Subject: [stir] new SIP Method DYPTC 'Did You Place This Call?'

From: Wolfgang Beck <[email-masked]>
Date: Thu, 7 Nov 2013 18:47:10 +0100

Here's a half-baked idea: when a call c1 arives from <a>, I send a DYPTC
SIP request message outside of this call back to <a>. The DYPTC request
carries some headers that describe c1, eg. the original from and to.

- if the receiving UA is indeed <a>, it responds with 200 OK. The origin of
call c1 is now verified.

- if <a> was spoofed by somebody, the request will arrive at a UA that does
not know about the call described by DYPTC. It responds with 404 Not Found

- if <a> was spoofed and there is no UA reachable, the request will time
out or the network will generate a 404 Not found.

Whenever I dont receive a 200 OK on a DYPTC, the calling number could not
be verified.

So far all methods to determine a party that can verify a number seem to
boil down to one of the two groups:

1. create a new database, replicated from the telcos' databases, that can
be accessed by end devices. That's what iMessage, whatsapp, and VIPR try to
do. Accurately replicating a fairly dynamic database without its
cooperation is a challenge.

2. create a way so that end devices can directly query the telcos'
databases. DNS is an obvious candidate for this.

However, accessing the database itself is not enough. The end device would
have to replicate all routing decisions the telcos make. All discussions
about PBXs and number portability are essentially about the routing inside
the telcos.

Why not just use the existing platform to verify calling numbers?

Wolfgang Beck

---

From: Victor Pascual Avila <[email-masked]>
Date: Fri, 8 Nov 2013 00:09:01 +0100

Check this one: http://tools.ietf.org/html/draft-kuthan-sip-derive-00

On Thu, Nov 7, 2013 at 6:47 PM, Wolfgang Beck
<[email-masked]> wrote:
> Here's a half-baked idea: when a call c1 arives from <a>, I send a DYPTC SIP
> request message outside of this call back to <a>. The DYPTC request carries
> some headers that describe c1, eg. the original from and to.
>
> - if <a> was spoofed and there is no UA reachable, the request will time out
> or the network will generate a 404 Not found.
>
> Whenever I dont receive a 200 OK on a DYPTC, the calling number could not be
> verified.
>
> 1. create a new database, replicated from the telcos' databases, that can be
> accessed by end devices. That's what iMessage, whatsapp, and VIPR try to do.
> Accurately replicating a fairly dynamic database without its cooperation is
> a challenge.
>
> _______________________________________________
> stir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/stir
>

-- 
Victor Pascual Ávila