1. SHAKEN
Jim McEachern
Senior Technology Consultant
ATIS
December 2017

2. PoP – Scenario #1 – Terminate PoP & Originate SHAKEN
SP-A
Analytics
PoP
SHAKEN
PoP AS
PoP VS
STI AS
STI VS …
SP-B
SP-C
SP-D
SP-Z

3. PoP – Scenario #2 – PoP E2E … SP-A Analytics PoP SP-B SP-C SP-D SP-ZAS
PoP VS …
SP-B
SP-C
SP-D
SP-Z

4. PoP – Scenario #3 – PoP & SHAKEN
SP-A
Analytics
PoP
PoP AS
PoP VS …
SP-B
SP-C
SP-D
SP-Z
STI AS
STI VS
SHAKEN

5. PoP – Scenario #1 - Performance
Originating SP must process PoP identity header and factor results into attestation in SHAKEN =
No impact on terminating SP
SP-A
Analytics
PoP
SHAKEN
PoP AS
PoP VS
STI AS
STI VS …
SP-B
SP-C
SP-D
SP-Z +
Originating SP can cache PoP certificates and refresh every time call is made from their customer PBx to any destination.

6. PoP – Scenario #2 – Local Cache+
Originating SP does not need to do anything. =
Terminating SP processes PoP identity header with complexity comparable to SHAKEN identity header.
SP-A
Analytics
PoP
PoP AS
PoP VS …
SP-B
SP-C
SP-D
SP-Z -
Terminating SP could cache PoP certificates but can only refresh every time call is made from a given customer PBx to a given VS function.

7. PoP – Scenario #2 – SP Cache+
Originating SP does not need to do anything. =
Terminating SP processes PoP identity header with complexity comparable to SHAKEN identity header.
SP-A
Analytics
Cache
PoP
PoP AS
PoP VS …
SP-B
SP-C
SP-D
SP-Z = -
Terminating SP could provide a centralized cache for PoP certificates and refresh every time call is made from a given customer PBx to any VS function within the terminating SP network. -
Incremental cost => terminating SP
Incremental revenue => originating SP
… especially with “bill and keep”.
However, this may be a very small portion of overall SIP signalling load.

8. PoP – Scenario #3 - Performance
Terminating SP must also process PoP identity header with complexity comparable to SHAKEN identity header.
Challenges caching PoP certificates.
SP-A
Analytics
PoP
PoP AS
PoP VS …
SP-B
SP-C
SP-D
SP-Z
STI AS
STI VS
SHAKEN = =
Terminating SP processes SHAKEN identity header.
Originating SP generates normal SHAKEN identity header.

9. PoP – Scenario #1 - Traceback
Traceback to the source of the “problem” (i.e., SP-A and enterprise) is complicated by having to go to SP-B and correlate SHAKEN origid with PoP certificate.
SP-A -
Analytics
PoP
SHAKEN
PoP AS
PoP VS
STI AS
STI VS …
SP-B
SP-C
SP-D
SP-Z
Does knowing that SP-B originated the call onto the network add any value? =

10. PoP – Scenario #2 - Traceback
Traceback points directly to the SP that issued the PoP certificate and then to the enterprise. +
SP-A
Analytics
PoP
PoP AS
PoP VS …
SP-B
SP-C
SP-D
SP-Z =
“Originating SP” role is equivalent to intermediate (transit) providers. -

11. PoP – Scenario #3 - Traceback
Traceback points directly to the SP that issued the PoP certificate and then to the enterprise. +
SP-A
Analytics
PoP
PoP AS
PoP VS …
SP-B
SP-C
SP-D
SP-Z
STI AS
STI VS
SHAKEN =
Traceback also points to the SP that originated the call onto the network. Is this information useful?

12. Other Considerations: Malformed Identity Headers
Is there value in the originating SP verifying PoP Identity header to spot problems (e.g., hacked PBX) closer to the source?
SP-A
Analytics
PoP
SHAKEN
PoP AS
PoP VS
STI AS
STI VS …
SP-B
SP-C
SP-D
SP-Z

13. Other Considerations: Lawful Intercept
Scenario 1
Do any of these scenarios have advantages or disadvantages for lawful intercept?
Scenario 2
Scenario 3

14. Conclusions
Allowing PoP Identity headers to go end-to-end does add some new responsibilities on the terminating SP:
They must support PoP Identity headers
Caching public certs is less efficient than for standard SHAKEN
Centralized caching for all calls to terminating SP improves efficiency
Bill & Keep may create misalignment between costs and benefits (though may be small)
Terminating PoP Identity headers at the originating SP does not improve traceback, and may even complicate traceback.
If PoP certs go end-to-end, the originating SP could add a second, SHAKEN Identity header if they needed to (e.g., if terminating SP could not verify PoP Identity header).
Are there any implications for lawful intercept?
Important to verify that allowing PoP Identity headers to go end-to-end does not cause problems for other use cases (e.g., NS/EP).