AWS connect high security documentation change
Summary
Comprehensive restructuring and expansion of STIR/SHAKEN documentation including detailed attestation level requirements, implementation specifics, and carrier network considerations
Security assessment
The changes explicitly document Amazon Connect's implementation of STIR/SHAKEN framework designed to combat caller ID spoofing - a critical telecom security issue. The detailed attestation levels (A/B/C) and their requirements directly address call authentication verification processes that prevent fraudulent calls. Specific security implications include preventing unauthorized number usage and call deflection attacks.
Diff
diff --git a/connect/latest/adminguide/stirshaken.md b/connect/latest/adminguide/stirshaken.md index 8de2a0605..87cf71025 100644 --- a//connect/latest/adminguide/stirshaken.md +++ b//connect/latest/adminguide/stirshaken.md @@ -5 +5 @@ -# Concepts: Stir/Shaken +What is STIR/SHAKEN?Amazon Connect attestation levelsRequirements for A-level attestationRequirements for B-level attestationExamples of C-level attestationImportant things to know @@ -7 +7 @@ -STIR/SHAKEN framework is designed to combat caller ID spoofing by verifying a caller's right to use a telephone number. It consists of two components: +# Stir/Shaken attestation in Amazon Connect @@ -9 +9,26 @@ STIR/SHAKEN framework is designed to combat caller ID spoofing by verifying a ca - * STIR (Secure Telephone Identity Revisited): A standard for using digital certificates to authenticate the calling party's identity and right to use a phone number. +Amazon Connect supports STIR/SHAKEN attestation for outbound calls to help prevent caller ID spoofing. + +When originating calls from United States direct-inward-dial (DID) or toll-free numbers to North American Numbering Plan (NANP) destinations (+1 prefix), Amazon Connect signs calls with STIR/SHAKEN headers indicating the level of attestation. + +###### Contents + + * What is STIR/SHAKEN? + + * Amazon Connect attestation levels + + * Requirements for A-level attestation + + * Requirements for B-level attestation + + * Examples of C-level attestation + + * Important things to know + + + + +## What is STIR/SHAKEN? + +The STIR/SHAKEN framework is designed to combat fraudulent caller ID spoofing in telephony networks. It consists of two components: + + * STIR (Secure Telephone Identity Revisited): The underlying protocol suite that enables cryptographic signing and verification of calling numbers. @@ -16 +41,56 @@ STIR/SHAKEN framework is designed to combat caller ID spoofing by verifying a ca -Within this framework, attestation plays a crucial role in indicating the level of confidence a service provider has in the caller's identity. +For more information about STIR/SHAKEN, see [Combating Spoofed Robocalls with Caller ID Authentication](https://www.fcc.gov/call-authentication) on the Federal Communications Commission (FCC) website. + +## Amazon Connect attestation levels + +Amazon Connect assigns one of three attestation levels when signing outbound calls: + + * A-level (Full) - Amazon Connect has: + + * Authenticated the calling party + + * Confirmed their authorization to use the calling number + + * B-level (Partial) - Amazon Connect has: + + * Authenticated the calling party + + * Cannot verify their authorization to use the number + + * C-level (Gateway) - Amazon Connect has: + + * Originated the call + + * Cannot verify the calling party's identity + + * Cannot verify legitimate use of the number + + + + +## Requirements for A-level attestation + +Your calls receive A-level attestation if you are subject to AWS Service Terms or are a customer of an authorized AWS Solution Provider/Distribution Seller AND any of these conditions are met: + + * Number claimed through Amazon Connect portal/API. + + * Number ported into Amazon Connect. + + * Third-party number mapped to your account with validated documentation. + + + + +## Requirements for B-level attestation + +Your calls receive B-level attestation if: + + * You have been notified that additional information is needed to maintain A-level attestation. + + * We have NOT notified you that we have successfully validated the information you provided. + + + + +## Examples of calls that receive C-level attestation + +All calls that don't receive A- or B-level attestation receive C-level attestation. @@ -18 +98 @@ Within this framework, attestation plays a crucial role in indicating the level -When a call is made, the originating provider assesses and assigns an attestation level—Full (A), Partial (B) and Gateway (C)—based on their relationship with the caller. This attestation information is included in the SIP header. It helps the receiving network evaluate the trustworthiness of the caller ID. +Following are examples of calls that receive C-level attestation: @@ -20 +100 @@ When a call is made, the originating provider assesses and assigns an attestatio - * A Full attestation means the identity of the caller is known and they have the right to use a particular phone number as caller ID for an outbound telephone call. + * Calls made by customers using unauthorized solution providers. @@ -22 +102 @@ When a call is made, the originating provider assesses and assigns an attestatio - * A Partial attestation means the identity of the caller is known but the service provider does not know if the caller has the right to use a number. + * Calls made in violation of AWS Services Terms (for example, call deflection). @@ -23,0 +104 @@ When a call is made, the originating provider assesses and assigns an attestatio + * Cases where we have notified you that additional information is required and we have not received the requested attestation documentation by the specified date. @@ -27 +107,0 @@ When a call is made, the originating provider assesses and assigns an attestatio -Amazon Connect is a multi-carrier service that provides phone numbers from various service providers to deliver outbound calls. With Amazon Connect's call resiliency, the service ensures a high level of confidence that calls reach customers. @@ -29 +109 @@ Amazon Connect is a multi-carrier service that provides phone numbers from vario - * When Amazon Connect routes calls made through the carrier that has provided the phone number used to make the call, the calls receive a Full (A) attestation. +## Important things to know @@ -31 +111 @@ Amazon Connect is a multi-carrier service that provides phone numbers from vario - * In other routing scenarios, calls will receive a Partial (B) attestation level. + * While Amazon Connect provides STIR/SHAKEN headers to carriers, attestation may not be preserved end-to-end due to legacy equipment in some carrier networks that cannot transmit these headers. @@ -32,0 +113 @@ Amazon Connect is a multi-carrier service that provides phone numbers from vario + * Carriers may use attestation levels as part of their process of determining whether they deliver calls in their network. @@ -33,0 +115 @@ Amazon Connect is a multi-carrier service that provides phone numbers from vario + * To maintain the highest levels of attestation for your calls, Amazon Connect may ask you for additional information. In the notification email we send to you, we will state when you need to reply with the requested information. Any delays in providing us the information may impact the attestation level of your calls and as a result, may impact the success of your call delivery. @@ -36 +117,0 @@ Amazon Connect is a multi-carrier service that provides phone numbers from vario -Amazon Connect provides attestation for eligible calls leaving its system in countries that have implemented STIR/SHAKEN. However, after a call enters the telephone network, the attestation may not be preserved. Maintaining this attestation is beyond the control of Amazon Connect due to the nature of legacy networks. @@ -38 +118,0 @@ Amazon Connect provides attestation for eligible calls leaving its system in cou -Amazon Connect supports the various implementations of the anti-spoofing configuration in United States, Canada, and France.