SMS to 911 White Paper Final October 2010

8/6/2019 SMS to 911 White Paper Final October 2010

1/76

4GAmericasOctober2010 1


2/76


4GAMERICAS TEXTING TO 911 WHITEPAPER TABLEOF CONTENTS

EXECUTIVESUMMARY...................................................................................................................................................5

1. INTRODUCTION.....................................................................................................................................................8

2. SMSOVERVIEW...................................................................................................................................................10

2.1 SMSHISTORY.................................................................................................................................................10

2.2 SMSTECHNOLOGYOVERVIEW......................................................................................................................12

2.2.1 CONCATENTATIONOFSMSMESSAGES...............................................................................................15

2.2.2 INTERCONNECTIONWITHOTHERNETWORKS....................................................................................16

2.2.3 SMSMISCONCEPTIONS ........................................................................................................................18

2.3

HOW

SMS

WORKS

.........................................................................................................................................

19

2.3.1 MOBILEORIGINATEDSMS...................................................................................................................27

2.3.2 MOBILETERMINATEDSMS..................................................................................................................29

2.3.3 SMSVIAEMAILORWEBCLIENTS........................................................................................................30

2.3.4 SMSAGGREGATORS............................................................................................................................31

2.4 MULTIMEDIAMESSAGING............................................................................................................................32

2.5 MOBILEINSTANTMESSAGING......................................................................................................................34

2.6 SMSOVERGENERICIPCONNECTIVITYACCESSNETWORK(IPCAN).............................................................36

2.7 SOCIALNETWORKING...................................................................................................................................37

2.8 EXAMPLEIMPLICATIONSOFTEXTINGSERVICESANDAPPLICATIONS..........................................................39

2.8.1 SMARTPHONEALERTINGAPPLICATION..............................................................................................39

2.8.2 FREESMSANDSMSBYPASSAPPLICATIONSANDSERVICES.........................................................40

3. SECURITYASPECTSANDVULNERABILITIES..........................................................................................................41

3.1 SMSSPOOFING..............................................................................................................................................41

3.2 SMSFLOODING.............................................................................................................................................43

3.3 SMSSPAM.....................................................................................................................................................44

3.4 DENIALOFSERVICEATTACKS........................................................................................................................45

3.5 FRAUDULENTPSAP........................................................................................................................................46


3/76


3.6 PRIVACY.........................................................................................................................................................46

3.7 SMSPHISHING...............................................................................................................................................46

4. IDENTIFEDSMSANDNETWORKSHORTFALLS.....................................................................................................47

4.1 SMSTOVOICEEMERGENCYCALLCOMPARISON..........................................................................................48

4.2 IDENTIFIEDSHORTFALLSFORSMS................................................................................................................48

4.2.1 CALLBACKINFORMATION....................................................................................................................49

4.2.2 ROUTINGSMSMESSAGETOAPPROPRIATEPSAP...............................................................................49

4.2.3 BESTEFFORTSERVICE..........................................................................................................................50

4.2.4 SUBSCRIBERMOBILEDURINGMESSAGINGWITHPSAP......................................................................51

4.2.5 NOLOCATIONCAPABILITIESFORSMS.................................................................................................51

4.2.6 NODELIVERYACKNOWLEDGEMENTS .................................................................................................51

4.2.7 RECOGNITIONOF911ASVALIDSMSDESTINATION........................................................................52

4.2.8 INTERNATIONALEMERGENCYNUMBERS............................................................................................52

4.2.9 UNAUTHORIZEDORFRAUDULENTMOBILEDEVICES..........................................................................53

4.3 CONSIDERATIONSFORPSAPSYSTEMS..........................................................................................................53

4.3.1 CONNECTIVITYOFSUBSCRIBERTOSPECIFICCALLTAKER/DISPATCHER ATPSAP................................53

4.3.2 ASSEMBLYOFMESSAGESINTOLOGICALSEQUENCE..........................................................................53

4.3.3 MESSAGEFORWARDINGTOPROPERPSAP.........................................................................................54

4.3.4 SMSSPAMMINGTOPSAP....................................................................................................................54

4.4 CANADAREPORTTOCRTCBYEMERGENCYSERVICESWORKINGGROUP(ESWG)..................................54

4.5 CONSIDERATIONSFORMIGRATIONTONEXTGENERATION........................................................................56

5. USERCONSIDERATIONS FOREMERGENCYSERVICES..........................................................................................56

5.1

CONSIDERATIONS

FOR

WIRELESS

SUBSCRIBER

.............................................................................................

