One time key Issuing for Verification and Detecting Caller ID Spoofing Attacks

Abstract

Caller ID has been used to tell the recipient who is calling before answering the call. In fact, nowadays using just Caller ID is not enough to proof the real caller since there are several ways to manipulate the caller identity. There are number of solutions to proof the caller e.g. using Time base, SMS base, or hardware. Even using DSA and CA, it can lead to data leak or inconsistent verification processing. The One-time password practices can mitigate the risk of Man-in-the-middle attacks because SSL has vulnerability assessment that can lead to MITM or man in the middle attack. The attacker can intercept SSL verification process between Server and client for sniffing then spoofing. It would be better if we can find a solution that does not rely on CA, Third party and/or external hardware. In this paper, we propose the solution with self-controlled security and one-time key issue to avoid data leak. The one-time key issuance is a good solution for verification and detecting caller ID Spoofing attacker through this methodology since it does not rely on third-party CA and store certification anywhere. This solution provides the best of key management as the one-time secret key is used. Results from our test lab show effectively verification rates and good performance where resource and power consumption are not impacted.