Your Phone Number Is a Security Vulnerability: How 6G Can Make Unauthorized Calls Architecturally Impossible

Abstract From Dialable Numbers to Deterministic Authorization: Re-Architecting Inbound Reachability for 6G Networks This paper introduces Capability-Validated Inbound Dialing (CVID) — a cryptographically enforced, non-bearer inbound communication architecture that fundamentally restructures telecommunications authorization. Instead of treating a dialable number as an inherently routable address, CVID replaces address-based reachability with capability-based execution control. In conventional telephony systems, possession of a dialable identifier (e.g., E.164 number or SIP URI) automatically confers inbound routability. Authorization is evaluated after signaling has already reached the terminating domain. This architecture permits pre-delivery signaling exposure, spam call propagation, robocall abuse, and bearer-token transferability. CVID eliminates persistent routing identifiers entirely. Dialable addresses are replaced with non-routable capability handles that have no independent network meaning and are resolvable exclusively within a Protected Authorization Domain (PAD).