How does STIR/SHAKEN work?

Essentially what STIR/SHAKEN does is use digital certificates, based on common public key cryptography techniques, to ensure the authenticity of the call. Here’s how STIR/SHAKEN works in the world of telephony:

1. When a call is initiated, a SIP INVITE is received by the originating service provider.
2. The originating service provider verifies the call source and number to determine how to confirm validity.
   • Full Attestation (A) — The service provider authenticates the calling party AND confirms they are authorized to use this number. An example would be a registered subscriber.
   • Partial Attestation (B) — The service provider verifies the call origination but cannot confirm that the call source is authorized to use the calling number. An example would be a calling number from behind an enterprise PBX.
   • Gateway Attestation (C) — The service provider authenticates the call’s origin but cannot verify the source. An example would be a call received from an international gateway.
3. The originating service provider will now create a SIP Identity header that contains information on the calling number, called number, attestation level, and call origination, along with the certificate.
4. The SIP INVITE with the SIP Identity header with the certificate is sent to the destination service provider.
5. The destination service provider verifies the identity of the header and certificate.

The complete solution

STIR/SHAKEN is a great start and absolutely should be part of the overall robocall solution, but it is not the end all be all. STIR/SHAKEN only applies to SIP-initiated calls and must be supported by the carriers at both ends of a call. Thus, scammers could conceivably get past STIR/SHAKEN simply by originating their robocalls on a TDM network.

REDCOM’s Personalized Call Screening software already includes full STIR/SHAKEN support, but it goes much further than that. Our “best of all worlds” approach means that we also enable several other layers of protection including:

Reputation Scoring: We integrate directly with TNS Call Guardian, an industry-leading solution that uses real-time crowd-sourced data to identify abusive or unlawful callers.

White list/Black list: We allow carriers and subscribers to create their own white- and black-lists, which gives end users far more control over protecting their phone numbers.

Recorded Greetings: Requires the calling party to record a greeting, which is played to the called party before accepting the call.

Audio CAPTCHA: requires the caller to respond with dialed digits, which stops robocalls dead in their tracks.

Service providers that implement REDCOM’s Personalized Call Screening software will be in full compliance with the pending TRACED Act, with the option of going above and beyond STIR/SHAKEN by implementing any number of these customizable call blocking tools.

Pa$$w0rd C0mpl3xity!

Password complexity. What type of emotion does that simple phrase invoke? Do you shudder with trepidation at the thought of having to come up with a convoluted string of characters that comply with a myriad of rules? Do you gasp at the shock of not remembering your password to log into your bank account? Passwords can certainly be complex, and not in a good way. Fortunately, the idea of complex passwords is changing, and that’s a good thing.

In 2003 the National Institute of Standards and Technology (NIST) published the NIST Special Publication 800-63. Among other things, this document provided guidelines for password requirements. The recommendations for sufficiently complex passwords included the following:

• Must be a minimum of eight characters
• Must include a mix of uppercase letters, lowercase letters, numeric, and special characters
• Must not contain sequential characters from the username
• Must not contain sequential characters from the user’s first or last name
• Must change the password periodically (typically every 90-180 days)
• Must not reuse passwords (typically within the last eight)

As a result, passwords such as Pa$$w0rd!1 became commonplace. And therein lies the problem. We, as humans, are predictable. To overcome the awkwardness of the rules, we began using recognizable patterns. Worse yet, when it came time to change our password, the natural migration was to change Pa$$w0rd!1 to Pa$$w0rd!2. Again, predictable.

In a recent interview with the Wall Street Journal Bill Burr, the author of NIST SP 800-63, admitted that much of what he did was wrong. To be fair, he was flying somewhat blind. He looked for research data regarding password security and came up empty-handed. Empirical data simply didn’t exist at the time. So, he set about creating the recommendations and did what most of us would likely have done in the same situation. He set about creating some rules that made it sound as if it would result in hard to crack passwords. The unfortunate reality is that this resulted in passwords that were hard for humans to remember, but easy for computers to crack.

