Simplifying Telecom Compliance, One Certificate at a Time

Nowadays, there will hardly be anyone who doesn’t own a cellular phone. You might have received an unwanted call from someone who tries to scam you in different ways. Such calls can be distressing for everyone where fraudsters spoof their caller ID in an attempt to defraud or dupe consumers. The majority of the cell phone numbers don’t even answer the phone call unless they are sure who is calling. This is a good way to protect themselves from unwanted and fraudulent calls. However, this practice is having a drastic impact on the reputation of legitimate businesses. Such businesses are often unable to contact potential customers by phone to relay some essential and sensitive information.

The top priority of the Federal Communication Commission (FCC) regarding consumer protection is stopping illegal robocalls. For this reason, the authorities have several actions underway. The FCC has directed different carriers to implement robust call authentication to address caller ID spoofing specifically. In this regard, STIR or SHAKEN standards were introduced several years ago. But if you are new to this technology, you might not know what this means for carriers?

STIR and SHAKEN are the set standards and the most viable ways to provide the recipient with information about the caller to provide a measure of trust. These technologies are used to fetch information about the caller and present it to the customers in the displayed caller name and number after authenticating the calling number. STIR is abbreviated as Secure Telephony Identity Revisited and is a set of technical standards developed by the Internet Engineering Task Force (IETF). This method is adopted to certify the identity of the incoming or origination calls. On the other hand, SHAKEN (Signature-based Handling of Asserted Information using tokens) is actually a framework developed by the Alliance of Telecommunications Industry Solutions (ATIS). It majorly focuses on the implementation of STIR to various IP-based service provider networks.

We have scoured a list of frequently asked questions that might have popped up in your mind a few times while digging a bit deeper into STIR/SHAKEN technologies.

Q: Are robocalls somehow different from spoofed calls?

Robocalls refer to the programmatic origination of phone calls. It is usually done in high volume to deliver either a recorded message to the recipient or get you in touch with a live person on the line. Some businesses are using legal robocalls to get out important messages quickly, for instance, for weather alerts and school closures.

On the other hand, call spoofing is the process when the call originator has changed the calling number. The person does this with the intent of hiding or controlling the number that is shown on the call display. A perfect example of the legal use of spoofing is to present the primary callback numbers for various customer support or call centres or to keep a specific private calling number. Besides, a doctor contacts a person from a private phone number to inquire about his/her health. However, you may come across different parties who spoof numbers nowadays whenever they wish to trick users into receiving unwanted calls or avoid detection. Currently, illegal calls are often a combination of spoofing and automated dialing to defraud consumers.

   

Q: Why did call spoofing turn into such a big problem?

At first, the telephone network was closed only for internationally licensed carriers. If a person doesn’t have authorized access to the signalling network that underly, he/she will not be able to process the call.

The Session Initiation Protocol (SIP) was particularly designed to implement Voice over IP (VoIP) on phone calls over the Internet. There were some unanticipated consequences where the SS7 network was connected to the Internet by gateways that ultimately compromised security. There was not a specific mechanism to verify the originating numbers at a particular gateway.

Such gateways generally accept the calling the number provided on the Internet and propagate it into the PSTN. However, it has become easy and cheap to spoof calls and deliver untraceable phone calls virtually with so many VoIP networks interconnected with various PSTN.

Q: How can caller ID authentication help consumers?

The caller ID authentication technology helps subscribers trust callers who don’t hide their identity. It reduces the effectiveness of a spoofed call that is made for fraudulent activities. People can identify a scam or spoofed robocalls because it erodes the caller’s ability to spoof the caller ID illegally. Some Americans are usually tricked into picking up the calls of scammers when they should not.

Besides, caller ID authentication technology allows law enforcement and consumers alike to more readily identify illegal robocall sources. It also reduces the impact and frequency of fraudulent calls. The STIR/SHAKEN framework is a set of technical standards that allow for the verification and authentication of caller ID information for calls that are carried over Internet Protocol networks. With the continuation of implementation and its progress, it will give more confidence to the users that caller ID information provided by the carrier is accurate. Additionally, it will allow voice service providers the facility to provide helpful and authentic information to their consumers. Thus, consumers will know which calls they should answer and which calls they should avoid.

