STIR/SHAKEN system to protect against scam calls

Scam calls have increased exponentially since 2019 and it’s time to find a good defense system. Canada and the United States have decided to try the STIR/SHAKEN solution.

STIR – Secure Telephony Identity Revisited – is the standard developed by the IEFT to define signature-based call authentication and SHAKEN – Signature-based Handling of Asserted information using tokens – is the framework used to implement protocols.

The STIR/SHAKEN system will be based on a digital signature, hence when someone makes a call, the SHAKEN Authentication module adds a digitally signed token to the call invite before moving it through the SIP interconnect. When the invite reaches the receiver, the SHAKEN verification system qualifies the token and either delivers or blocks the call. Therefore, this system allows identifying real calls from scam.

However, these tokens can’t be transmitted over a legacy network, which supports 85% of all robocalls. Indeed, the tokens are dropped at the first SIP to TDM conversion, hence when the system doesn’t identify a token, it will drop the invite.

One solution for this is using out-of-band (OOB) STIR/SHAKEN. By doing this, it gives the token a call placement service (CPS) before the network conversion, thus removing it from the call path and sending it to the destination over the internet. After it is received, the authentication server should match the call invite and the token at the destination and start the verification process. This change should help bypass the barriers between mixing network types.

Yet, since CPS has insight into all calls, the security needs to be carefully managed. The certification authority needs to have approval from policymakers to operate the CPS and be held responsible if there are some issues.

Moreover, STIR/SHAKEN can improve a key peripheral use-rich call data, containing information about who is calling and why. It will also have more information such as name, logo, picture, and call reason. Hence, users will be able to authenticate calls quickly all the while companies will have greater control over their brand’s appearance.

Telecom operators will have the choice to implement STIR/SHAKEN or not, however, smartphone manufacturers will need to be able to support rich call data.

STIR/SHAKEN should be implemented in June 2021 in Canada. However, Canadians already use basic call protection. Indeed, in December 2019, Canadian carriers adopted a rudimentary blocking feature, blocking calls from fake numbers. Yet, it cannot stop spam calls.

Therefore, it was decided to add STIR/SHAKEN by September 2020. Due to the pandemic, however, Canadian operators reported the implementation to 2021.