Systems and methods for stir-shaken attestation using SPID
Embodiments described herein provide for evaluating call metadata and certificates of inbound calls for authentication. The computer identifies a service provider indicated by the SPID and/or the ANI (or other identifier) of the metadata and identifies a service provider indicated by the SPID and/or ANI (or other identifier) of the certificate, then compares identities of the service providers and/or compares the data values associated with the service providers (e.g., SPIDs, ANIs). Based on this comparison, the computer determines whether the service provider that signed the certificate is first-party signer (e.g., carrier) for the ANI or a third-party signer that is signing certificates as the first-party signer for the ANI.
1. A computer-implemented method comprising:
receiving, by a computer, signaling metadata for an inbound call indicating an Automated Number Identification (ANI) and a first Service Profile Identifier (SPID) associated with the ANI, and a certificate indicating a second SPID and an attestation level for the inbound call;
identifying, by the computer, a first provider indicated by the first SPID and a second provider indicated by the second SPID by querying a certificate authentication database;
determining, by the computer, a signer-level of the second provider for the inbound call based upon comparing the first provider identified by the first SPID and the second provider identified by the second SPID; and
generating, by the computer, an authentication score for the inbound call based upon the attestation level and the signer-level.
2. The method according to claim 1 , further comprising authenticating, by the computer, the inbound call in response to determining that the authentication score satisfies an authentication threshold.
3. The method according to claim 1 , wherein the attestation level indicated by the certificate includes at least one of full attestation, partial attestation, and gateway attestation.
4. The method according to claim 1 , further comprising determining, by the computer, that the signer-level is a first-party service provider in response to determining that the first provider identified by the first SPID corresponds to the second provider identified by the second SPID.
5. The method according to claim 1 , further comprising identifying, by the computer, one or more missing signaling data fields in the signaling metadata, wherein the computer determines the authentication score based upon a number of missing signaling fields or a type of a missing signaling data field.
6. The method according to claim 1 , further comprising extracting, by the computer, certificate identity header data as a portion of the signaling metadata, the certificate identity header data including at least one of: the attestation level, the certificate, a calling number, called number, a timestamp, and a unique originating identifier.
7. The method according to claim 1 , wherein the computer receives the signaling metadata of the inbound call via a call center, the signaling data indicating the call center as a call destination of the inbound call.
8. The method according to claim 1 , further comprising generating, by the computer, a spoof likelihood score indicating a likelihood that inbound call is a spoofed call, based upon the signaling metadata, wherein the computer generates the authentication score based upon spoof likelihood score.
9. The method according to claim 1 , further comprising generating, by the computer, a verification score for the second SPID based upon the attestation level and a level of similarity between the signaling metadata associated with the first SPID and the signaling metadata associated with the second SPID, wherein the computer generates the authentication score based upon the verification score.
10. The method according to claim 1 , further comprising generating, by the computer, a reputation score for the second SPID based upon one or more behavior features associated with the second SPID, wherein the computer generates at least one of the authentication score, a verification score, and a spoof likelihood score based upon the reputation score for the second SPID.
11. A system comprising:
a computer coupled to a telecommunications system and comprising a processor configured to:
receive signaling metadata for an inbound call indicating an Automated Number Identification (ANI) and a first Service Profile Identifier (SPID) associated with the ANI, and a certificate indicating a second SPID and an attestation level for the inbound call;
identify a first provider indicated by the first SPID and a second provider indicated by the second SPID by querying a certificate authentication database;
determine a signer-level of the second provider for the inbound call based upon comparing the first provider identified by the first SPID and the second provider identified by the second SPID; and
generate an authentication score for the inbound call based upon the attestation level and the signer-level.
12. The system according to claim 11 , wherein the computer is further configured to authenticate the inbound call in response to determining that the authentication score satisfies an authentication threshold.
13. The system according to claim 11 , wherein the attestation level indicated by the certificate includes at least one of full attestation, partial attestation, and gateway attestation.
14. The system according to claim 11 , wherein the computer is further configured to determine that the signer-level is a first-party service provider in response to determining that the first provider identified by the first SPID corresponds to the second provider identified by the second SPID.
15. The system according to claim 11 , wherein the computer is further configured to identify one or more missing signaling data fields in the signaling metadata, wherein the computer determines the authentication score based upon a number of missing signaling fields or a type of a missing signaling data field.
16. The system according to claim 11 , wherein the computer is further configured to extract certificate identity header data as a portion of the signaling metadata, the certificate identity header data including at least one of: the attestation level, the certificate, a calling number, called number, a timestamp, and a unique originating identifier.
17. The system according to claim 11 , wherein the computer is configured to receive the signaling metadata of the inbound call via a call center, the signaling data indicating the call center as a call destination of the inbound call.
18. The system according to claim 11 , wherein the computer is further configured to generate a spoof likelihood score indicating a likelihood that inbound call is a spoofed call, based upon the signaling metadata, wherein the computer generates the authentication score based upon spoof likelihood score.
19. The system according to claim 11 , wherein the computer is further configured to generate a verification score for the second SPID based upon the attestation level and a level of similarity between the signaling metadata associated with the first SPID and the signaling metadata associated with the second SPID, wherein the computer generates the authentication score based upon the verification score.
20. The system according to claim 11 , wherein the computer is further configured to generate a reputation score for the second SPID based upon one or more behavior features associated with the second SPID, wherein the computer generates at least one of the authentication score, a verification score, and a spoof likelihood score based upon the reputation score for the second SPID.