Q: What is “call authentication?”

The process of “call authentication” is all about authenticating the identity of a caller by analyzing different facts and connecting dots between the contact centre or enterprise and its originating carriers or telco providers. Call authentication ensures that the calls are identified as valid or trusted from the point of origination to the point of termination. Once the identity of the caller has validated by the originating service provider, your information will be associated with your out pulsed telephone number. The next step leads towards the terminating device (the telephone of the person to whom you are calling) to validate the identity and phone number information that is passed from the originating service provider to display the call as a Verified Call. The call will be displayed as not-verified if the identity and phone number of the caller cannot be validated by available data.

Q: How will “Verified” calls be displayed?

The procedure of how some of the specificities around the display of verified calls will be visually depicted are in progress. However, the requirements to trace back the caller’s identity are mandated by the renowned TRACED Act. Various service providers are looking for ways and working to make sure that they meet these requirements to avoid probable interruptions to the calls blocked and overall services.

It is crucial to take possible steps now to ensure your identity or branded calling presence is the same as associated with the use of your phone numbers’ authorization and verification. The process provides “Know Your Customer” proofs that are needed to validate the identity on behalf of or by service providers after passing the STIR/SHAKEN signed calls all the way to the point of termination. This step will prevent the improper blocking of the calls while enabling the highest levels of STIR/SHAKEN attestation and visual depiction of the verified status (if and when possible).

Q: Whose responsibility is STIR/SHAKEN?

You are not responsible for handling the ideation and logistics behind implementing STIR/SHAKEN. It is the responsibility of your telco service provider. Thus, you should keep pace with the progression of your service provider toward STIR/SHAKEN implementation. Thus, you will be assured that your calls will be given the most significant opportunity to the authenticated successfully.

With a lot of work going on behind the scenes with STIR/SHAKEN, it is crucial for you to give your opinion. For service providers, it is essential to weigh in the policies that will impact their businesses and their users’ security. Also, be wary of solutions with ‘guarantees’ on STIR/SHAKEN. Special attention should be given to the ones with promises for ‘attestation’ or ‘enterprise signing’. However, nothing has been finalized yet. So at this point, no one can predict the outcomes with 100% certainty.

Q: What is the reason that STIR/SHAKEN are considered the best way to address caller ID spoofing?

STIR/SHAKEN technology combines the security that ensures the safety of e-commerce on the Internet with telephone security. It provides a proper way of knowing whether a caller can use a given telephone number according to the law or not. Among the top ways to attest the identity of a caller on the Internet is with a digital certificate.

In both the STIR and SHAKEN framework, the digital certificates are issued first to the carriers or others who are assigned to dedicate the telephone numbers. Hence, a private key is associated with a digital certificate that is used to sign a VoIP call. Thus, it indicates that the calling party’s telephone number has been attested properly. So, if the recipient gets a call from a number that carriers cannot verify, these are the ones that the caller has spoofed.

Q: What if a carrier has traditional TDM trunks and wants to implement STIR/SHAKEN? Is it possible to do without SIP trunk?

There are many ways that carriers with traditional TDM trucks can use to successfully implement STIR/SHAKEN. There should be a STIR/SHAKEN-aware gateway that the carrier can put in front of legacy infrastructure. It will enable calls to by referring them to be valid for the destination. However, if there are intermediaries or endpoints in the legacy TDM infrastructure to access the Internet, out of band infrastructure can be implemented for STIR/SHAKEN. On behalf of the carriers, an upstream carrier with a gateway can sign calls potentially on behalf of the carrier with those traditional TDM trunks as well.

Q: In most cases, people get telemarketing calls from local numbers. As the origination party has the local calling numbers, the number would be authenticated successfully. How can STIR/SHAKEN address this situation?

