A telephone call can cross several networks, countries and technology environments in seconds. Yet the recipient may have very little evidence that the identity displayed on the screen actually belongs to the organization making the call.
That gap between connectivity and trust is becoming one of the defining security challenges for global telecommunications.
Caller ID spoofing is not limited to one country or one type of network. The ITU identifies caller-ID spoofing as a significant signalling security issue and has developed standards for calling-line identification authentication using public-key infrastructure. (ITU) The organization also held a 2025 workshop specifically focused on using digital certificates to strengthen telephone-network security and promote greater international alignment. (ITU)
STIR/SHAKEN has become a major part of this evolution in North American voice networks. Its architecture uses cryptographic signatures and digital certificates to authenticate caller identity. Newer standards and initiatives are extending the broader concept toward richer and more interoperable forms of verifiable calling. The GSMA's Open Verifiable Calling initiative is one example of this direction with a focus on embedding verifiable identity and cryptographic proof into global voice communications. (GSMA)
For telecom providers the strategic question is therefore changing.
It is no longer simply "How do we connect calls across networks?"
It is increasingly "How do we establish trusted identity across networks that may use different technologies, regulations and authentication frameworks?"
Why Global Telecom Trust Is Becoming a Strategic Issue
The Telephone Network Was Built on Connectivity First
Traditional telecom architecture was designed around reliable routing.
A call originated.
Networks exchanged signalling information.
The call reached its destination.
Identity was largely represented through calling-line information carried across the network.
That model worked reasonably well when network participants and signalling environments were relatively controlled.
The modern telecom ecosystem is different.
Calls can originate from cloud platforms, enterprise PBXs, VoIP providers, mobile networks and interconnected carriers. They can move between SIP, IMS, legacy signalling and international gateways before reaching the recipient.
The number displayed to the customer can therefore become disconnected from the actual source of the communication.
Spoofing Turns Identity Into a Security Problem
The ITU notes that modern networks contain increasing numbers of untrusted devices and systems including PBXs, call centres and VoIP access systems. This creates opportunities for calling-line identification spoofing and related scams. (ITU)
The problem is easy to understand with a simple analogy.
Imagine an international airport where every passenger can print their own passport.
The airport could still move people efficiently but identity would become meaningless.
Telecom networks face a comparable challenge when caller identity is accepted without adequate verification.
Connectivity without identity assurance creates an environment where legitimate and fraudulent communications can look remarkably similar.
Digital Identity Is Becoming the New Trust Layer
From Caller ID to Verifiable Identity
The next generation of telecom security is moving from displaying identity toward proving identity.
STIR/SHAKEN demonstrates this model clearly.
The originating provider creates a digitally signed identity assertion. The terminating provider can retrieve the corresponding certificate and verify the signature against the information carried in the call. TransNexus describes the process as checking the Identity Header against the SIP INVITE then using the originating provider's public certificate to verify the signature and trust chain. (TransNexus)
The basic model becomes:
Identity claim → Cryptographic signature → Certificate → Verification → Trust decision
That is significantly stronger than simply receiving a caller ID number.
Certificates Create Inter-Provider Trust
A digital certificate provides the connection between a cryptographic key and the provider identity associated with that key.
This is essential because cryptography alone does not establish organizational identity.
A private key can prove that someone possesses that key.
The certificate helps establish whose key it is.
The STIR/SHAKEN ecosystem therefore relies on certificate governance to ensure participating providers and certificate issuers operate within a recognized trust framework. TransNexus describes the Policy Administrator as the trust anchor that authorizes service providers and maintains the integrity of the certificate ecosystem. (TransNexus)
The Concept Extends Beyond STIR/SHAKEN
This is where global telecom development becomes particularly interesting.
The ITU's Q.3063 recommendation defines signalling procedures for calling-line identification authentication using a PKI-based architecture. (ITU)
The GSMA's Open Verifiable Calling initiative is also exploring how caller identity and cryptographic proof can support interoperable trust across the global voice ecosystem. (GSMA)
The terminology and implementation may differ.
The underlying principle is similar:
Make identity verifiable across organizational boundaries.
