[stir] An alternative solution to authenticate caller ID

["Hao, Feng" <[e-mail]>]

Hello the STIR members,

My name is Feng Hao, from the Department of Computer Science, University of Warwick. Over the past two years, I and my team have been researching an alternative solution to authenticate the caller ID without using digital signatures as in STIR/SHAKEN. We want to avoid digital signatures as 1) they require a public key infrastructure which is difficult to scale; 2) they don't work well with non-IP networks (even for IP networks, the digital signatures can be dropped as soon as the call traverses a non-IP intermediate network in the call path).

Our solution, called Caller ID Verification (CIV), is based on a challenge-response protocol with the receiver sending a 4-digit challenge embedded as part of the CLI, and the calling party echoing the same 4 digits through DTMF in the response. We have prototyped this solution for landline, mobile and VoIP phones, and it appears that it works for all different networks (IP and non-IP). As researchers, we are limited to only modifying the software on the users' phones for a proof-of-concept demonstration. We believe a more practical deployment would be to implement the challenge-response process in the Telco cloud.

For SIP phones, we have tested that the delay for doing the challenge-response between the two SIP phones is around 4 seconds. The delay is mainly caused by using the INVITE signalling message to send the 4-digit challenge, however, we believe this delay can be substantially reduced, e.g., by using an out-of-band signalling message between the SIP servers. Our goal is to reduce the delay to milliseconds. This should be possible but it will require cooperation from the Telecom providers. A standard would help.

Our paper has full technical details. It has been accepted for publication in ACM Transactions on Privacy and Security, and a copy of the paper is freely available at https://arxiv.org/abs/2306.06198.

I'm reaching out to you to inquire if this is something of interest to the working group. We'll be more than happy to contribute if people think an alternative solution other than using digital signatures is useful. I would like to highlight that our intention is not to replace STIR/SHAKEN, which I understand has been the focus of this working group. From a technical perspective, STIR/SHAKEN authenticate the "carrier", while our solution authenticates the "caller ID". The difference is fundamental; the two solutions may well turn out to be complementary.

If anyone has any questions, I'm happy to answer. Any suggestions and comments are most welcome.

Best regards,
Feng