TWC: Small: Designing Strong End-to-End Authentication Mechanisms for Modern Telephony Systems

电话是全球数字通信的主要手段。这些系统在全球拥有60多亿用户，是地球上大多数人可用的唯一通信基础设施。传统上，身份验证一直是电话提供商最核心的安全问题。身份验证直接与计费流程捆绑在一起，可确保提供商能够正确地向特定各方收取网络使用费。这些技术的问题在于它们对终端用户几乎没有作用--虽然网络相当确定用户和网络用户的身份，但这些技术对帮助用户确定呼叫另一端的一方的身份毫无帮助。作为这一问题的主要证据，每年因电话诈骗而损失的金额远远超过20亿美元。这些攻击是可能的，因为身份验证模型只满足提供商的需求，而不是其客户的需求。如果要缓解来电显示欺骗等攻击，多样化的电话系统将需要更强大、更普遍适用的机制。这项研究通过将现代电话系统与全球身份验证基础设施捆绑在一起来解决身份验证问题，在过去20年中，全球身份验证基础设施极大地提高了Web上的交易安全性。这项提议寻求创造变革性的技术来减少大部分现代电话欺诈(例如，国税局欺诈、银行/电信欺诈)。

Telephony is the dominant means of digital communication across the globe. With more than six billion users worldwide, these systems represent the only communications infrastructure available to the majority of people on the planet. Authentication has traditionally been the most central security issue for telephony providers. Tied directly to the billing process, authentication ensures that providers are able to correctly charge specific parties for their network usage. The problem with these techniques is that they do very little for end users -- while the network is fairly certain of the identity of the user and the user of the network, these techniques do nothing to assist the user in determining the identity of the party on the other end of a call. As primary evidence of this problem, well over US$2 Billion is lost every year via phone fraud. These attacks are possible because the model of authentication addresses only the provider's needs, not those of their customers. If attacks such as Caller ID spoofing are ever to be mitigated, the diverse landscape of telephony systems will require stronger, more universally applicable mechanisms. This research addresses authentication problems by tying modern telephony systems into the global authentication infrastructure that has dramatically improved transaction security over the Web during the past two decades. This proposal seeks to create transformative techniques to mitigate much of modern phone fraud (e.g., IRS fraud, bank/wire fraud).