Global Networks Need Interoperable Trust Rather Than Isolated Trust
Different Networks Create Different Authentication Challenges
A call may move between:
Mobile operators
Fixed-line carriers
VoIP providers
Enterprise communications platforms
International gateways
Cloud communications providers
Legacy PSTN infrastructure
Each environment can have different signalling capabilities.
This creates a major challenge.
A trusted identity mechanism is most useful when its evidence survives the journey across the network.
IP and Non-IP Segments Matter
STIR/SHAKEN is closely associated with SIP-based communications.
But international telecom infrastructure still includes non-IP and transitional network segments.
That creates opportunities for identity information to be lost or transformed.
3GPP's current technical specifications describe STIR/SHAKEN operation across multiple telephony scenarios including interworking with PSTN signalling and forwarded calls. They also describe Out-of-Band SHAKEN and richer caller information mechanisms such as Rich Call Data. (ETSI)
This is important because a trust mechanism cannot be considered successful merely because it works at the originating network.
The real question is:
Can the identity evidence remain usable when the call crosses network boundaries?
Out-of-Band Architectures Help Address Network Gaps
When traditional SIP signalling cannot carry the required identity information end-to-end, out-of-band approaches can provide another mechanism for communicating authentication evidence.
TransNexus describes Out-of-Band SHAKEN as a mechanism that can extend the current framework around non-SIP call segments. (TransNexus)
This illustrates an important architectural principle:
Global trust requires identity mechanisms that can adapt to heterogeneous network paths.
Certificate Infrastructure Is the Backbone of Cross-Network Trust
Public-Key Infrastructure Connects Providers
A global trust model requires more than authentication software.
It requires infrastructure capable of issuing, publishing, validating and managing the credentials behind authentication.
In the STIR/SHAKEN architecture the provider's private key is used for signing while the public certificate is made available to verification systems. The certificate establishes the provider identity associated with the public key. (TransNexus)
This creates a trust chain:
Provider authorization
↓
Certificate issuance
↓
Public certificate publication
↓
Call authentication
↓
Certificate retrieval
↓
Signature verification
↓
Trust decision
Every component matters.
Certificate Availability Can Affect Verification
The certificate is not useful merely because it exists.
A terminating verification system needs to retrieve it.
TransNexus notes that certificate repositories are accessed during caller-ID verification and that certificate retrieval latency can influence post-dial delay. (TransNexus)
This creates an interesting engineering requirement for global networks.
The trust infrastructure must be:
Secure enough to protect sensitive credentials
while also being:
Available enough to support real-time verification.
That is why certificate repositories, CDN delivery, caching and lifecycle management become important parts of telecom identity infrastructure.
Centralized Certificate Operations Can Support Global Scale
Global Infrastructure Creates Lifecycle Complexity
Imagine a provider operating in several markets with multiple signing environments.
It may have:
Multiple certificates
Multiple authentication services
Different customers
Different number ranges
Multiple cloud environments
Several certificate repositories
Different operational teams
Managing these resources independently creates unnecessary complexity.
Centralized certificate operations can provide a consistent management layer even when the underlying network remains distributed.
Automation Is Critical
Certificate issuance and renewal are predictable processes.
They are therefore well suited to automation.
Peeringhub provides an ACME-based certificate lifecycle workflow supporting account authorization, certificate orders, challenges, CSR submission and certificate retrieval. (PeeringHub Documentation)
Its platform also provides certificate generation and rotation capabilities together with API access for certificate lifecycle automation. (Peering Hub)
For a provider this can transform certificate management from:
Manual request → manual download → manual deployment → manual tracking
into:
Automated request → issuance → deployment → validation → monitoring
Global Operations Need Consistency
A centralized control model does not mean that all network traffic must pass through one location.
Instead it can provide consistent governance while the network itself remains distributed.
This is similar to multinational banking.
A bank may have branches in dozens of countries but still maintain centralized rules for identity, security and compliance.
Telecom identity infrastructure can follow the same principle.
Distributed network. Centralized trust controls.
