STIR/SHAKEN Framework: Implementation Guide for Carriers
Published by AVM Networks NOC Engineering • Category: Standards & Compliance • 9 min read
A definitive guide to implementing FCC and international STIR/SHAKEN caller ID authentication, digital certificates, and STI-GA governance.
A definitive guide to implementing FCC and international STIR/SHAKEN caller ID authentication, digital certificates, and STI-GA governance.
- Full Attestation (Level A) cryptographically binds enterprise telephone numbers to verified caller identity, eliminating fraudulent CLI spoofing and spam tagging.
- The RFC 8224 SIP Identity header encapsulates an RFC 8225 PASSporT JSON Web Token signed via ECDSA (ES256) and verified against official STI-CA trust anchors.
- International voice transit carriers entering North America must file with the FCC Robocall Mitigation Database (RMD) to prevent downstream SBC call blocking.
1. What Are STIR/SHAKEN Attestation Levels A, B, and C?
The STIR (Secure Telephone Identity Revisited) and SHAKEN (Signature-based Handling of Asserted information using toKENs) framework mandates cryptographic signing of telephone numbers in SIP signaling to combat caller ID spoofing.
Attestation levels define the degree of trust placed in the calling party:
• Full Attestation (Level A): The signing service provider confirms that the customer has a direct relationship with the carrier and is legally authorized to use the specific telephone number displayed in the CLI.
• Partial Attestation (Level B): The service provider authenticates the customer origin (e.g., enterprise PBX trunk) but cannot independently verify telephone number ownership.
• Gateway Attestation (Level C): The service provider receives the call from an international gateway or intermediary transit partner without knowledge of the caller identity.
2. How Does the RFC 8224 SIP Identity Header Encapsulate PASSporT JWTs?
The cryptographic core of STIR/SHAKEN is a JSON Web Token (JWT) formatted as a PASSporT (RFC 8225). It is encoded in Base64URL and injected into the SIP INVITE inside an Identity header.
The Identity header contains three segments: a JOSE header indicating the elliptic curve signing algorithm (ES256) and certificate URL (x5u), a payload detailing origination and destination MSISDNs, and a cryptographic signature verified by the terminating provider against the STI-CA certificate chain.
{
"header": {
"alg": "ES256",
"ppt": "shaken",
"typ": "passport",
"x5u": "https://cert.avmnetworkslimited.com/sti-ca/avm-2026-09.pem"
},
"payload": {
"attest": "A",
"dest": {
"tn": ["+14155550199"]
},
"iat": 1757894400,
"orig": {
"tn": "+12125550144"
},
"origid": "d3840b2a-5bf8-4691-884c-avm-shaken-token-01"
},
"signature": "c0e9...[256-bit ECDSA signature]..."
}3. How Do Carriers Implement Cross-Border Robocall Mitigation and FCC Compliance?
For international wholesale carriers delivering traffic into North America, STIR/SHAKEN requires registration on the FCC Robocall Mitigation Database (RMD). Unregistered foreign transit carriers face automatic call blocking at downstream US border SBCs.
AVM Networks operates certified STI-AS (Authentication Service) and STI-VS (Verification Service) nodes, allowing wholesale partners to maintain Level A/B signing across bilateral SIP trunks.
Direct SIP Peering & STIR/SHAKEN Trunks
Establish authenticated SIP interconnections with automated cryptographic attestation.
Connect via SIP Trunk →Authoritative Standards & Regulatory Citations
- SIP Authenticated Identity Management (RFC 8224) (IETF - RFC 8224)
- PASSporT: Personal Assertion Token (RFC 8225) (IETF - RFC 8225)
- FCC Robocall Mitigation Database & STIR/SHAKEN Mandate (FCC - 47 CFR § 64.6300)
Frequently Asked Engineering Questions
Does AVM Networks support Level A STIR/SHAKEN tokens for enterprise customers?
Yes, all verified enterprise and wholesale customers using authenticated CLI ranges receive full cryptographic Level A signing, maximizing call answer rates on major US mobile carriers.
What happens if a wholesale carrier passes unauthenticated international traffic?
Unauthenticated traffic receives Level C Gateway attestation and is subject to analytics-based tagging (Spam Likely) or outright termination rejection under FCC 47 CFR § 64.6300.