Are CLID & ANI Running Out of Time?

Continuing with yesterday's theme of VoIP spam, and the previous posts on telecom security, it's time to analyze ANI, or Automatic Number Identification. ANI, CLID (Calling Line ID, or Caller ID) and CPN (Calling Party Number) all have similar meanings.

With the advent of VoIP, especially IP trunking, I feel that a major re-work of the PSTN is needed to more or less "authenticate" calls to ensure identity. As I mentioned yesterday in my post about VoIP spam, the time has come for technical advances to be made in how our PSTN validates and identifies calls on the network.

We've become accustomed to the use of Caller ID spoofing, especially since the advent of VoIP. But, what many people don't know is that the more permanent "ANI" needs a technical re-work as well. Effectively, on traditional (non-IP) telephone circuits, the ANI with the CPN is passed as a packet of data to SS7 (Signaling System 7) compatible carrier switches. Regardless of whether you "block" your CLID or not, the ANI information gets sent anyways. In fact, 911 centers rely on ANI to generate location information for emergency calls. But, what if ANI could be spoofed as well? And, what if the ANI isn't even correct, especially for VoIP calls?

I came across an interesting article on the implications on VoIP + ANI scenarios by Doug Brickner, titled "Understanding ANI & CPN with VoIP". You can find it here:
http://www.oldskoolphreak.com/tfiles/voip/voipani.txt

What's illustrated in this article is that residential-based VoIP services such as Vonage use a centralized, unprovisioned number for ANI on all outbound calls. So, you wonder: how is this traced? Truth is, it still can be traced as ANI for a "Vonage call", and therefore Vonage's switches maintain records of what IP made the call using which ANI, etc. It gets complicated, and it literally takes a lot of time in an emergency to detect the "who, what, where, and when".

Long story short, ANI is a mess in the VoIP world. Since VoIP calls aren’t necessarily “real” calls in respect to the PSTN, it becomes more and more difficult to verify sender identity. Except for the last leg on the IP carrier’s side, where the media gateway terminates the call onto the PSTN by PRI, does any ANI get passed. I firmly believe that the “ma-bells” see this as a major problem, as ANI isn’t the stronghold of sender identity it once was. We need a new strategy that will properly identify traditional and VoIP-based PSTN calls, and fast.
What do you think? Is ANI effectively running out of time? What features or considerations need to be implemented in future identification-based technologies and standards?