Re: [stir] Permitted spoofing

[Henning Schulzrinne <[e-mail]>]

On Jun 7, 2013, at 2:17 PM, Rosen, Brian wrote:
> 
> Please note that there are another class of calling party number spoofing circumstances we CAN do something about.  Suppose a doctor wants to place a call on her mobile that appears to come from her office number.  In that case the doctor can authorize the service that arranges that call.  They can get the cert for the office number and authorize the service to place calls with that number by giving them a cert for that authorization.  This also works for, as an example, a call center placing calls for an enterprise.


That's probably something we might want to flesh out a bit. My very rough vision in the central database case would be something like the following:

(1) Owner [doctors' office] says: "Please mint a cert that entitles Doctor Smith [public key attached] to use our number 555 1234." [signed by assignee]

(2) Database returns cert, which is handed to doctor.

(4) Doctor uses cert just like any other.