56

5.1.1 AVAILABILITY .....................................................................................................................................57

5.1.2 ACCESSIBILITY ....................................................................................................................................58

5.1.3 RELIABILITY ........................................................................................................................................59

5.1.4 USERLOCATION ................................................................................................................................59


4/76


5.2 CONSIDERATIONSFORPSAPCALLTAKER.....................................................................................................60

5.2.1 EVALUATION OF CALLER..................................................................................................................60

5.2.2 ANCILLARYINFORMATION ..............................................................................................................61

5.2.3 OVERLOAD POTENTIAL.....................................................................................................................61

5.2.4 LANGUAGESAN DTERMINOLOGY ...................................................................................................61

5.2.5 POTENTIALIMPACTOF VIRTUALREALITY.....................................................................................62

5.3 SIMPLESMSTO911SCENARIO...............................................................................................................62

6. PEOPLEWITHDISABILITIES..................................................................................................................................69

7. CONCLUSIONS......................................................................................................................................................71

8. ACKNOWLEDGEMENTS ........................................................................................................................................73

APPENDIXA. ACRONYMSANDDEFINITIONS........................................................................................................74

A.1 ACRONYMS....................................................................................................................................................74

A.2 DEFINITIONS..................................................................................................................................................76


5/76


EXECUTIVE SUMMARY

A citizens ability to send text messages to 911 emergency services (e.g., PSAP) is a topic that is undergoing

significant discussions in the emergency services community, the people with disabilities community, and the

wirelessindustry.Thetermtextisusedinthegeneralsenseduringthesediscussionstextsignifieseverything

from the short message service (SMS), to instant messaging (IM), to social networks such as Twitter and

Facebook.Understandably,thepeoplewithdisabilitiescommunityinparticularhasexpressedinterestintextto

911usingtheexistingcapabilitiesoftheirmobiledevices,asanalternativetousingbulky,cumbersomeaddon

TTYdevices.Thewireless industryfullyunderstandsthedesiresofthepeoplewithdisabilitiescommunityand is

focusedon findingareliablesolution fortheirneeds.Thisanalysis focusesonSMSasameans tocontact911

emergencyservices,withagoaltoprovideaviewofthecapabilities,limitations,threatsandvulnerabilitiesofthis

meansofcommunications.

Texting,particularlySMS,hasexplodedinthepastdecade. Citizensrelyontextingfortheirsocialcommunications

needs.TherearemillionsofSMSmessagessenteachdayandthereisaperceptionthatSMSisreliable;however,

SMS was never designed as a reliable means for lifesaving critical communications. SMS was designed to be

secondary

to

voice

calls

and

was

never

designed

to

provide

the

full

and

robust

communications

citizens

have

come

toexpectwithvoicecalls. SMShassignificant limitationsandshortcomings that donotmakeSMSsuitable for

emergencycommunications,especiallyunderlifethreateningconditions.

It is importanttounderstandthatSMS isnotandneverwillbearealtimecommunicationsservice. SMSby its

verydesignisanonrealtime,besteffort,storeandforwardservice. SMSisnotasessionbasedprotocol;without

session based communications, SMS makes correlation of multiple messages from a citizen to a particular

emergencyimpossible.Withthesecharacteristics,SMSmessagesmayhaveadelayeddelivery,maybedeliveredin

adifferentorderthanthesenderintended,ormaybelostordiscarded.

A critical component to providing emergency services in a timely manner to citizens in distress is for the

emergencyinformationtoberoutedtotheappropriatePSAP,andforthatPSAPtobeabletoobtainthecurrent

locationofthecitizenwhoisrequestingtheemergencyservices. RoutingtotheappropriatePSAPisfacilitatedby

therough locationofthesubscriberwhenthey initiateavoicecall.Theabilitytoobtainmoreaccurate location

information is available when there is a voice call; however, there is no location information available for the

routing function or for the PSAP to obtain location information when a citizen initiates an SMSmessage and it

traversesthenetwork. Whilethereareapplicationsthatmakeuseof locationcapabilitiesofthemobiledevice,

locating the nearest pizza restaurant is significantly different from the location accuracy required to direct an

emergencyresponse.

