Out-of-Band STIR for Service Providers
draft-peterson-stir-servprovider-oob-00

Document Type Active Internet-Draft (individual)
Last updated 2020-03-09
Stream (None)
Intended RFC status (None)
Formats plain text pdf htmlized bibtex
Stream Stream state (No stream defined)
Consensus Boilerplate Unknown
RFC Editor Note (None)
IESG IESG state I-D Exists
Telechat date
Responsible AD (None)
Send notices to (None)
Network Working Group                                        J. Peterson
Internet-Draft                                                   Neustar
Intended status: Informational                             March 9, 2020
Expires: September 10, 2020

                 Out-of-Band STIR for Service Providers
                draft-peterson-stir-servprovider-oob-00

Abstract

   The Secure Telephone Identity Revisited (STIR) framework defines
   means of carrying its Persona Assertion Tokens (PASSporTs) either in-
   band, within the headers of a SIP request, or out-of-band, through a
   service that stores PASSporTs for retrieval by relying parties.  This
   specification defines a way that the out-of-band conveyance of
   PASSporTs can be used to support large service providers, for cases
   in which in-band STIR conveyance is not universally available.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on September 10, 2020.

Copyright Notice

   Copyright (c) 2020 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of

Peterson               Expires September 10, 2020               [Page 1]
Internet-Draft            Service Provider OOB                March 2020

   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   3
   3.  Service Provider Deployment Architecture for Out-of-Band STIR   3
   4.  Advertising a CPS . . . . . . . . . . . . . . . . . . . . . .   3
   5.  Submitting a PASSporT . . . . . . . . . . . . . . . . . . . .   4
   6.  PASSporT Retrieval  . . . . . . . . . . . . . . . . . . . . .   5
   7.  Acknowledgments . . . . . . . . . . . . . . . . . . . . . . .   6
   8.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   6
   9.  Security Considerations . . . . . . . . . . . . . . . . . . .   6
   10. Informative References  . . . . . . . . . . . . . . . . . . .   6
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .   7

1.  Introduction

   STIR [RFC8224] provides a cryptographic assurance of the identity of
   calling parties in order to prevent impersonation, which is a key
   enabler of unwanted robocalls, swatting, vishing, voicemail hacking,
   and similar attacks (see [RFC7340]).  The STIR out-of-band
   [I-D.ietf-stir-oob] framework enables the delivery of PASSporT
   [RFC8225] objects through a Call Placement Service (CPS), rather than
   carrying them within a signaling protocol such as SIP.  Out-of-band
   conveyance is valuable when end-to-end SIP delivery of calls is
   partly or entirely unavailable due to network border policies, calls
   routinely transitting a gateway to the PSTN, or similar
   circumstances.

   While out-of-band STIR can be implemented as an open Internet
   service, it then requires complex security measures to enable the CPS
   function without allowing the CPS to collect data about the parties
   placing calls.  This specification describes CPS implementations that
   act specifically on behalf of service providers who will be
   processing the calls that STIR secures, and who thus will learn about
   the parties to communication independently, so an alternative
   security architecture becomes possible.

   Environments that might support this flavor of STIR out-of-band
   include carriers, large enterprises, call centers, or any Internet
   service that aggregates on behalf of a large number of telephone
   endpoints.

Peterson               Expires September 10, 2020               [Page 2]
Internet-Draft            Service Provider OOB                March 2020

Show full document text