Proposed updates to SHAKEN governance standards

There are a few updates under consideration for the SHAKEN governance standard to clarify support for delegate certificates and RespOrg participation. This article reviews the proposed changes.

The current version of the governance standard is described in ATIS-1000080.v004, ATIS Standard on Governance Model and Certificate Management. The standard describes how an originating provider is approved by the STI Policy Adminstrator to receive Service Provider Code (SPC) Tokens necessary to obtain a SHAKEN certificate, then presents the SPC token to a STI Certification authority to receive a SHAKEN certificate.

From that point, the SHAKEN-authorized provider can generate SHAKEN PASSporTs and digitally sign them using its SHAKEN certificate and Public Key Infrastructure (PKI) methods as described in ATIS-1000074.v003, ATIS Standard on SHAKEN.

Proposed changes under consideration

The primary changes under consideration involve the following:

1. Adding normative references to the following standards:
   1. ATIS-1000092, ATIS Standard on Delegate Certificates (Zip file)
   2. ATIS-1000093, ATIS Standard on Toll-Free Numbers in the SHAKEN Framework.
2. Replacing the term Service Provider with STI Participant, a broader definition that includes “Service Providers RespOrgs, and other parties that the STI-GA authorizes to obtain SPC Tokens.” (Note: RespOrgs assign, manage, and administer toll-free numbers in the Toll-Free Number Registry.)
3. Miscellaneous edits to :
   1. Improve the security of the governance framework
   2. Clarify the text in the standard.

In October 2021, the STI Governance Authority announced support for enhanced SHAKEN functionality, including:

• Support for delegate certificates
• Authorization for RespOrgs to:
  1. Obtain a Subordinate CA certificate from a STI Certification Authority
  2. Issue delegate certificates to VoIP entities to whom they issued toll-free numbers.

The proposed edits to ATIS-1000080 will align and clarify the governance standard for delegate certificates and RespOrgs.

Miscellaneous edits

The proposed updates also include more specific requirements for:

• Which certificates are stored in the STI Certificate Repository (STI-CR),
• Listing certificates in order that each certificate is followed by the certificate that issued it, and
• PEM encoding certificates.

Another proposed update involves requirements to enforce best practices for deployment of STI-CRs.

Note that these updates are still under discussion and may evolve before publication.

TransNexus solutions

TransNexus is a leader in developing innovative software to manage and protect telecommunications networks. The company has over 20 years’ experience in providing telecom software solutions including toll fraud prevention, robocall mitigation and prevention, TDoS prevention, analytics, routing, billing support, STIR/SHAKEN and SHAKEN certificate services.

Contact us today to learn more.