Overview The baseline SHAKEN framework and the core STIR protocols from which SHAKEN is based support the call authentication for the common 2-way call scenario where user-a calls user-b. For this case, the originating network generates a PASSporT containing "orig", "dest" and "iat" claims to assert that the calling telephone number (TN) is authorized to be used as the originating identity for that specific call. The terminating network can then verify that the PASSporT signature is valid, and that the "dest" claim matches the target called TN, to determine with a high degree of certainty that the calling TN identifies the calling user. However, for call scenarios where a call is retargeted, the verification process becomes less certain due to the fact that the PASSporT "dest" claim may no longer match the target called TN. Based only on the SHAKEN Identity header from the first leg of the call, the verification service is unable to validate the associated changed telephone destinations. This document presents the solution for extending the SHAKEN framework to support these call retargeting scenarios. draft-ietf-stir-passport-divert defines a PASSporT extension, "div", as a basis for accommodating the retargeting that may occur for various SIP applications. The PASSporT provides an indication that the original called “div” number in the PASSporT no longer reflects the destination to which a call is likely to be delivered. “shaken” When an INVITE is retargeted, the "div" PASSporT extension enables an STI-AS to authenticate the TN of the retargeting entity. Therefore, when a retargeted INVITE request arrives at its final destination, a verification service (STI-VS) can use the received "div" PASSporT authentication information to verify the identity of each entity that retargeted the INVITE.
Overview The baseline SHAKEN framework and the core STIR protocols from which SHAKEN is based support the call authentication for the common 2-way call scenario where user-a calls user-b. For this case, the originating network generates a PASSporT containing "orig", "dest" and "iat" claims to assert that the calling telephone number (TN) is authorized to be used as the originating identity for that specific call. The terminating network can then verify that the PASSporT signature is valid, and that the "dest" claim matches the target called TN, to determine with a high degree of certainty that the calling TN identifies the calling user. However, for call scenarios where a call is retargeted, the verification process becomes less certain due to the fact that the PASSporT "dest" claim may no longer match the target called TN. Based only on the SHAKEN Identity header from the first leg of the call, the verification service is unable to validate the associated changed telephone destinations. This document presents the solution for extending the SHAKEN framework to support these call retargeting scenarios. draft-ietf-stir-passport-divert defines a PASSporT extension, "div", as a basis for accommodating the retargeting that may occur for various SIP applications. The “div” PASSporT provides an indication that the original called number in the “shaken” PASSporT no longer reflects the destination to which a call is likely to be delivered. When an INVITE is retargeted, the "div" PASSporT extension enables an STI-AS to authenticate the TN of the retargeting entity. Therefore, when a retargeted INVITE request arrives at its final destination, a verification service (STI-VS) can use the received "div" PASSporT authentication information to verify the identity of each entity that retargeted the INVITE.
IPNNI-2018-00107R000.docx