Events & community · Cloud computing · 3 min read
Identity for Telecom and Broadband Cloud Services
Short answer
Telecom and broadband providers act both as large customer identity platforms for their own subscribers and as sources of identity signals for others, exposing network capabilities such as number verification and SIM swap checks through OAuth-protected APIs under strict consent and privacy rules.
Key takeaways
- Operators run some of the largest customer identity systems anywhere, often with legacy billing identities underneath.
- Network APIs (for example the CAMARA project's number verification and SIM swap APIs) expose operator signals to app developers through OAuth 2.0 and OpenID Connect.
- In Europe, these services fall under GDPR and the ePrivacy rules, so consent and purpose limitation drive the design.
Telecom operators and broadband providers sit in an unusual place in the identity world. They hold verified records for millions of subscribers, they know which SIM is in which phone and they operate the networks everyone else runs on. Their own customer sign-in is a large identity system in its own right, and the signals they hold are valuable to banks, retailers and app developers fighting fraud.
What identity problems do operators have internally?
Huge customer bases, many channels and identity data spread across billing, CRM and network systems built over decades.
A single subscriber may appear as a billing account, a mobile number, a broadband line, a TV subscription and an online account, each created by a different system. Unifying them into one customer identity, with one sign-in and clear consent records, is a long project. Customer identity and access management (CIAM) platforms, OpenID Connect for apps and portals, and careful account-linking rules are the usual tools.
What are network APIs?
Network APIs let developers ask an operator questions about a phone number or connection, such as "is this number on this device?" or "did this SIM change recently?", through standard OAuth-protected interfaces.
The CAMARA project under the Linux Foundation defines common API specifications so that a developer can use the same request across operators. Examples include:
| API | Question it answers | Typical use |
|---|---|---|
| Number verification | Is the phone making this request using this number? | Sign-up and sign-in without SMS codes |
| SIM swap | When did the SIM for this number last change? | Fraud checks before a bank transfer |
| Device location verification | Is the device near this location? | Fraud and compliance checks |
Access is usually through OAuth 2.0 and OpenID Connect flows, often with the subscriber's consent captured by the operator. The Authorization URL Builder shows the general shape of those requests.
Why does this matter for authentication?
Because SMS codes, still the most common second factor, depend on the operator network and are exposed to SIM swap and porting fraud.
Attackers who talk a carrier into moving a number to a new SIM receive the victim's SMS codes. Network signals such as a recent SIM swap can block a risky transaction. Better still, moving users to phishing-resistant methods like passkeys removes the dependency. NIST SP 800-63B classifies the public switched telephone network as a restricted authenticator for this reason.
What privacy rules apply?
In the EU and EEA, GDPR governs processing of subscriber personal data, and the ePrivacy rules add specific limits on traffic and location data.
Design consequences: collect consent for a clear purpose, minimize what each API returns (a yes or no answer rather than raw data), log every request with its legal basis, and give subscribers a way to see and withdraw consent. Similar principles apply in other jurisdictions with their own laws.
Where is this heading?
Toward more standardized APIs, wider use of OpenID Connect for subscriber identity, and links to digital identity wallets.
The EU's digital identity framework and national eID schemes, such as the bank-issued IDs common in the Nordic countries, change how people prove who they are online. Operators can be identity providers, verifiers or simply one signal among many. For conference and community coverage of these topics, see our overview of identity events.
Questions
What is CAMARA?
CAMARA is an open-source project under the Linux Foundation, started in 2022 with GSMA involvement, that defines common APIs for telecom network capabilities so developers can use them the same way across operators.
Is SMS one-time password authentication still acceptable?
SMS codes are better than passwords alone but vulnerable to SIM swap, number porting fraud and interception. NIST SP 800-63B treats the public telephone network as a restricted authenticator. Prefer passkeys or authenticator apps for anything sensitive.
Sources
Tagged: Event, Cloud, Identity, API, APIs and the API economy