Subject: [stir] Small Carriers?

From: "Anton Tveretin" <[email-masked]>
Date: Sun, 26 Jul 2015 04:12:15 +0500

Hello All,
Just few thoughts. In Russia, SMS spammers are licensed as carriers. (At least they 
advertise as "licensed"). So they get SS7 links.
Maybe I am completely wrong, I do not know the situation.
So, we must track carriers, not just trust them. Thus, hop-by-hop authentication is required, 
possibly in addition to other mechanisms. But this is more a matter of policy, not protocol.
For instance, the network must validate each SIP message coming from a user equipment 
(UE). The network already authenticates the user somehow (not each message). This is an 
"asserted identity", even though it never appers in the PAI.
Checking of From-URI in a request  or To-URI in a response results in:
1. From-URI or To-URI matches the asserted identity.
2. From-URI or To-URI matches another AoR of the asserted user. (E.g. an alias.)
3. From-URI or To-URI is trusted (see "the doctor problem"). From-URI is trustor, the 
asserted identity is trustee.
4. From-URI or To-URI is anonymous. It could be considered as a sub-case of (3).
5. Anything else means an attempt to spoof.
Best regards,
Anton.