Device Identifier Meeting Minutes 2024-02-09

Attendees & Representation

Agenda

• Review of previous meeting minutes
  • Approved
• Review of Device Identifier API status
• Discussion on requirements for IMEI Fraud
• AOB

Review of Device Identifier API status

• Current "work in progress" version can be found here

PRs

• New PRs:
  • None

• Existing PRs:
  • None

• Closed PRs:
  • PR #54: Update API to match common schema definitions
    • Updates Device schema to match that in CAMARA_common.yaml 
    • Identifying device by IPv6 must be single IPv6 address

• • PR #53: Add X-Correlator to OAS and update linting rules
    • Requirement in latest version of API Design Guidelines
    • Linting rules agreed in Commonalities, but still not merged

UPDATE: Rafal suggested newline issue was due to Windows newline format being used rather than Linux

• • PR #52: Rename project to CAMARA Mobile Device Identifier API
    • As agreed in Issue #46

• • PR #51: Add Identity & Consent header
    • Adds mandatory identity & consent header to API information
    • This will be a requirement of v0.1.0 of Identity & Consent documentation

Issues

• New Issues
  • None

• Existing Issues

• • Issue #47: Add ageOfInformation field to API response
    • Follows on from Discussion #35
    • Current API response gives no indication of when the physical device information was collected for the specified subscription identifier (e.g. phoneNumber). Dependent on the backend implementation, this information could have been collected some time earlier, and potentially be out of date

ISSUE UPDATE:

• • • Current proposal is to introduce lastChecked response parameter, defined as follows:

lastChecked:
  description: Last time that the associated device identity was checked and updated if necessary
  type: string
  format: date-time

MEETING UPDATE:

• • • Huub proposed lastRecorded 
      • AGREED
        ACTION: Eric to raise PR
    • Huub raised issue of primary / secondary MSISDNs and multi-SIM
      • ACTION: Eric to open discussion on multi-SIM scenarios
      • ACTION: Eric to update documentation on MSISDN being treated as secondary MSISDN by network

• • Issue #30: Defined scopes and meanings, being discussed in Issue 
    • The two use cases (retrieve all parameters or only tac / manufacturer / model), two separate scopes are required
    • Should they be two scopes of same endpoint, or associated with separate endpoints

ISSUE UPDATE: 

• • • Updated proposal is to have two separate endpoints as follows:

      get-identifier with scope device-identifier:get-identifier which returns:

      • imeisv
      • imei
      • tac
      • model
      • manufacturer

      get-type with scope device-identifier:get-type which returns:

      • tac
      • model
      • manufacturer

MEETING UPDATE:

• • • Alex supports two endpoints
    • Kevin suggests retrieve-identifier  and retrieve-type 
    • AGREED to use retrieve-identifier  and retrieve-type 
      ACTION: Eric to raise PR

• • Issue #21: API Definition Terminology
    • Issue is out of date

ACTION: Eric to update issue text (still open)

• Closed Issues

• • Issue #46:  Rename API title to CAMARA Mobile Device Identifier API
    • Closed by PR #52

Discussions

• New Discussions
  • None

• Existing Discussions:
  • Discussion #36: Alternative device identifiers
    • An alternative proposal is to salt the IMEI with an API consumer specific salt and then hash it
    • This would a less useful identifier (only useful to the API consumer) but easier to justify providing under an opt-out or no consent basis
    • Use cases for such an alternative identifier are not clear

AGREEMENT: Leave discussion open for now, but prioritise returning IMEI / IMEISV

• Closed Discussions
  • None

Other Issues

• Kevin raised the point that YAML schemas should use the common schemas defined in CAMARA_common.yaml where appropriate. Ideally, they could be directly referenced, though this can cause issues with some OAS viewers.
  • ACTION: Kevin to check how OAS viewers handle external references

Discussion on IMEI Fraud API

• See API Proposal submission here
• Open Discussions:
  • #37: IMEI Fraud API Input
    • Proposal is just to use a single "IMEI" field, which would accept either IMEI or IMEISV
  • #34: What values should the IMEI Fraud API respond with to indicate reported ownership status?
    • The GSMA appear to have an existing Device Check service, which includes an API. How does the CAMARA proposal differ from this?
    • Kevin highlighted a GSMA video on their Device Check service.

AGREEMENT: MTN / Huawei will join sub-project meetings from next year, so can then drive these discussion

AOB

• Issue #48: Additional sub-project codeowner required
  • UPDATE: No additional codeowner yet identified
• Next meeting to be held Friday 23rd February 2024 @ 16:00 GMT.
• One day, meetings will be held using the LFX Zoom service, but not yet