • PR #53: Add X-Correlator to OAS and update linting rules

    • Requirement in latest version of API Design Guidelines

    • Linting rules agreed in Commonalities, but still not merged

•  

  • PR #52: Rename project to CAMARA Mobile Device Identifier API

    • As agreed in Issue #46

•  

  • PR #51: Add Identity & Consent header

    • Adds mandatory identity & consent header to API information

    • This will be a requirement of v0.1.0 of Identity & Consent documentation

Issues

• New Issues

  • None

• Existing Issues

•  

  • Issue #47: Add ageOfInformation field to API response

    • Follows on from Discussion #35

    • Current API response gives no indication of when the physical device information was collected for the specified subscription identifier (e.g. phoneNumber). Dependent on the backend implementation, this information could have been collected some time earlier, and potentially be out of date

•  

  •  

    • Current proposal is to introduce lastChecked response parameter, defined as follows:

•  

  •  

    • Huub proposed lastRecorded 

      • AGREED
        ACTION: Eric to raise PR

    • Huub raised issue of primary / secondary MSISDNs and multi-SIM

      • ACTION: Eric to open discussion on multi-SIM scenarios

      • ACTION: Eric to update documentation on MSISDN being treated as secondary MSISDN by network

•  

  • Issue #30: Defined scopes and meanings, being discussed in Issue 

    • The two use cases (retrieve all parameters or only tac / manufacturer / model), two separate scopes are required

    • Should they be two scopes of same endpoint, or associated with separate endpoints

•  

  •  

    • Updated proposal is to have two separate endpoints as follows:

      get-identifier with scope device-identifier:get-identifier which returns:

      • imeisv

      • imei

      • tac

      • model

      • manufacturer

      get-type with scope device-identifier:get-type which returns:

      • tac

      • model

      • manufacturer

•  

  •  

    • Alex supports two endpoints

    • Kevin suggests retrieve-identifier  and retrieve-type 

    • AGREED to use retrieve-identifier  and retrieve-type 
      ACTION: Eric to raise PR

•  

  • Issue #21: API Definition Terminology

    • Issue is out of date

• Closed Issues

•  

  • Issue #46:  Rename API title to CAMARA Mobile Device Identifier API

    • Closed by PR #52

Discussions

• New Discussions

  • None

• Existing Discussions:

  • Discussion #36: Alternative device identifiers

    • An alternative proposal is to salt the IMEI with an API consumer specific salt and then hash it

    • This would a less useful identifier (only useful to the API consumer) but easier to justify providing under an opt-out or no consent basis

    • Use cases for such an alternative identifier are not clear

• Closed Discussions

  • None

Other Issues

• Kevin raised the point that YAML schemas should use the common schemas defined in CAMARA_common.yaml where appropriate. Ideally, they could be directly referenced, though this can cause issues with some OAS viewers.

  • ACTION: Kevin to check how OAS viewers handle external references

Discussion on IMEI Fraud API

• See API Proposal submission here

• Open Discussions:

  • #37: IMEI Fraud API Input

    • Proposal is just to use a single "IMEI" field, which would accept either IMEI or IMEISV

  • #34: What values should the IMEI Fraud API respond with to indicate reported ownership status?

    • The GSMA appear to have an existing Device Check service, which includes an API. How does the CAMARA proposal differ from this?

    • Kevin highlighted a GSMA video on their Device Check service.

AOB

• Issue #48: Additional sub-project codeowner required

  • UPDATE: No additional codeowner yet identified

• Next meeting to be held Friday 23rd February 2024 @ 16:00 GMT.

• One day, meetings will be held using the LFX Zoom service, but not yet