Since SMS was never intended for robust missioncritical communications, SMS was not designedwith security

mechanisms. SMS has a number of security vulnerabilities including SMS spoofing, Denial of Service

vulnerabilities,SPAM,Malware,etc. Thesesecurityvulnerabilitiesareprimarilyduetothelackofauthentication

ofSMSmessagesandtheabilitytoinjectSMSmessagesintothenetworkfromexternalsources.

RelatedtoSMSspoofingareemergingsmartphoneapplicationsandthirdpartynetworkservicescommonlycalled

Free SMS or SMS Bypass. These applications provide SMS capability without using the wireless operator

messagingcapabilities. ThesesmartphoneapplicationsevenhavescreensthatlookverysimilartotherealSMS

services. ThewirelessoperatornetworkhasnoknowledgeorcontroloftheseotherSMSapplications. Someof

thesespecialSMSservicesdontevenrequireamobiledevice. TheseservicescanbedoneviaaPCandcantotally

bypasswirelessnetworks. However,totherecipient,theseSMSmessagescouldlookliketheyarecomingfroma


6/76


mobiledevice. AsaresultaPSAPcouldbesubjecttomassiveamountsofSPAMorDenialofServiceattacksfrom

whatappeartobelegitimateSMSmessagescomingfrommobiledevicesonwirelessnetworks.

Withoutclearrequirementsandastandardizeddesignfornonvoiceemergencycommunications,theresultwillbe

a patchwork implementation that will be a source of confusion to the wireless users since they will have no

indication of when they arewithin a PSAPboundary andserved by a wirelessoperatorwhichsupportsSMS to

911andwhentheyareoutsideoftheareathatsupportsSMSto911. Theremayalsobeinconsistentvendor

specificimplementationsacrossPSAPsandwirelessoperators.Thisconfusioncouldresultinevenfurtherdelaysin

obtainingtheemergencyservicesthattheuserrequires.

Currentvoiceemergencyservicessupportemergencycallsto911formobiledevicesthatdonothaveaninstalled

smartcard(SIMorUICC)orwhichmaynotbeauthorizedforregularvoiceservicesintheservingnetwork(for

example,aprepaiddevicethathasdepletedthefundsforservice). Mobiledevicesthatdontcontainasmartcard

orarenotauthorizedforuseontheservingnetworkcannotinitiateSMSmessagesduetothefundamentaldesign

ofthenetworkprotocols.

Thewirelessindustryrecognizesthattherearenumerousregulatorydiscussionsinprogress,andisveryengaged

intheseregulatorydiscussions. However,theviabilityofscalableSMSto911servicecannotbesolvedsimplyby

thestrokeofaregulatorspen.Aswillbedetailedthroughoutthiswhitepaper,multipletechnicalissuesinherent

inSMSdesignandimplementationshowthatSMSto911isnotarationaltechnicalpossibility.

ImplementationofSMSto911emergencyservicescouldhavesignificantimpactsontheresourcesandpersonnel

ofthePSAPs. SMScanbeoriginatedthroughanumberofsources includingwirelessdevices,the Internet,and

thirdpartyapplicationsonsmartphones.Theonlywaytocontroltheauthenticityofthesetextmessagesisatthe

destination,whichwillrequiresignificantSPAMfilteringandotherprotectionsatthePSAPs.

TheNationalEmergencyNumberAssociation(NENA)iscurrentlydefiningthenextgenerationemergencyservices

requirementsandenvironment.RecentincreasedcooperationbetweenNENAandthewirelessindustry,including

theAllianceofTelecommunicationsIndustrySolutions(ATIS)andthe3rdGenerationPartnershipProject(3GPP),is

leadingtoauniformapproachacrossaccesstechnologies(wireline/wireless).Thiswillnodoubtbenefitboththe

consumeraswellasthePSAPs.Theseareongoing,multiyeareffortsthatwillimposesignificantcostsandpromise

majorbenefits. Effortstoaddressthe legacySMSstandardswilldetractfromresourcesthatcouldotherwisebe

used to advance next generation systems; hence delaying a better solution in order to deploy a limited and

constrainedone.

