you
Okay, so now it's Federico's turn unfortunately Daniel from the Camarillo project couldn't be with us today
but Federico will talk, will talk to us about steer and shake and maybe tell us why I'm getting all those robocalls from an energy hour
Good evening everyone can you hear me?
Yes, okay, thank you, so thank you Lorenzo for the introduction.
Yeah, my name is Federico Cavidu, I am a voice lead developer at Libon, it's a voice application developed in France
and I am contributor of the Camarillo project and this presentation should have seen also Daniel but he couldn't make it today
and Daniel Constantinierla is the co-founder of the Camarillo project
and today we are here to speak about sexy PIDX, which is a library CLI tool and REST API server implementing steer shaken
So first of all, steer shaken, steer stand for secure telephony identity revisited and shake and stand for secure handling of a certain information using tokens
They are a suit of protocols and procedure that have been designed to try to fight against robocalls and colliding spoofing
which is a huge problem in certain countries and the name shake and it was inspired by James Bond and his predilection for Martini drinks steer and not shake
and so the name shake and since steer was already existing was created as someone said torturing English language to get this acronym
So basically how does steer shake and work?
Basically when an originating provider receive and invite, so a call
First thing I decided is to decide which level of attestation, which level, how we can, one of the three level of attestation that can give to the caller
So there is a full attestation which is the service provider has authenticated the calling party and can be sure that the entity using the phone number is authorized to do this
The more simple example is a landline subscription or an operator running a mobile network or a VoIP network where the devices are directly connected
Basically any way else to physically verify that the user is who claims to be
And we have a partial attestation and so the service provider can identify the caller origination but he cannot confirm that the caller, say the call source is authorized to use the phone number
So the call number would be an example, an calling number behind an extension of an enterprise PBX
And then we have the third level which is the gateway attestation level
And when the service provider can authenticate the call origins but he cannot verify the source, this could be the case for example of an international gateway provider receiving a call from an international gateway
So once decided the level, the attestation level, the originating provider can create a CIP identity either, we will see later how it is formed
Which contains information about the calling number, the call number, the attestation level, the call origination and the certificate that it has been used for signing the identity
And the CIP invite is sent to the receiving the destination provider which in terms using the information of the CIP identity can verify that the identity is itself
So the global shake and steer framework includes several components, several entities and a whole layer of governance which is being public infrastructure
And we need a way to trust each one's certificate, so we have some policy administration which is responsible to delegate to identify which are the certificate authority that are allowed to enable to issue certificate for this infrastructure
And where it is used today, as today is deployed and forced in US, in Canada and since a few months in France where it goes under the name of man, mechanism d'authentification d'anime
But it's basically using the steer shake and it's just the governance layer is slightly different and more centralized
Ok so let's quickly look at how this CIP identity either is built, this is the, you could say here, I was in search of it, in a message and let's have a look
Basically the CIP identity header contains a JSON web token and three parameters, the JSON web token has three sections, header is highlighted in blue and red we have the payload and then the signature is the green part
And then we have three, the identity header has finally three parameters, they say what are these attributes and parameters, so sorry I forgot to say that both header and payloads are based on 64 URL and encoded JSON
So this is how they look, the other part is encoded and decoded and it has five attributes, the algorithm, the encryption algorithm which must be ES256, the extension PPPT, the extension used, in this case shaken, the token type, the passport
And the X5U which is the location of the certificate used to sign the token or whether the public certificate is used to validate the signature
And while the payload part contains information about the attestation level, the information about the destination, the timestamp and the original ID which is a unique way for the provider to identify the actual sender
And finally the signature part which is obtained by base 64 URL link, the encryption, ES256 encryption of the concatenation of the JWT header and JWT payload both in their base 64 URL encoded
And finally the parameters, the three parameters of the identity are the info, so again the location of the certificate must correspond to the X5U attribute of the JWT header, the algorithm used again must be ES256 and the extension used that must be shaken
So all of these said, so how can you implement a steer shaken in your infrastructure, not only from the SIP, not only the SIP part but also the other component that you need for the certificate, the validation service, the signature service, etc.
At least my knowledge there are two open source projects just focused on steer shaken, one is the SignalY libsteer shaken library and the second one is SIPDiax
Did you make this slide?
Sorry?
Did you make this slide or did Daniel write it?
No I did
Why?
I'll ask again, I think it's okay
Okay
So SIPDiax is a project created by Daniel and it's the GitHub repository and it has three components, the SIPD Go library, the main component is the library exporting the common function
CSEC PID which is a C library wrapper to build dynamic or static libraries and the H files and that what it uses, we'll see later in Camelio to build the SIP module
And then we have SSEC CPIDiax which is the CLI tool and the HTTP server for checking or building SIP identities
So why a standalone project first?
