Imagine receiving an ordinary phone call in the near future. Previously you may not have recognized the phone number. Or perhaps your former handset showed that the phone number matched an entry in your contact book. If you live in the USA then there was a 30 percent chance you would see a green checkmark indicating the call had an A-grade STIR/SHAKEN signature, although many people have been misled about what that really means. But as this is the future, your phone now does something very different whenever you receive a call from that person. Now it shows you a photograph of that person’s face, tells you their name, their job title, which company they work for, and plays an audio clip of him saying: “howdy, this is Jeffrey from Texas”, which proves to be consistent with the location of the caller as also shown on the handset screen. All of this occurs before you decide whether to pick up. That is the imminent future of call authentication per CHAKEN, the Chinese alternative to STIR/SHAKEN, which recently became a Chinese national standard and which Chinese telcos will implement this year. And it is not just the future for Chinese phone users, per the observations in the standard about CHAKEN being adopted by foreign authorities.
Chinese National Standard GB/T 43779-2024 (pictured) was published on April 25 but it took us a little while to obtain and interpret a copy. Now we know that ‘CHAKEN’ is the name given to the call validation methods described in that standard, in an obvious nod to the SHAKEN protocol promoted by US businesses. There is always some risk of misunderstandings occurring when scrutinizing a highly technical document written in a foreign language, especially when it builds upon many other unfamiliar technical specifications, but here are some key takeaways from the first look at CHAKEN.
Personal Avatars and Audio/Video Idents
Validation in STIR/SHAKEN occurs at the level of networks vouching for their users, but in CHAKEN the cryptographic authentication runs all the way to the individual’s handset. This means CHAKEN can safely do things that would be incredibly risky with STIR/SHAKEN. Proponents of STIR/SHAKEN have consciously confused what it means to comply with various standards, which is why they talk about STIR/SHAKEN when persuading the public that telcos must spend a lot of money on a questionable method of fraud reduction, when the real goal has always been the Rich Call Data (RCD) extension of STIR/SHAKEN which is already being sold to big telemarketing businesses as a way to increase the rate at which customers pick up. RCD is often treated as synonymous with ‘branded calling’, which is a good indication of who really wants it, so it is startling to see how CHAKEN has leaped far ahead of RCD by sequestering the same data channels to present a lot of information about the individual human being that makes the call, not just the entity that employs them.
To put it succinctly, the sales pitch for RCD delivered via SHAKEN is that the handset of recipients will display:
- the name of the organization calling them (such as the name of their bank);
- an image that may represent that entity’s corporate logo; and
- the reason for the call.
The data carried by CHAKEN can include all of above, plus the following:
- the name of the individual who made the call;
- their job title;
- the department they work in, as well as the company they work for;
- the country, the province, and possibly a more detailed address for where the call came from;
- a reference to the certification authority that was used to sign the call; and
- a video or audio file, or alternatively a URL that points to video or audio content.
The concept of video idents will be familiar to media professionals. You will have seen idents every time you went to the cinema; think of those little animations shown at the beginning of a film that tells you who made it. The ident for 20th Century Studios starts with drums beating as the camera swoops around giant golden letters illuminated by spotlights; the MGM ident was a lion roaring. Per CHAKEN, everybody can have an ident that plays on the phone of the person they are calling. The phone will either receive the audio/video data in the CHAKEN signature or will visit a URL to get the audio/video content before playing it as the call is received. The ident could be a short video or it could just be an audio clip. That is a huge step up from RCD’s ability to present a static image on behalf of a corporation, but not on behalf of individual users.
Multiple Identities for Each Phone
SHAKEN is keyed to an originating phone number, so there is no possibility of the same number being associated with multiple identities. This contrasts with CHAKEN, which leverages the data on the phone to permit a choice from multiple identities to be associated with each outgoing call. Perhaps this might be used in practice to distinguish between a call made from a mobile phone by a person who is at work, and by the same person during their leisure hours. Your ident for a work-related call may show you wearing a suit and tie; your leisure ident may be more playful. CHAKEN stipulates that all handsets must be capable of supporting at least five separate identities. This may cause some to wonder if there will be the potential to abuse the multiplicity of identities. It would be premature to reach a conclusion, as CHAKEN is meant to ultimately tie calls to the specific originating handset, meaning the Chinese authorities will also have far superior traceback abilities than those being touted for STIR/SHAKEN.
Five Security Tiers Instead of Three
Professionals who have taken an interest in STIR/SHAKEN may be bored to tears by how often its three attestation levels have been described. Put succinctly, an A-grade attestation has some value (if originating telcos respect it), whilst the B-grade is dubious and the C-grade is worthless. Details are limited in the CHAKEN standard, but it clearly offers five potential security tiers for each call. These tiers are named Platinum, Gold, Silver, Bronze and General. The General tier in CHAKEN will likely be equivalent to a C-grade attestation in SHAKEN, whilst Platinum will be above an A-grade attestation. The greater number of tiers in CHAKEN is possible because of the additional role that CHAKEN gives handsets to play in the process of supplying data about the originating party and checking whether that data is reliable.
Backwards Compatibility to SHAKEN and International Compatibility in General
CHAKEN borrows from SHAKEN, including the inspiration for its name, although the Chinese acronym is best translated as ‘Caller Identity Authentication Using Crypto Tokens’. Many of the concepts will be familiar to engineers who have studied STIR/SHAKEN, such as the use of a public key infrastructure to attach signatures to calls that are conveyed by SIP signals on IP networks. This means the authors were able to consciously make CHAKEN compatible with SHAKEN despite choosing to include a lot more within CHAKEN signatures. In essence, a CHAKEN-compatible handset should be able to reproduce all the data received via a SHAKEN signature carrying RCD data, but there would be less to reproduce.
The CHAKEN standard alludes more generally to how China’s national certification authorities would be able to accept signatures that comply with both China’s standard and equivalent standards imposed by other countries. The North American architects behind SHAKEN have made it a priority to encourage implementations of SHAKEN that would work on calls that cross international borders but with minimal success so far. Even calls between the USA and Canada do not benefit from cross-border validation yet. The CHAKEN architects have anticipated the desire for their method to also work for calls that pass between China and other countries.
Conclusions
Better technologists than me will need to review the standard to assess how well it will work in practice. Standards which look amazing on paper can flounder when implemented. However, the support of network manufacturers like Huawei and ZTE, plus the backing of three of the world’s biggest smartphone manufacturers in Samsung, OPPO and Xiaomi, is reason to treat this standard as a credible vision for how calls will be validated in future.
If CHAKEN works well then either there will be a competition with SHAKEN to see which countries choose to comply with each standard, or else there will be an alignment of standards with CHAKEN evidently offering a lot more than is included in STIR/SHAKEN, even if we treat the latter as synonymous with its RCD extension. That will make for interesting times. Commsrisk has consistently reiterated how standards like these are not just technological in nature; they also relate to governance. A US strategy to govern international telecoms traffic is an obvious threat to China’s interests, and CHAKEN offers a way to neutralize it.
SHAKEN has been driven by US companies and a US regulator with a particular view of who will decide which calls can be connected. Making room for CHAKEN would mean making compromises that many will find hard to accept. Platitudes about international collaboration in crime prevention are common because they are so easy to spout when nobody really expects collaboration to occur. The real appetite for international cooperation in validating calls may soon be put to the test.
