May 2021 STIR/SHAKEN statistics

With the June 30 SHAKEN deadline rapidly approaching, we’ve looked at call statistics from our ClearIP customers to see whether they’re getting many calls that were signed using STIR/SHAKEN. We looked at similar statistics in March and April. Let’s have a look at what we found and what’s changed.

There are quite a few voice service providers using ClearIP to verify SHAKEN calls. This provides a good barometer of SHAKEN activity across the industry.

Verification statuses

What proportion of terminated calls were signed? Of the signed calls, were there any verification errors?

Highlights:

• Of the calls received by ClearIP customers, more than 6% had a PASSporT. This is a significant improvement over March/April, where fewer than 3% had a PASSporT.
• In March–April, 0.02% of signed calls generated verification errors. In May, 0.18% of signed calls generated verification errors. The error rates were small, but increased by a factor of 9.
• Most of the PASSporTs with a verification status of Certificate chain error were signed with a self-signed certificate.
• Most of the PASSporTs with a verification status of Called number mismatch had an invalid number in the dest claim of the PASSporT.
• Most of the PASSporTs with a verification status of Calling number mismatch had a valid number in the orig claim of the PASSporT but had anonymous in the From and/or P-Asserted-Identity header.

Attestation levels

What attestation levels are originating service providers using?

Of the successfully verified calls received by ClearIP customers, more than 98% had an attestation level of A. This is nearly identical to what was seen in March/April.

SHAKEN participation by originating service provider

Which originating service providers are sending signed calls? Of all successfully verified calls received by ClearIP customers, which OSPs originated the most signed calls? (Note that these figures are the proportion of all successfully verified calls, not all calls.)

We went from 26 originating service providers that sent signed traffic in March/April to 50 in May. New participants do not have a number in the March column. It’s s a big jump, but we expected more so close to the June 30 deadline.

Because access to numbers is no longer a requirement to receive and Service Provider Code token, some Service Provider Codes are not in the LERG. We left the LERG company name blank for those providers in this table.

Note that the above data reflects both call volume and SHAKEN activity. The data shows the proportion of successfully verified calls received by ClearIP customers for each originating service provider as a percentage of all successfully verified calls.

If a small number of calls were received from an originating service provider, then percentage of successfully verified calls received by ClearIP customers would be low, even if the originating service provider signed a high percentage of their outbound calls.

The above data includes only originating service providers that had at least one successfuly verified call received by a ClearIP customer.

Certificate repositories

What are typical certificate latencies, i.e., time-to-fetch, and why? This was one of the most surprising results in the March/April statistics, and it continues to this day. Several Certificate Repositories are adding significant latency and post dial delay to calls because they are not set up to use cache control.

Retrieving a certificate from a certificate repository takes time, or latency, which increases Post-Dial Delay (PDD). If a certificate is cached by the STI-VS, then it does not need to be retrieved.

A certificate repository can be configured to provide a Cache-Control HTTP header, which tells the STI-VS how long to cache the certificate after retrieving it. If a certificate repository does not provide the Cache-Control header, the STI-VS does not cache the certificate or caches the certificate for only a short time.

Note that the ClearIP STI-VS caches certificates for 60 minutes if the Cache-Control header is not set by the certificate repository or if the Cache-Control header contains a value of less than 60 minutes.

Summary

• More than 6% of calls were signed. This is a significant improvement over March/April, where fewer than 3% had a PASSporT.
• Fewer than 3% of signed calls had verification errors. This is significantly higher than March/April. The vast majority of the signed calls with verification errors were due to self-signed certificates.
• More than 98% of successfully verified calls had an attestation level of A. This is nearly identical to what was seen in March/April.
• Successfully verified calls were received from 50 originating service providers. This is almost double the number of unique Service Provider Codes seen during March/April.
• More than 55% of certificate repositories did not include the Cache-Control header. This is slightly lower than March/April.

TransNexus solutions

We offer STIR/SHAKEN and robocall mitigation solutions in our ClearIP and NexOSS software platforms. We can make your STIR/SHAKEN deployment a smooth process.

In addition, we help service providers with all aspects of STIR/SHAKEN deployment, including registering with the Policy Administrator and filing their certification with the FCC.

Contact us today to learn more.