How PKI and SHAKEN/STIR Will Fight Illegal Robocalls and Caller ID Spoofing

There is a new ecosystem underway that will impact everyone, including those in the U.S. who receive 48 billion + robocalls each year. This new ecosystem will hopefully put an end to these irritating and fraudulent robocalls. The Federal Communications Commission (FCC) and major telecommunications companies including Comcast, AT&T, and T-Mobile are behind a new, global technology standard called SHAKEN/STIR (Signature-based Handling of Asserted Information using ToKENs and Secure Telephony Identity Revisited) to combat robocalls and caller ID spoofing. This new standard addresses the issue of commercial robocallers who are impersonating other callers and committing fraud via caller ID.

Public key infrastructure (PKI) is the backbone of the SHAKEN/STIR global technology standard. In order for the entire ecosystem to work, it needs to be created with a trusted PKI system as the base, using digital signatures in every single call, which are verified and authenticated. SHAKEN/STIR uses digital certificates, based on common public key cryptography techniques, to ensure the calling number of a telephone call is secure. The way it works is each telephone service provider obtains its digital certificate from a certificate authority that is trusted by other telephone service providers. The certificate technology enables the called party to verify that the calling number is accurate and has not been spoofed.

In order to build this new ecosystem to facilitate stronger identities for each and every call generated, an effective PKI ecosystem must be implemented. Strong identities and controls will be needed to ensure call identities are trusted globally. PKI is the technology that will be used to identify and verify each phone call. SHAKEN/STIR will shift the identity details from the call originator to the trusted telephone company routing the call. The industry – technology infrastructure, telecommunications, and government entities – needs to work together on a solution that will reduce fraud and put an end to robocalls. As this technology standard evolves and deployed, it is important to identify the security risks telecommunications companies will face and how enterprises can benefit from this work. Security will be required at every level of SHAKEN/STIR implementation.

Learning objectives:
1. Learn what the SHAKEN/STIR technology standard is and how it works
2. Understand the importance of implementing a PKI correctly
3. Learn the behind the scenes of how the flow of calls will work
4. Hear the latest status of this standard, where we are, outstanding issues, etc.