In June 2017 NIST SP 800-63 was updated and the password complexity recommendations were completely rewritten and simplified. These simplified requirements emphasize password length and memorability above all else. Longer passwords are harder to crack and we are less likely to use Post-it® notes to write down passwords. The updated password recommendations include:

• Longer passwords (typically up to 64 characters)
• A mix of character types is no longer recommended
• No need to change passwords unless there is evidence that it has been compromised
• Must be compared to a list of known bad passwords
• Must not contain the associated username
• Must not contain the user’s first or last name

Given the new recommendations, the general consensus is that a password should consist of four random words strung together. There is no need for a mix of character types, so the password would be made up of all lowercase letters without spaces. For example, coffeediplomaeaglephone.

Randall Munroe, cartoonist, and author of the xkcd webcomic put together a comparison on the strength of the two recommendations. He calculated the time needed to crack passwords from each of the two methods. He chose Tr0ub4dor&3 and correcthorsebatterystaple as the subjects of the analysis. He calculated that it would take a short three days to crack Tr0ub4dor&3 but a whopping 550 years would be needed to crack correcthorsebatterystaple. His results were verified as accurate by computer security specialists.

The good news is NIST recommendations have evolved to allow for passwords that are less frustrating to set up, easier to remember, and harder to crack. The bad news is that it takes time for the word to get out, have the recommendations adopted, and software developers to implement the changes.

As John Oliver points out, robocalls are plaguing the American public, and the problem is getting worse. According to the FCC, robocalls comprised 60% of all complaints! In fact, 47.8 billion nuisance calls got logged in 2018 alone.

The issue of nuisance calls is reaching fever pitch. It’s hard to go through a day without hearing about the inconvenience caused by so many calls. Today, in the latest in a series of articles about the maddening increase in nuisance calls, the website Gizmodo reports that some US carriers are working to mitigate robocalls even without regulatory guidance.

What can be done to stop Robocalls?

REDCOM gives service providers the opportunity to offer robocall blocking to subscribers with REDCOM’s Personalized Call Screening Solution (PCS). PCS puts an end to the constant bombardment of robocalls plaguing subscribers and relieves the broader issue of nuisance calls. PCS leads to happy customers and has the potential to generate new streams of revenue.

A "Best of all Worlds" solution

REDCOM’s PCS applies the proven STIR/SHAKEN (Secure Telephony Identity Revisited / Secure Handling of Asserted Information using toKENs) method to verify that Caller ID numbers aren’t being spoofed. Of course, while STIR/SHAKEN can help reduce nuisance calls, we also recognize the need to go further. Consumers need a flexible set of tools to protect themselves, especially as the perpetrators innovate new and annoying ways to circumvent protection.

That is why REDCOM PCS was developed as a “best of all worlds” solution, building upon STIR/SHAKEN with reputation scoring and various other tools for providers and subscribers to break through today’s barrage of nuisance calls.

Empowering providers and subscribers with a full toolbox

REDCOM PCS arms providers and consumers alike with a full toolbox of options beyond STIR/SHAKEN and reputation scoring. In that toolbox are white- and blacklists, a caller CAPTCHA, calling party name greeting, and more. Instead of feeling hopeless in a sea of nuisance calls, service providers can offer REDCOM Personal Call Screening to empower and protect their subscribers.

Legislation from Canada

On January 25th of 2018, the Canadian Radio-television and Telecommunications Commission (CRTC) introduced CRTC 2018-32 mandating that by March 31 of 2019, all Canadian telecommunications service providers must implement authentication and verification of caller ID information for Internet Protocol (IP) voice calls.

With more attention being brought to the issue in the U.S., similar legislation is likely to be rolled out in the near future. REDCOM PCS is the “best of all worlds” solution that can position service providers to meet — and exceed — the requirements of future legislation.