Inconclusion,therearesignificantlimitationsinherentinthedesignofthecurrentShortMessageServiceswhich

makeitimpracticaltobeusedforemergencyservice.However,theindustryisfullyawarethatitisimportantto

address the requirements for people with disabilities as soon as possible. To that end, it is recommended that

techniques which are readily available today, such as silent 911 calls, along with accelerating research and

developmentintoemergingtechnologiessuchasTTYEmulation,beundertakenwhilethenextgenerationsystems

arebeingdesigned.Thefollowingconsiderationsmustbetakenintoaccount:

SMSto911isabesteffortservicewithnodeliveryorperformanceguarantees,thereforeFULLliabilityprotectionmustbeprovidedforwirelessoperatorsandotherstakeholders.LiabilityprotectionsforSMS

to911havetobefargreaterthanthoseforvoicebecausetheprobabilityofsomethinggoingwrongis

somuchgreaterandtherearemoreareaswherethingscangowrong.


7/76


Thereneedstobeaneducationprocessforbothcalltakersandconsumersontheexperienceexpectedastheexperienceforboththecalltakerandenduserfortextingto911willbesignificantlydifferentthan

voiceorTTYto911.

Routingofa"911"SMSmaybeprovidedtoaNENAdefinedcentralserverforhandlingandroutingtoaPSAP.Thewirelessnetworkoperatorisnotresponsibleforrouting.

No location information isprovidedby theoriginatingnetworkormobiledevice.Location issubject towhatever is put in the message by the originator and subject to mobile device and other functional

elementcapabilities/limitations.

NopriorityorspecialhandlingisgiventoSMSmessages. SMSto911messagesshouldlessthan160charactersinlengthtoeliminatetheneedforsegmentation

andreassemblyof longSMSmessages.LongSMSmessagesarebrokenintoasequenceof independent

messages.Each segmentcanbe delayed resulting in outof order delivery of themessages resulting in

confusion,anddevicesareinconsistentinthewaytheyreassemblelongmessages.

Noacknowledgmentsofsent,deliveredorreadSMSmessagesareprovided(bytheoriginatingnetwork). Nosecurity,authentication,ornonrepudiationofanySMSmessageisprovided. Theoriginatingnetworkwillnotpreventanyspam,SMSspoofing,ordenialofservice (DoS)attackson

messagesdeliveredtothe"911"centraladdress.

Anoriginatingnetworkreservesallrightstoprotectitsnetworkfromnetworkspikes,DoSattemptsandothercongestionissues.Thismustbepartofthoseliabilityprotections.

SMS isnotasessionbasedprotocol.Therefore it isaPSAP (E911Authorityasapplicable) function tomanage routing ofallmessages toor from theappropriatePSAPcall taker for eachSMSmessage. If

thereisaseriesofSMSmessagesintheexchangebetweenthecallerandPSAPcalltaker,thenthePSAPis

responsible for association of those messages, ensuring routing to the same call taker if that is their

desire,andappropriateroutingtoanotherPSAPifapplicable.Originatingnetworksdonotmaintainthis

association.

o NOTE: If thecaller ismovingandcrossesPSAPboundaries,messagesmaybesent todifferentPSAPs based on caller location, cell site boundaries, etc. Management of messages in this

environment isnottheresponsibilityoftheoriginatingnetwork. It isnotclearhowthismight

workatPSAPboundaries.


8/76


1. INTRODUCTION

Thepurposeofthis4GAmericaswhitepaperistoexaminetheuseofShortMessageService(SMS)messagingto

911emergencyservicesviaPublicSafetyAnsweringPoints(PSAPs). Thiswhitepaperwillprovidethereaderwith

thefollowinginformation:

AbriefhistoryofSMS AnoverviewofhowSMSworks SecurityaspectsandvulnerabilitiesofSMS IdentifiedlimitationsandshortfallsforSMSbasedemergencyservices RegulatoryconsiderationsrelatedtoSMSbasedemergencyservices WirelesssubscriberconsiderationsforSMSbasedemergencyservices PSAPcalltakerconsiderationsforSMSbasedemergencyservices Considerationsforthepeoplewithdisabilities Conclusions

TheabilityforacitizentobeabletosendSMStextmessagesto911emergencyservices(e.g.,PSAP) isatopic

thatisreceivingsignificant interestandundergoingsignificantdiscussions intheemergencyservicescommunity,

the people with disabilities community,and the wireless industry.The termtext is used in the general sense

duringthesediscussionstextsignifieseverythingfromtheshortmessageservice(SMS),toinstantmessaging