So first was the idea of starting developing a extension for Camelio in goal language
Also the idea was to have an HTTP API service that could be used by many SIP server nodes
Also it is an easier way to integrate with older releases that doesn't have native support for Steershaken
And finally it has the command line tool could be useful when you're in the bug phase
There were some examples with a command line you can generate a full identity header passing the parameter of the header
An example there you can check here, you can check here an identity header stored in a file, this is more useful for a command line for debugging
But you can also run SSEC CPIDiax as an HTTP server and it exposes this way or as an HTTP server and use it to validate the identity header of your traffic
Or at the same time or generate them, so as I said you don't need to have the full Steershaken stack in your SIP server, you could use external services
And also it can be used to serve the certificate publicly, to serve the certificate so that when you are sending an invite with an identity header the certificate will be retrieved from this URL
And as I said in Camelio the SSEC CPID module is implemented using the SSEC CPID wrapper and it exposes basically all the functionality that you need to implement Steershaken in your server
There are various, you can check, get, add, build and assign identities and all these functions accept several variables in various forms
And finally a simple example of how it can be used in a Camelio typical routing script, so loading it, a couple of parameters about the expires of the JWT or the time outages, the time out, you want to configure a rule to retrieve the certificates in case you don't have them cached locally
And that's it, I should have any questions, I want to remind Camelio World Conference division that will take place this year in April 18, 19 in Berlin
Is there a HVP to the server behind the scenes?
No, no, there is a, okay, I go back
Okay, so it has three components, the library is in a go, but it has also a C wrapper, so Camelio is using the library for the moment, you have to compile it and use it statically because it's still not packaged in any distribution
But instead, yeah
This isn't looking to go code directly via a wrapper, okay
Yeah, sorry
I'll go back to my 31
So have you dealt with your shake-a-friend with MAN?
Yeah, and, yeah, so he's asking if, sorry if I am...
I have a complete application here, so we found out that they have this different requirement of the original telephone number and destination telephone number where you can go past the E164 link
Yeah
He does sexy things, like have a...
So, okay, so he's asking about, as I said, there are some differences because it's French implementation, so
And honestly, I'm starting to look at the actual implementation, a large total specification of the MAN because, yeah, there are some differences
And, yeah, we will have probably to adapt
Yeah, sorry about your intervention, I was just, as I was saying, if I realized that our implementation of this is in the library
The study was about open source libraries, not about open source information
No, it was exclusively about a library that you can use outside of
The secure zip is done as a library, so is that why it's...
It's nice
Thank you
Is there also a CLI or something that you can use?
Sorry
Is there a CLI, a command line?
Yes, I don't think...
Sorry
Yeah, so the same...
So the CLI is called sexy PIDX
And you can use it, let's say the same binary can be used as a command line to check or generate identity headers
Or as an HTTP server, which can...
Yeah, which has both the two APIs for generating and validating
And the path for the X5U to download the certificate for
Thank you
There's not so much of a question, just look to see how I do it finally
I'm hoping on the presentation and we hope to see you guys from OpenCypher
Because I was trying to call Daniel here, so I was coming
There's some sort of sharing in the way, but nobody is needed
I know you needed
Yes, sorry
When you went back to one of your earlier slides, you were showing that there is a part of this third-stake in model
Is that you go and contact some regulatory authority
But all you see here is that you are just signing a JWT
So how is that verification service integrating into this picture?
For me, I...
The dot of line on the bottom that you're showing here, how is this being taken into...
This is simply the call, one sign
That's an HTTP request to some regulatory authority or what?
Yeah, but the regulatory authority is for the certificate
Okay, so the authority gives you a certificate and after that...
Yeah, so authority decides which certificate the authorities can generate
You are allowed to generate a certificate and actually there is another
A third level of governance which is the political governance
So basically you go through that and you get your certificate
I want you to have a certificate that you can sign all the calls
And it's fully your responsibility to make sure you sign things with the correct attestation
Yes, exactly
Is the certificate any different from a normal S519 certificate?
No
So you can have a self-imgenerated certificate then?
For testing, yes, but then not for running
For any entity that requests?
Yeah, for testing
Yeah
Another small difference just because we were speaking, I believe you were asking
According to MAN operator should report to a kind of centralized database
All the attempt to have a kind of global security mechanism
Any other question?
Does the library have a...
I heard the mention right before this question about the S519 certificate being standard
But I also noted that there is a small extension to the right, the end of this extension
Sorry, I could not
The check and framework, this end of this extension to the S519
Where you put kind of a range of numbers that the certificate is for
So my question was does the library...
Still not
Care at all about the thing?
No, not for them, no
We don't care about it either
It might be required according to the nation
It's not required in France for the MAN map, but it may...
If some other country decide to implement it, they could choose to
So kind of related to the extent, you know, a longer number allowed on the France one
Is there any provisions in the state system at all to allow for the tax prefixes?
Sorry, two
To allow for tax prefixes
And you can put this pre-candidate to the dial number to signify the route that it's going to go through
Is there any capabilities of sign...
No, because it...
We are all...
But this is not the end
Yeah
I'm assuming that's why the number would be a longer than France one
To allow for the tax prefixes
Yeah
Okay
That's it
Okay, thank you
Thank you