TWC: Small: Designing Strong End-to-End Authentication Mechanisms for Modern Telephony Systems

点击翻译按钮获取中文摘要

Telephony is the dominant means of digital communication across the globe. With more than six billion users worldwide, these systems represent the only communications infrastructure available to the majority of people on the planet. Authentication has traditionally been the most central security issue for telephony providers. Tied directly to the billing process, authentication ensures that providers are able to correctly charge specific parties for their network usage. The problem with these techniques is that they do very little for end users -- while the network is fairly certain of the identity of the user and the user of the network, these techniques do nothing to assist the user in determining the identity of the party on the other end of a call. As primary evidence of this problem, well over US$2 Billion is lost every year via phone fraud. These attacks are possible because the model of authentication addresses only the provider's needs, not those of their customers. If attacks such as Caller ID spoofing are ever to be mitigated, the diverse landscape of telephony systems will require stronger, more universally applicable mechanisms. This research addresses authentication problems by tying modern telephony systems into the global authentication infrastructure that has dramatically improved transaction security over the Web during the past two decades. This proposal seeks to create transformative techniques to mitigate much of modern phone fraud (e.g., IRS fraud, bank/wire fraud).