The breakthrough insight: All numbering information already exists in each Communication Provider's own databases.
We don't need to centralize it. We just need to query it.
How It Works
Here's how a CP can obtain all information about a phone number. First, they check their local cache to see if they already have it. All processes contain cache invalidation responses to keep cache values current.
If the cache is missing the data, or has been invalidated, they use Ofcom's S1 to S9 lists to locate the Range Holder for the number block.
The CP sends a request to that Range Holder. The Range Holder may respond directly, or may provide a redirect if the number has been ported - in which case the CP tries there instead. The solution means there is no need for a central database.
How It Works - Authorised Parties
Any authorised party can obtain information about a phone number, using the same mechanism as a CP would. However, there is no need for cache logic, and we can simply follow the existing manual processes. Start with Ofcom's S1 to S9 lists to locate the Range Holder, who may respond directly, or may provide a redirect if the number has been ported.
Law Enforcement Access
👮
Law Enforcement Officer
Needs subscriber information
→
pstn2-query.police.uk
Number Lookup
Phone Number:+44 7700 900123
Query
JavaScript page - works from any web server or local machine
Law enforcement officers, who need subscriber information for an investigation, can access a JavaScript web page from the PSTN2 web site, or use a local copy from their own machine, to query the PSTN2 network directly. No central database to contact, no single point of failure, just direct queries to the Communication Providers.
Data Available
📋Query Result
+44 7700 900123
👤
Customer Data
Name & Address
ID Verification
Account Status
💳
Billing History
Payment Records
Service Plans
Account Changes
📞
Calling History
Call Detail Records
SMS/MMS Logs
Data Usage
The Communication Provider's databases contain all the information law enforcement may need, such as name, address, identity verification and payment documents, as well as Calling History.
Validating Legal Requests
1
Digital Certificates
Law enforcement agencies use cryptographic certificates to sign requests. CPs verify the signature against a trusted authority list.
Strong authenticationTamper-proof
2
SPOC Verification
Requests routed through Single Points of Contact. CPs maintain a directory of authorised SPOC endpoints for each agency.
Centralised controlAudit trail
3
OAuth/Token Based
Time-limited access tokens issued by a trusted identity provider. Tokens encode permissions and can be revoked instantly.
Fine-grained accessRevocable
4
Hybrid Approach
Combine certificate-based identity with token-based authorisation. Provides both strong authentication and flexible access control.
Best of bothRecommended
A critical question: how does a Communication Provider validate that a request is legally authorised? Several options exist. A hybrid approach is recommended, combining Digital certificates to provide cryptographic proof, with OAuth tokens to enable fine-grained time limited access control. Authorities that can issue certificates and provide request authorisation need to be identified.
Dependencies of the Solution
A single source of truth for the PSTN2 API URL is essential. It is expected that the region's Regulator, Ofcom in the UK, would augment numbering information with the URL of the Range Holders. Multiple bodies can provide copies for resilience. If a CP is not participating, and no Range Holder, Wholesaler or Managed Access Provider (MAP) is providing the PSTN2 API on that CP's behalf, then queries to numbers in their ranges are not possible.
Learn More
pstn2.org
PSTN2
✓ No central database required
✓ Direct queries to Communication Providers
✓ Cryptographic verification of requests
✓ Works from any web browser
Visit the PSTN2 website to download working code, read the complete specification, and see this and other animations which describe the enhancements over the PSTN that the PSTN2 delivers. These include; CLI Authentication, Identification, Encryption, Direct Routing, and generic electronic messaging to enhance processes such as Porting and 999, all without a central database or the costs associated with it.