Spoofing Against Spoofing: Toward Caller ID Verification in Heterogeneous Telecommunication Systems
Spoofing Against Spoofing: Toward Caller ID Verification in Heterogeneous Telecommunication Systems
复制标题
反欺骗：异构电信系统中的来电显示验证
DOI：
10.1145/3625546
复制
发表时间：
2023
影响因子：
2.3
通讯作者：
Wang S
中科院分区：
文献类型：
--
作者：
Wang S
主叫方ID欺骗是一个全球性的行业问题，通常是电话欺诈的关键促成因素。为了解决这个问题，联邦通信委员会已经授权美国的电信提供商实施STIR/SHAKEN，这是一种基于数字签名的行业驱动解决方案。STIR/SHAKEN依赖于公钥基础设施（PKI）来管理数字证书，但在全球电信行业中扩展这种PKI是极其困难的，如果不是不可能的话。此外，它只适用于基于IP的系统（例如，SIP），留下传统的非IP系统（例如，SS7）unprotected.到目前为止，STIR/SHAKEN的替代品尚未得到充分研究。在本文中，我们提出了一个无PKI的解决方案，称为来电显示验证（CIV）。CIV基于质询-响应过程而不是数字签名来验证呼叫者ID，因此不需要PKI。它支持IP和非IP系统。也许与直觉相反，我们表明可以利用数字欺骗，结合双音多频，以有效地实现挑战-响应过程，即，使用欺骗来对抗欺骗。我们通过只更新用户手机上的软件，在异构网络（SS 7/SIP）上为互联网协议语音、蜂窝和固定电话实现CIV。这是第一个来电显示身份验证解决方案，具有适用于当前电信体系结构中所有三种电话系统的工作原型。最后，我们展示了如何将CIV的实现作为一种服务集成到电信云中，从而优化CIV的实现。
Caller ID spoofing is a global industry problem and often acts as a critical enabler for telephone fraud. To address this problem, the Federal Communications Commission has mandated telecom providers in the U.S. to implement STIR/SHAKEN, an industry-driven solution based on digital signatures. STIR/SHAKEN relies on a public key infrastructure (PKI) to manage digital certificates, but scaling up this PKI for the global telecom industry is extremely difficult, if not impossible. Furthermore, it only works with IP-based systems (e.g., SIP), leaving the traditional non-IP systems (e.g., SS7) unprotected. So far the alternatives to the STIR/SHAKEN have not been sufficiently studied. In this article, we propose a PKI-free solution, called Caller ID Verification (CIV). CIV authenticates the caller ID based on a challenge-response process instead of digital signatures, hence requiring no PKI. It supports both IP and non-IP systems. Perhaps counter-intuitively, we show that number spoofing can be leveraged, in conjunction with Dual-tone Multi-frequency, to efficiently implement the challenge-response process, i.e., using spoofing to fight against spoofing. We implement CIV for Voice over Internet Protocol, cellular, and landline phones across heterogeneous networks (SS7/SIP) by only updating the software on the user’s phone. This is the first caller ID authentication solution with working prototypes for all three types of telephone systems in the current telecom architecture. Finally, we show how the implementation of CIV can be optimized by integrating it into telecom clouds as a service, which users may subscribe to.