(IM),tosocialnetworkssuchasTwitterandFacebook.Understandably,thepeoplewithdisabilitiescommunity

inparticularhasexpressedinterestintheSMStextto911functionalityonusingtheirexistingcapabilitiesoftheir

mobiledevices,asanalternativetousingspecializedbulky,cumbersomeaddonTTYdevices.Thewirelessindustry

fully understands the desires of the people with disabilities community and is focused on finding a good and

reliablealternativesolutionfortheirneeds.ThisanalysisfocusesonSMSasameanstocontact911emergency

services,withagoaltoprovideaviewofthecapabilities,limitations,threatsandvulnerabilitiesofsuchmeansof

communications.

Texting,particularlySMS,hasexplodedinthepastdecade. Citizensrelyontextingfortheirsocialcommunications

needs.TherearemillionsofSMSmessagessenteachdayandthereisaperceptionthatSMSisreliable;however,

SMSwasneverdesignedtobeusedasareliablemeansforlifesavingcriticalcommunications. SMSwasdesigned

tobesecondarytovoicecallsandwasneverdesignedtoprovidethelevelofcommunicationsthatcitizenshave

cometoexpectwithvoicecalls. SMShasseveralsignificantlimitationsandshortcomingswhichdonotmakeSMS

suitableforemergencycommunications especiallyunderlifethreateningconditions.

SMSisatextbasedmessagingserviceandthereisacomplementaryservicecalledMultimediaMessagingService

(MMS).MMSisamultimediaservicewhichsupportsavarietyofmultimediaformatsincludingtext,pictures,and

videoclips. The issuesand limitations forMMSbasedemergencycommunicationsaresimilartothe issuesand

limitationsforSMSbasedemergencycommunications.


9/76


10/76


2. SMS OVERVIEW

ThissectionprovidesanoverviewofSMSincludingdiscussionsonthefollowing:

ThehistoryofSMS AnintroductiontohowSMSworksincludingconcatenationofSMSmessages,SMSinterconnectionwith

othernetworks,andcommonmisconceptionsaboutSMS

AdescriptionofhowSMSworksforSMSmessagesoriginatingfromthemobiledevices,forSMSmessagesbeingdeliveredtoSMSdevices,andforSMSsentviaemail

AdescriptionofSMSviaemailorwebclients AdescriptionofSMSaggregators AdescriptionofMultimediaMessagingService(MMS) AdescriptionofMobileInstantMessaging(MIM) AdescriptionofSMSviaagenericIPconnectivityaccessmethod AdiscussionofsocialnetworkingasrelatedtoSMS Adiscussionofexampletextingservicesandapplicationsandtheirassociatedimplications

2.1 SMS HISTORY

SMSwasoriginallydesignedinthe1980s,beforemoreadvancedwirelessdataservicesexisted. Theoriginalintent

ofSMS was tousesparesignalingcapacity toprovide some basic data transferand information services. SMS

transportedmessagesonthesignalingpathsneededtocontrolthetelephonytrafficduringtimeperiodswhenno

signaling traffic existed (i.e., during the periods of lowest wireless activities), making productive use of idle

channels. Subsequently,SMSwasexpandedtosendshortblocksofinformationsuchasweather,sports,financial,

etc.,thatwereneithertimesensitivenormissioncritical.

Voicecallswereconsideredtobetheprimaryserviceformobiledevices,andeventodaywiththegrowthofdata

services,voiceisstilltheprimaryservice.SMSwasdesignedasasecondaryservicetousesignalingchannelsand

otherresourceswhentheywerenotbeingused forvoicecalls. SinceSMS isasecondaryservice,therewasno

intenttosupportemergencyservicecapabilities (aswasdone forvoicecalls),orhighreliability, lowdelay,real

time2waymessaging,with location,orsecuritycapabilities. As a result, the deliveryofSMSmessagescanbe

delayedwhensystemresourcesareneededtohandlevoicecalls. Asaconsequence,SMSwasdesignedasastore

andforwardserviceifthemobiledeviceorsystemresourcesarenotavailable,theSMSmessageisstoreduntil

they became available. Unlike voice calls (which setup an endtoend path from originator to receiver), SMS

messagesarestoredandhandedoffbetweenthenetworkentitiesastheytraversefromsourcetodestination. If

thedeliveryofanSMSmessagetoamobiledevicefails(e.g.,ifthemobiledeviceisoutofcoverageorpoweredoff

orforwhateverreasonunabletoreceivetheSMS),thatSMSmessageisstoredinthenetworkforaperiodoftime

andthedeliveryoftheSMSmessageisretriedatafuturetime. AnundeliverableSMSmessagewilleventuallybe

deletedbythenetworkbaseduponthenumberofretriesorbasedupontheageoftheSMSmessage.Alsosince

