ATIS closes the last mile of the SHAKEN-over-TDM problem

ATIS has published ATIS-1000107, SHAKEN: STI-CPS Discovery for Out-of-Band PASSporT Transmission Involving TDM Networks — the piece that makes out-of-band SHAKEN actually operable when a call crosses legacy switching. The framing in the announcement is the familiar one: TDM can’t carry the SIP Identity header, so “authentication information can be lost before reaching the terminating service provider.” The fix is to move the signed PASSporT out of the call path entirely and let the terminating provider retrieve it separately.

The out-of-band mechanism itself isn’t new — the Call Placement Service model has been sitting in ATIS standards since 2021. What has been missing is discovery: given an inbound call off a TDM trunk with no Identity header, how does the verifying provider know which CPS is holding the PASSporT for it? Without an answer, out-of-band SHAKEN works in a lab and in bilateral arrangements and nowhere else. This specification is the addressing layer, and it arrives from the Non-IP Call Authentication Task Force under PTSC, which is the group carrying the FCC’s non-IP authentication expectations.

Worth keeping the standard’s status in proportion. A published specification is not deployment, and the non-IP gap has been the durable excuse in this space for years — the reason a call can be signed at origination and arrive at the terminating carrier stripped of any attestation, with the resulting hole showing up in every “percentage of calls signed” figure the industry publishes. The interesting question is whether anyone builds to it, and how the coverage numbers move if they do. The document is behind the ATIS member wall, free to members, which is its own small statement about who this is written for.