Who may authenticate calls for STIR/SHAKEN

STIR/SHAKEN provides a way to authenticate caller ID as a safeguard against spoofing, a common robocall tactic. The framework relies on a governance structure that vets and approves who can authenticate calls. This blog post gives an overview of the current policy around authentication approval in the U. S.

Service provider token access policy

The STI-GA governance authority has established a service provider token access policy as follows:

In order to obtain the Secure Telephone Identity (STI) certificates they will use to sign calls, i.e. authenticate Caller ID, from an approved STI Certificate Authority (CA), service providers must first apply to the STI Policy Administrator (PA) to acquire a Service Provider Code (SPC) token.

The STI-PA will vet each service provider applicant against rules set by the STI Governance Authority (GA). The STI-GA Board has determined that, to be cleared by the STI-PA for access to the STI certificates, an entity must meet the following criteria:

1. Have a current form 499A on file with the FCC
2. Have been assigned an Operating Company Number (OCN)
3. Have direct access to telephone numbers from the North American Number Plan Administrator (NANPA) and National Pooling Administrator (NPA)

While the access limitation is reasonable, signing a given call should not be limited to only the pool of numbers available to the provider via direct access. In other words, per ATIS-100074, section 5.2.3, under correct conditions a qualified service provider (SP) must be allowed to sign leased numbers as well as other numbers belonging to an OCN not assigned to that qualified SP insofar as the SP can properly verify the customer’s authorized use of that number.

Terminating telephone number validation

The terminating service provider (TSP) shall not perform a validation that the telephone number (TN) in the Caller ID field matches the holder of the SPC token.

These policy decisions were issued by the STI-GA on February 11, 2020.

TransNexus STIR/SHAKEN solutions

We offer comprehensive STIR/SHAKEN solutions in our ClearIP and NexOSS software products. We can also provide SHAKEN certificates.

Contact us today for more information.