About 98% of complaints that carriers get are about telemarketing calls that they receive from local telephone numbers. This phenomenon is referred to as “neighbor spoofing,” which is a technique used to give the impact that the call is being made from a local number. While most neighbor spoofing gets back to the caller ID spoofing, some illegal robocalls, which are a bit more sophisticated, get legitimate numbers in local NXXs/NPA for this purpose. In this case, STIR/SHAKEN adds a new layer of authentication and accountability to the process. However, there is no efficient way to trace back who is the calling entity behind all the calls.

By using STIR/SHAKEN, the neighbor spoofed calls can be traced a bit more quickly to the carrier that is signing the call and further isolated within the network of carriers. Some service providers use more punitive policy and legal measures for the people who issue such illegal robocalls like the ones being used in “neighbor spoofing.”

Q: Why should people use the option of flag calls instead of blocking them?

Industry associations and businesses have brought this issue to the table. They were in the view that by blocking calls, the users are actually giving the impact of the business to other consumers that the call is mistakenly marked as spam or doesn’t go through. The most common example in this regard is of pharmacies and highlighting how the calls were being marked as spam by different solutions when they were only trying to send out some important prescription information. Businesses and consumers both do not want to get such important calls blocked or spammed automatically. A large number of enterprises came to know that almost everyone has experienced some of the calls being mistakenly marked as spam or blocked.

It can be attributed partly to the call analytics program that takes into account crowdsourcing and volume metrics to determine whether the call should be blocked or marked as spam or not. As anyone will have the ability to mark the telephone number as “bad” or “unwanted calls” from their personal mobile devices, the authority of data sources becomes limited. Thus, it is always a better idea to inform consumers about the person who is calling and empowering them to decide whether they want to pick that call up or not. Consumers will have access to different tools to set their policies to respond to the communication that is being held with someone. They can consider the reliable information that STIR/SHAKEN will provide to make the decision.

Q: Someone receives a spam call from a telephone number that is similar to the ones being used in England. Will the STIR/SHAKEN standards work with international originated callers?

The calls that are being originated from any other country will have an ingress or entry point into the country of the recipient. Suppose a US resident is getting the call from a phone number that is identified as that of England. In such a situation, the carrier responsible for bringing the call into the US can sign or attest it. SHAKEN has the authority to sign these calls as the “gateway level of attestation.” The information provided will be useful as an input to call analytics programs to help advise/warn consumers about responding to the call.

Q: How are other countries playing their part in STIR/SHAKEN?

There is a particular process that can be found in the US regarding Call Authentication Trust Anchor Working Group (CATA) to define the trust for STIR/SHAKEN. It is endorsed by FCC. Countries need to go through a similar regulatory process to participate in STIR/SHAKEN. In Canada, STIR/SHAKEN has been put into effect from 2019 as per CRTC’s recommendations. Canada is also working through a similar process to efficiently define the trust anchor. Besides, many regulators in Europe are putting efforts to track the progress of STIR/SHAKEN adoption and other US measures and are at different stages of introducing initiatives in their country.

Q: In what ways can enterprises use STIR / SHAKEN for call authentication?

As many of you might already know, SHAKEN is a carrier-centric framework that sets out a standard method to implement STIR authentication to the Internet Protocol-based Network-to-Network Interface (IP-NNI). Entreprises having their VoIP infrastructure are expected to have the option to set up the process of call authentication by using a new STIR/SHAKEN feature. Carriers can delegate the authority against various telephone numbers to enterprises to effectively participate in the STIR/SHAKEN ecosystem.

The Verdict

It is not a secret that spammed robocalls and spoofing numbers have destroyed the trust of people in telephone calls. The trust of the common man is destroyed to the point that a lot of people have stopped answering calls from unknown phone numbers. This practice of not answering calls from telephone numbers that they are not familiar with is certainly understandable from the consumers’ point of view. However, it is costly for businesses and organizations that need to conduct various business and marketing activities over the phone and face difficulty while connecting to the customers. STIR/SHAKEN is the ultimate source to get back the trust of consumers and combating a potential threat to public safety.