In the quest to fortify our telecommunications against the dark arts of caller ID spoofing, the latest standard from ATIS has arrived like a knight in shining armor. Let’s unpack the Out-of-Band SHAKEN and see how it’s equipping us to bridge the gaps left by non-IP segments in our network.
The Challenge of Non-IP Sections: A Technological Quandary
Imagine a straightforward journey where an Originating Service Provider (OSP) sends a call complete with a SHAKEN PASSporT—a digital seal that certifies the call’s authenticity. This works seamlessly in an all-SIP environment where the digital seal travels intact to the Terminating Service Provider (TSP).
However, trouble brews when our call encounters a non-IP segment—akin to a murky swamp where our digital seal disappears, leaving the TSP in the dark about the call’s authenticity.
The Ingenious Solution: Out-of-Band SHAKEN
To navigate around these tricky non-IP segments, the Out-of-Band SHAKEN acts as a strategic detour. Before our call enters the non-IP swamp, it securely deposits its SHAKEN PASSporT with a Call Placement Service (CPS). Once clear of the swamp, the PASSporT is retrieved, and the call’s authenticity is preserved.
What’s New with the Standard?
The latest Out-of-Band SHAKEN standard is a significant evolution on the original version (which we have discussed before). Previously, responsibilities were fixed: OSPs published the PASSporT, and TSPs retrieved it. This was straightforward but not always equitable, especially if intervening non-IP segments were introduced by other providers.
Now, the responsibility to publish or retrieve PASSporTs aligns with the presence of non-IP segments. Essentially, any provider encountering a non-IP segment takes on the corresponding role. This fairer distribution ensures that the burden falls on those directly interacting with the non-IP segments.
Moreover, for added security and to alleviate concerns about retrieving the incorrect PASSporT, the new standard allows the two ends of the TDM trunk to agree to use a specific CPS (perhaps even a private CPS?) and also mandates specifying the Service Provider Code (SPC) during retrieval. These two requirements substantially remove previous concerns that a hacker could access a PASSporT by submitting requests to retrieve PASSporTs from the CPS pool based solely on the phone numbers involved.
Implications for Rural Telecom Providers
For rural service providers, this new standard means that we’re getting close to an agreed approach for securing calls against spoofing without overhauling your existing infrastructure. Adopting Out-of-Band SHAKEN would allow you to maintain customer trust and meet regulatory requirements effectively, even with mixed-technology networks.
Conclusion
As we navigate through the complexities of modern telecommunications, the Out-of-Band SHAKEN standard offers a robust tool to ensure call authenticity across diverse network types. It’s a testament to the industry’s commitment to adapting and enhancing security measures, keeping us all one step ahead in the ongoing battle against fraud. While the FCC has not mandated the implementation of Out-of-Band SHAKEN, it continues to monitor the progress and encourages voluntary adoption – so this could be the technology we’ll all be using in a few years once we reach a consensus on the best approach.
For now, it’s good for you to stay abreast of these developments as the industry evolves toward more secure and reliable communication frameworks.
If you need any help with STIR/SHAKEN in your network, or if you are looking for a more affordable option that what you’re using today, please don’t hesitate to reach out and we’d be happy to review the options.
