STIR and SHAKEN Overview

Your Guide to Everything STIR and SHAKEN

STIR (Secure Telephony Identity Revisited) and SHAKEN (Secure Handling of Asserted information using toKENs) are the frameworks that promise to prevent the completion of illegally spoofed calls.

Overview

STIR and SHAKEN use digital certificates, based on common public key cryptography techniques, to ensure the calling number of a telephone call is secure. Each telephone service provider obtains their digital certificate from a certificate authority who is a trusted authority. The certificate technology enables the called party to verify that the calling number is accurate and has not been spoofed.

SHAKEN Work Flow

1. A SIP INVITE is received by the originating telephone service provider.
2. The originating telephone service provider checks the call source and calling number to determine how to attest for the validity of the calling number.
3. Full Attestation - The service provider has authenticated the calling party and they are authorized to the use the calling number. An example of this case is a subscriber registered with the originating telephone service provider’s softswitch.
4. Partial Attestation - The service provider has authenticated the call origination, but cannot verify the call source is authorized to use the calling number. An example of this use case is a telephone number behind an enterprise PBX.
5. Gateway Attestation - The service provider has authenticated from where it received the call, but cannot authenticate the call source. An example of this case would be a call received from an international gateway.
6. The originating telephone service provider uses the authentication service to create a SIP identity header. The authentication service could be a third party service hosted in the cloud, or a software application integrated with the telephone service provider’s Session Border Controller (SBC) or a softswitch. The SIP identity header contains the following encrypted data:
7. Calling number
8. Called number
9. Date and time
10. Attestation
11. Unique originating identifier