Asserted identity and privacy

Between trusted networks, the caller’s real number often travels in a separate header instead of From: P-Asserted-Identity (RFC 3325) or Remote-Party-ID. FlySIP turns either header into one internal identity of the call. You can then authenticate the call by it, pass it on, convert it to the other header, generate it from the CLI, or put it into From. The same mechanism carries the caller’s request for privacy and hides the number when the account asks for it.

How it works

1. Receive. The switch reads P-Asserted-Identity with its Privacy header, and Remote-Party-ID with party=calling and its RPID-Privacy header. Privacy Schemas on the account lists the accepted headers in order of preference: pai, rpid or both. The default pai,rpid prefers P-Asserted-Identity when the caller sends both. The username of the chosen header becomes the identity. Privacy: id, or privacy=full, uri or name in Remote-Party-ID, means the caller asks to stay anonymous.

2. Authenticate. With Trust Privacy Headers on the account, the switch also matches authentication rules against the identity number, not only against the CLI. Identity Auth Mode in System Management → SIP Features → SIP decides when the CLI still counts:

   Mode	The CLI is used for authentication
   Strict (default)	Only when the caller sent no identity header
   Relaxed	When no rule matches the identity; the identity is tried first
   Mandatory	Never; the call must authenticate by its identity

   The mode applies to accounts with Trust Privacy Headers only. Other accounts authenticate by CLI as usual.

3. Pass on. Pass P-Asserted-Identity on the account lets the received identity, from either header, continue to the vendor. P-Asserted-Id Translation Rule on the account rewrites it first. Without this option the received identity and the caller’s privacy request stop at the account.

4. Generate. When no identity is passed on, a connection with Use CLI As Identity creates one from the CLI.

5. Translate. Identity Tr. Rule on the connection rewrites the outgoing identity, received or generated.

6. Send. Send Identity As on the connection picks the header for the vendor: Off (default), P-Asserted-Identity or Remote-Party-ID. The switch builds a new header with the identity as username, its own address as host and the caller name as display name. It sends the header only when Trusted Privacy Domain is on for the connection, which is the default.

Use Identity As CLI on the connection replaces the number in From with the identity after step 5. Use it when the vendor ignores identity headers but must see the real number.

Privacy

The call is anonymous when the account has Hide CLI, or when the caller asked for privacy and the account passes the identity on. The switch then empties the CLI in From and sends Anonymous as the caller name, whatever Send Identity As is. Depending on Send Identity As it also tells the vendor:

Send Identity As	Trusted Privacy Domain on	Trusted Privacy Domain off
P-Asserted-Identity	P-Asserted-Identity and Privacy: id	Privacy: id only
Remote-Party-ID	Remote-Party-ID with privacy=full	RPID-Privacy: party=calling;privacy=full only
Off	nothing	nothing

So an untrusted vendor learns that the caller is anonymous but never sees the real number.

Caution

Use Identity As CLI runs after the privacy rules. On a connection with this option the identity fills the emptied From again, and the vendor sees the number even on anonymous calls.

Key terms

• Account — a SIP identity (username/password or IP) owned by a customer that originates and receives calls and carries its own balance.
• Connection — a route to a vendor (SIP host, port, protocol, codecs) used by routing to send calls.
• CLI — Calling Line Identification: the caller’s number presented on an outgoing call. In FlySIP it is the username of the From header.
• Authentication Rule — a rule that identifies the account for an incoming call by source IP, CLI, called number or other SIP fields instead of a password.
• Translation Rule — a regular-expression rule that rewrites the called or calling number before rating or routing.

Common scenarios

Pass the caller’s P-Asserted-Identity to the vendor

On the account, keep pai in Privacy Schemas and turn on Pass P-Asserted-Identity. On the vendor connection, set Send Identity As to P-Asserted-Identity and keep Trusted Privacy Domain on. Add P-Asserted-Id Translation Rule or Identity Tr. Rule when the vendor expects another number format.

Receive Remote-Party-ID, send P-Asserted-Identity

Set Privacy Schemas to rpid and turn on Pass P-Asserted-Identity on the account. Set Send Identity As to P-Asserted-Identity on the connection. The switch converts the header; the other direction works the same way.

Always send an identity built from the CLI

Turn off Pass P-Asserted-Identity on the account and turn on Use CLI As Identity on the connection. Every call to this connection then carries an identity equal to the CLI, whatever the caller sent.

A PBX sends a generic number in From and the extension’s number in P-Asserted-Identity

Turn on Trust Privacy Headers and create the authentication rule for the number the PBX puts in P-Asserted-Identity. With Strict the identity decides whenever it is present; switch to Mandatory if calls without an identity must fail. To show the vendor the identity instead of the generic number, turn on Pass P-Asserted-Identity and Use Identity As CLI on the connection.

Screenshot "admin-panel/connection-advanced-parameters" has not been generated yet — see scripts/screenshots/screens.yml.

Note

The switch does not copy identity headers from the incoming INVITE: it builds the outgoing header itself, and P-Preferred-Identity is dropped. Only headers listed in Pass-Through Headers reach the vendor unchanged. See Pass-through headers.

Related pages

• Accounts: Advanced tab, SIP / Services and Privacy sections
• Connections: Advanced Parameters and Number Translation tabs
• System parameters: Identity Auth Mode
• Authentication
• Number translation
• Pass-through headers