Identity Assurance Must Account for the Entire Call Journey
Originating Identity Is Only the Beginning
A call can be authenticated at its source and still encounter problems later.
Consider this simplified journey:
Enterprise → VoIP Provider → Transit Carrier → International Gateway → Mobile Operator → Customer
Every transition introduces another trust boundary.
If identity information is modified, removed or disconnected from the call then the terminating network may have less evidence to evaluate.
This is why identity assurance needs to be considered as an end-to-end process rather than an isolated originating function.
Gateway Providers Are Especially Important
International gateways represent a critical boundary between domestic and foreign-originated traffic.
The FCC has specifically required U.S. gateway providers to implement STIR/SHAKEN for certain foreign-originated calls directed toward U.S. numbers and has also imposed robocall mitigation obligations. (FCC Documents)
The regulatory model reflects a practical reality.
International traffic can introduce identity uncertainty into a domestic network.
Gateway providers therefore become important points for authentication, verification and policy enforcement.
Global Trust Needs Shared Evidence
If every network independently interprets caller identity without a common evidence model then the recipient may still face uncertainty.
The long-term goal is therefore interoperability.
Identity should be capable of being:
Created → Preserved → Verified → Interpreted
across network boundaries.
Authentication Needs to Evolve Beyond a Binary Trust Decision
A Verified Identity Is Not Automatically a Safe Call
This distinction is crucial.
Authentication can provide evidence that a particular provider signed a caller identity.
It does not prove that the communication is desirable.
A legitimate business can make unwanted calls.
A compromised account can potentially be used for abusive activity.
A verified identity can therefore be one input into a larger trust decision.
Combine Identity With Reputation and Analytics
Modern voice security increasingly combines authentication with additional signals.
Ribbon's Secure Telephone Identity solution covers authentication, signing, verification and certificate management while its wider Call Trust portfolio adds capabilities around reputation and call treatment. (Ribbon Communications)
TransNexus similarly connects STIR/SHAKEN verification with call validation treatment and analytics. (TransNexus)
The emerging model is therefore:
Identity + Authentication + Reputation + Behavior + Policy
This is much closer to how modern cybersecurity works.
A user logging into a cloud service may have valid credentials but still trigger additional security controls because of unusual behavior.
Voice networks can apply a similar principle.
Richer Identity Can Improve Context
3GPP's current specifications also describe Rich Call Data and enhanced caller-name mechanisms that build on authenticated identity. (ETSI)
That points toward a future where trusted calls provide more than a number.
They can potentially provide verifiable context about the organization or purpose of the communication.
The objective is not simply to tell the recipient:
"This number is authentic."
It is to provide enough trusted context for the recipient to make a better decision.
Comparing Approaches to Global Telecom Trust
Peeringhub: Certificate and Identity Infrastructure
Peeringhub focuses on the certificate and identity infrastructure supporting STIR/SHAKEN.
Its platform provides:
Certificate enrollment
Certificate issuance and rotation
Delegated signing
Attestation controls
Identity Header parsing
Certificate inspection
STI-CR hosting
OCN lookup
ACME certificate lifecycle automation
Public APIs
Python tooling
Its platform describes a workflow spanning provider enrollment, certificate issuance, PASSporT signing and trust monitoring. (Peering Hub)
This positioning can be particularly relevant to providers that already operate their own voice infrastructure and need a dedicated trust layer that can integrate with existing systems.
TransNexus: Authentication, Verification and Call Treatment
TransNexus provides a broader STIR/SHAKEN platform covering authentication, verification, certificate management and call validation treatment. (TransNexus)
Its certificate management architecture also covers private-key storage, certificate repositories and certificate validation. (TransNexus)
For providers seeking a more integrated authentication and verification environment this broader approach can be attractive.
Ribbon: Secure Telephone Identity Within a Wider Trust Portfolio
Ribbon provides a complete STIR/SHAKEN-compliant Secure Telephone Identity solution covering authentication, signing, verification and certificate management. Its Identity Hub also provides cloud-hosted certificate repository functionality. (Ribbon Communications)
Ribbon extends this into a broader Call Trust portfolio that incorporates reputation and call-treatment capabilities. (Ribbon Communications)
The Strategic Choice
These approaches are not simply competing feature lists.
