STIR/SHAKEN
STIR/SHAKEN is the Acronym for Secure Telephone Identity Revisited / Signature-based Handling of Asserted information using toKENs
A framework designed to combat caller ID spoofing in telephone networks, especially in the fight against illegal robocalls. STIR/SHAKEN is a two-part solution that combines technical standards and implementation guidelines to authenticate caller IDs and prevent malicious spoofing. The framework has become a regulatory requirement in the United States under FCC rules and is being adopted by major telecom providers.
How STIR/SHAKEN Works
STIR stands for Secure Telephone Identity Revisited, a set of technical standards developed by the Internet Engineering Task Force (IETF). It specifies how to digitally sign calls at the start of their journey through the phone network, verifying that the caller ID has not been tampered with. SHAKEN stands for Signature-based Handling of Asserted information using toKENs, a set of implementation guidelines created by the Alliance for Telecommunications Industry Solutions (ATIS). SHAKEN defines how STIR's digital signatures should be used and verified within carrier networks.
- Digital Signatures: The originating carrier attaches a cryptographic signature attesting to the legitimacy of the caller ID.
- Verification Process: Downstream carriers check this signature. If verified, the call is delivered with an indicator that the caller ID is authenticated.
Implementation and Adoption
In practice, when a call is placed, the originating carrier attaches a cryptographic signature attesting to the legitimacy of the caller ID. Downstream carriers then check this signature. If verified, the call is delivered with an indicator that the caller ID is authenticated. If not, the call may be marked as potentially fraudulent or blocked.
- Regulatory Requirement: STIR/SHAKEN has become a regulatory requirement in the United States under FCC rules.
- Telecom Providers: The framework is being adopted by major telecom providers to improve consumer trust in phone calls.
Limitations
While STIR/SHAKEN improves consumer trust in phone calls by helping to distinguish legitimate calls from spoofed ones, it does not stop robocalls entirely, especially those originating outside of compliant networks.
- Non-Compliant Networks: Robocalls from networks not adhering to STIR/SHAKEN standards may still bypass verification.
- Consumer Trust: The framework enhances trust but does not eliminate all forms of phone-based fraud.