SMS is a secondary service, there was no intent to support any level of service such as the emergency service


11/76


capabilities of voice calls. Therefore, the SMS service is not designed with high reliability, low delay, realtime

2way messaging, location, or security. Because the SMS service was designed and deployed to use only

temporarilyvacantcapacityinthenetworks,wirelessoperatorshavealwaysdescribedservice/reliabilitylevelsas

best efforts onlyor equivalent. Subscribers know thatSMS messagesmay bedelayed, sometimes for lengthy

periods;HappyNew YearSMS messages canbedelayed formanyhoursoreven days;Presidentialcandidate

Obama

used

SMS

to

announce

Joe

Biden

as

his

VP

candidate

this

message

was

delayed

12

hours

or

more

after

it

wassentat3:00AM.

BythetimethatSMSwasdeployed intheearly1990s3,voicecallminuteswere increasingrapidlyeveryyearas

peopleacquiredmoremobiledevices. EvenwhenSMS initiationfrommobiledeviceswasaddedasaserviceto

subscribers, itwasconsidered tobean interesting featurethatwouldhave limitedusagesimplybecause itwas

viewedtobemucheasiertomakeaphonecallthanitistotypealimitedcharactermessageonamobiledevice

keypadwithonly12keys.

AstheSMSserviceprogressed,someviewedSMSasanalternativetothebeeperorpagersthatwerethen in

widespreaduse.Thecapabilitytoreceiveashorttextmessageonamobiledevicebecamemoreattractive.But

again,thiswasaonewaynonmissioncriticalserviceanddidnothavethereliabilityofpagingservices(whichuses

asignificantlydifferenttechnologydesignedforapagingpurpose).

However, what wasnotpredictedwas themassiveshift insocial behavior thathas occurredover the past few

years. Wellaheadofmobiledevicesforteenagers,InstantMessagingonPCsshiftedtheyoungergenerationaway

fromvoicecallstotextbasedcommunicationswithitsownspecializedvocabulary. Asmobiledevicesandwireless

plans became cheaper, teenagers started getting mobile devices and started accelerating the usage of text

messaging. Forexample,priortothismajorevolutioninsocialbehavior,theaveragewirelesssubscriberhadan

averageof0.4SMSmessagespermonthwiththevastmajorityofsubscribersnotevenusingtheSMSservices.

Today,SMSusagehasexploded.IntheU.S.in2009,thenumberofannualizedSMSmessages4was1.56trillion,or

152.7billionmonthlySMSmessages.EachoneofthesebillionsofSMSmessagesiscontendingforthatunused

space,

which

can

be

viewed

as

a

funnel:

3ThefirstSMSmessagewassentovertheVodafoneGSMnetworkintheUnitedKingdomon3December1992.

4Source:CTIA


12/76


Figure1:SMSTrafficFunnelDiagram

2.2 SMS TECHNOLOGY OVERVIEW

Short

Message

Service,

also

known

as

SMS,

is

a

service

originally

created

in

the

GSM

family

mobile

communicationssystem,usingstandardizedcommunicationsprotocolsthatenablethe interchangeofshorttext

messages between mobiledevices. With SMS becoming so widely used incellularnetworks, the term SMS is

oftenusedasasynonymforanytextmessageortheactofsendingatextmessage,thoughinrealitytherecould

beanumberofdifferentmethodsorprotocolsbeingused.Inthispaperweintroducethe3GPPSMStechnology,

and use the term SMS to refer to 3GPP SMS, not any other text messaging applications such as Instant

Messaging.

SMS allows the sending of text messages up to 160 characters in length (including spaces), to and from other

mobile devices. SMS is supported in other technologies including cdma2000 networks, as well as satellite and

landlinenetworks.SupportovermultipletechnologiesallowsSMSmessagestobesenttomobiledevicesacross

networks.MostSMSmessagesaremobiletomobiletextmessages.