They represent different architectural priorities.
A carrier may want:
A dedicated certificate and identity layer
or
A broader authentication and verification platform
or
An integrated identity, reputation and call-treatment environment
The correct choice depends on the provider's existing network architecture and how much of the trust stack it wants to operate itself.
A Practical Framework for Building Global Telecom Trust
1. Establish a Strong Provider Identity
Maintain accurate records connecting:
Legal entity
Carrier identity
Operating identifiers
Telephone number resources
Customer relationships
Signing infrastructure
Peeringhub's onboarding process collects telecom identifiers including RMD, FCC Form 499 Filer ID, FRN and OCN information for validation before production certificate access. (Peeringhub)
2. Use Recognized Trust Anchors
Do not create isolated certificate ecosystems.
Participate in recognized governance structures appropriate to the market in which the provider operates.
3. Protect Private Keys
Private keys should be treated as high-value credentials.
A compromised private key can undermine the identity associated with the corresponding certificate.
4. Make Public Trust Information Reliably Available
Certificate repositories need to support verification systems without creating unnecessary latency or availability problems.
5. Automate Certificate Lifecycle Operations
Automate issuance, renewal, rotation and revocation wherever practical.
6. Validate Identity at Network Boundaries
Pay particular attention to:
International gateways
Transit providers
SIP-to-TDM transitions
Cloud interconnections
Number portability
Call forwarding
Network retargeting
7. Combine Authentication With Analytics
Treat authenticated identity as a high-value signal rather than a complete fraud verdict.
8. Prepare for Interoperable Global Identity
Track developments in international standards and initiatives such as ITU calling-line authentication and GSMA Open Verifiable Calling. The direction is clear: telecom identity is moving toward more evidence-based and interoperable trust. (ITU)
The Future of Global Telecom Trust
The telecom industry is entering an important transition.
For decades the central question was:
Can this network connect to that network?
Increasingly the question is becoming:
Can this network trust the identity presented by that network?
That shift is visible across standards bodies and industry organizations.
The ITU is developing signalling and PKI-based approaches to caller-line authentication. (ITU)
3GPP specifications incorporate STIR/SHAKEN concepts into broader telephony architectures and examine scenarios including forwarding, TDM interworking and richer caller data. (ETSI)
The GSMA is exploring Open Verifiable Calling to restore trust in global voice through verifiable identity and cryptographic proof. (GSMA)
The direction is therefore larger than STIR/SHAKEN alone.
Telecom identity is becoming infrastructure.
Conclusion: Global Connectivity Needs Global Trust
A global telecom network can only be as trustworthy as the identity information moving across it.
The challenge is not simply stopping spoofed calls.
It is creating an environment where carriers, gateways, service providers and receiving networks can establish confidence in one another through evidence that survives complex network journeys.
STIR/SHAKEN provides a strong example of this approach through digital certificates, cryptographic signatures, Identity Headers and governed trust relationships. (FCC Documents)
But global telecom trust requires a broader perspective.
Networks need interoperability.
Certificates need reliable lifecycle management.
Private keys need protection.
Public certificates need availability.
International gateways need stronger identity controls.
Legacy and IP networks need mechanisms for preserving authentication evidence.
And authenticated identity needs to work alongside analytics and reputation rather than operating as an isolated security signal.
Peeringhub addresses a key part of this infrastructure through STIR/SHAKEN certificate authority services, certificate enrollment, delegated signing, attestation controls, Identity Header inspection, certificate validation, STI-CR hosting, OCN lookup and API-driven certificate lifecycle automation. (Peering Hub)
The larger opportunity is to build a telecom ecosystem where identity can travel with communications and remain verifiable across organizational and network boundaries.
That is the foundation of trusted global voice.
Build a stronger foundation for trusted telecom identity
Explore Peeringhub's STIR/SHAKEN trust infrastructure to evaluate certificate management, identity validation and automation capabilities for modern voice networks.
Post a Comment