Abstract
STIR/SHAKEN was built to answer one question: is the caller who they claim to be? It signs and verifies the originating number so that spoofed caller ID can be detected. That is valuable, but it leaves a larger question unanswered: is this verified caller allowed to reach this person, right now, for this purpose?
A telemarketer calling from its own legitimately assigned number receives full A-level attestation. So does a business that keeps calling a customer long after a single enquiry, a marketplace seller who copies a buyer’s number into a marketing list, and an automated system dialing through a purchased contact list. Each of these calls is authenticated correctly, and each still reaches the recipient. STIR/SHAKEN proves identity; it does not grant, limit, or revoke permission. The PASSporT destination claim records where the call was sent, not that the recipient agreed to receive it. Number masking hides the real number but leaves the alias dialable while active, and call screening and spam analytics act only after the call has already been routed and signaled.
This disclosure describes an authorization-to-reach layer that works alongside STIR/SHAKEN and closes that gap. Knowing a phone number, SIP URI, or messaging handle no longer creates a route. Each call, message, or notification is held as a pending request until an enforcement point, such as a session border controller, SIP proxy or application server, IMS node, or CPaaS gateway, validates a grant issued by or for the recipient. The grant is bound to the caller (whose identity STIR/SHAKEN can verify), the recipient, a purpose or transaction ID, the channel, an expiry time, an attempt quota, a revocation epoch, and the intended enforcement point, with replay protection and sender binding so that a copied grant cannot be reused by someone else. If the grant is missing, expired, used up, revoked, or tied to a different caller or purpose, the call is rejected, for example with SIP 403, before the phone rings. STIR/SHAKEN tells the network who is calling; the grant tells it whether that caller may call.
The approach requires no change to E.164 numbering and can be deployed incrementally in three profiles: blocking at the network edge, checking before routing, or never creating a route for an unauthorized handle at all. Emergency calls (911/112) and lawful intercept are unaffected. Candidate encodings include a new PASSporT claim, a SIP header or pre-INVITE check, or an OAuth Rich Authorization Request profile. The need becomes urgent as AI agents and AI-native 6G networks begin placing calls and sending messages at machine speed, where an authenticated but unauthorized caller can scale instantly.
STIR/SHAKEN remains essential and is not replaced. This disclosure argues that authentication alone cannot solve unwanted contact, and documents the missing permission layer as a public technical reference.
Full document, workflow charts, grant format, and 58-question telecom FAQ: https://zenodo.org/records/23729618
Keywords: STIR/SHAKEN; beyond STIR/SHAKEN; caller ID authentication; calling party authentication; attestation level; PASSporT; PASSporT claim; SIP Identity header; caller authorization; calling party authorization; callee consent; recipient consent; permission to call; consent-based call routing; incoming call screening; call blocking; call filtering; call admission control; session admission control; robocall prevention; unwanted calls; spam calls; scam calls; telemarketing calls; spam over IP telephony (SPIT); SMS spam; SIP; SIP INVITE; pre-INVITE authorization; SIP 403 Forbidden; SIP proxy; SIP application server; session border controller (SBC); IMS; CPaaS; click-to-call; callback request; number masking; proxy number; virtual number; anonymous phone number; privacy-preserving phone number; phone number privacy; contact data leakage; lead list abuse; authorization-to-reach; recipient-issued grant; access token for calling; time-limited token; one-time token; single-use token; usage quota; purpose-bound authorization; transaction-bound authorization; revocable authorization; token revocation; replay protection; sender-bound token; proof of possession; non-bearer token; OAuth Rich Authorization Requests; DPoP; telecom fraud prevention; AI agent calling; automated calling; machine-originated calls; 6G; IMT-2030; AI-native networks; emergency call routing; lawful intercept; defensive publication
CPC: H04M 3/436 (arrangements for screening incoming calls); H04M 3/42059 (calling party identification service); H04M 3/38 (graded-service arrangements, e.g. restricting access); H04L 65/1076 (screening of IP real-time communications, e.g. spam over IP telephony); H04L 65/1104 (SIP); H04L 63/10 (controlling access to network resources); H04L 63/0807 (authentication using tickets or tokens); H04L 9/3213 (authentication using tokens); H04W 12/08 (access security in wireless networks); H04W 4/16 (communication-related supplementary services, e.g. call-transfer)
Patent filing details
International Application No. PCT/IB2026/056771 International Filing Date: 1 July 2026 Publication Number: WO 2026/172333 Publication Date: 20 August 2026 Chapter II Demand Filed: 16 September 2026 WIPO PATENTSCOPE: https://patentscope.wipo.int/search/en/detail.jsf?docId=WO2026172333
Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License
Recommended Citation
Das, Sangam Kumar, "Why STIR/SHAKEN Cannot Stop Unwanted Calls, and an Authorization-to-Reach Layer That Can", Technical Disclosure Commons, ()
https://www.tdcommons.org/dpubs_series/12577