Out-of-Band STIR for Service Providers
draft-ietf-stir-servprovider-oob-01
Network Working Group J. Peterson
Internet-Draft Neustar
Intended status: Informational February 22, 2021
Expires: August 26, 2021
Out-of-Band STIR for Service Providers
draft-ietf-stir-servprovider-oob-01
Abstract
The Secure Telephone Identity Revisited (STIR) framework defines
means of carrying its Persona Assertion Tokens (PASSporTs) either in-
band, within the headers of a SIP request, or out-of-band, through a
service that stores PASSporTs for retrieval by relying parties. This
specification defines a way that the out-of-band conveyance of
PASSporTs can be used to support large service providers, for cases
in which in-band STIR conveyance is not universally available.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on August 26, 2021.
Copyright Notice
Copyright (c) 2021 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
Peterson Expires August 26, 2021 [Page 1]
Internet-Draft Service Provider OOB February 2021
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Service Provider Deployment Architecture for Out-of-Band STIR 3
4. Advertising a CPS . . . . . . . . . . . . . . . . . . . . . . 3
5. Submitting a PASSporT . . . . . . . . . . . . . . . . . . . . 5
6. PASSporT Retrieval . . . . . . . . . . . . . . . . . . . . . 6
7. Gateways . . . . . . . . . . . . . . . . . . . . . . . . . . 7
8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 7
9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7
10. Security Considerations . . . . . . . . . . . . . . . . . . . 7
11. Informative References . . . . . . . . . . . . . . . . . . . 7
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 9
1. Introduction
STIR [RFC8224] provides a cryptographic assurance of the identity of
calling parties in order to prevent impersonation, which is a key
enabler of unwanted robocalls, swatting, vishing, voicemail hacking,
and similar attacks (see [RFC7340]). The STIR out-of-band
[I-D.ietf-stir-oob] framework enables the delivery of PASSporT
[RFC8225] objects through a Call Placement Service (CPS), rather than
carrying them within a signaling protocol such as SIP. Out-of-band
conveyance is valuable when end-to-end SIP delivery of calls is
partly or entirely unavailable due to network border policies, calls
routinely transitting a gateway to the PSTN, or similar
circumstances.
While out-of-band STIR can be implemented as an open Internet
service, it then requires complex security measures to enable the CPS
function without allowing the CPS to collect data about the parties
placing calls. This specification describes CPS implementations that
act specifically on behalf of service providers who will be
processing the calls that STIR secures, and who thus will learn about
the parties to communication independently, so an alternative
security architecture becomes possible. These functions may be
crucial to the adoption of STIR in some environments, like mobile
networks, where in-band transmission of STIR may not be feasible.
Environments that might support this flavor of STIR out-of-band
include carriers, large enterprises, call centers, or any Internet
service that aggregates on behalf of a large number of telephone
Show full document text