TheinnovationinSMSistousethetelephonyoptimizedsystemtotransportSMSmessagesonthesignalingpaths

needed tocontrol the telephony trafficduring timeperiodswhennosignaling trafficexists. In thiswayunused

resources in the systemcan beused to transport SMS messages without additionalcost. It is because the SMS

messageshadtofit intotheexistingsignalingformats iswhytheSMSmessage lengthwas limitedto128bytes,


13/76


which is roughly140alphanumericcharacters (using astandard7bitcoding foreachalphanumeric character)5.

However, later improvement increased thecapacityto140bytesor1607bitcharacters. It is the fundamental

designofSMStofittheSMSmessageintotheexistingsignalingslots,asnamedSHORTMessageService.

SMS is implemented inmobiledevicesand in thenetwork, including radio andcorecomponents.SMS requires

engineeringof the radiocapacityand network transport infrastructure to transport the SMSmessages, aseach

controlchannelcanonlyhandlethetransmissionanddeliveryofafixednumberofSMSmessagespersecond.SMS

requires a network element called a Short Message Service Center (SMSC), or Message Center or Message

ServiceCenterforshort.TheSMSCisthestoreandforwardentityintheSMSnetwork.

AsthenumberofSMSmessagetrafficincreases,thisextraloadonthenetworkrequiresengineeringthesignaling

capacityandpotentiallyaddingmoreSMSCs. WithalargebaseofSMScapablemobiledevices,ortoenableevery

mobiledeviceforSMSemergencyservice,networkcapacityneedstobeplannedaccordinglytosupporttheSMS.

The resources dedicated to providing cellular service in a particular area are calculated based on a number of

variables.Factors includingpopulationdensity, theexpectedaverage lengthofaphonecalland theprobability

thatattemptstousethenetworkwillencounterabusysignalorblocking,areallcarefullybalancedduringthis

phase.6

SMS isapointtopointserviceasopposedtoabroadcastservice.ApointtopointservicesendsaSMSmessage

frompointAtopointB,asindicatedinthefollowingfigure:

5Seewhytextmessagesarelimitedto160characters,LosAngelesTimes,

http://latimesblogs.latimes.com/technology/2009/05/inventedtextmessaging.html6 3G Americas White Paper, Characterizing the Limitations of ThirdParty EAS over Cellular Text Messaging

Services,PatrickTraynor,Ph.D.,September2008


14/76


Figure2:SMSasPointtoPointService

AbroadcastservicealsoexistsinGSMandUMTSandwillbeusedforservicessuchastheCommercialMobileAlert

System(CMAS).

TheSMSPointtoPointserviceisdefinedinthe3GPPstandardTS23.0407.SMSmessagesaresenttoanSMSCthat

providesastoreandforwardmechanismtoqueuetheSMSmessageandforwardittotherecipient. Ifarecipient

isnotreachable,theSMSCrequeuestheSMSmessagetoberetriedlater.SomeSMSCswillretryonlyonce(or

twice)andthendiscardtheSMSmessage.SMSmessagedeliveryisabesteffortservice;therearenoguarantees

thataSMSmessagewillactuallybedeliveredtoitsrecipient,anddelayorcompletelossofaSMSmessageisfairly

common,particularlywhensendingSMSmessagesbetweennetworks.

Anoptionalfeature intheSMSstandards(whichrequiressupportbythewirelessoperatornetworkandmaybe

supportedbysomeofthenewermobiledevices)enablesausertorequestconfirmationthattheSMSmessage

wasdeliveredtoitsrecipients.ThistradesoffthelossofSMSmessageswithblindretransmissionfromtheSMS

message sender, regardless of the problems this causes and any consideration of network impacts (such as

congestion). SMSdoesnothavetheabilitytohandleretransmissioninagoodneighborwaythat,intheeventof

congestion,avoidsexacerbatingtheproblem. Bycontrast,someprotocols(suchasTCP)havemechanismsthatdo

retransmissionwithbackofftoreducecongestion,andwitheveryone'sSMSmessagesmorelikelytogetthrough.

Even thoughSMS isusedextensivelybysubscriberstoday, italso is inusebythewirelessoperator forsending

binarycontenttothemobiledeviceand/orsmartcard,suchasOvertheAir(OTA)programmingorconfiguration

data.

7Seehttp://www.3gpp.org/ftp/Specs/htmlinfo/23040.htm


15/76


2.2.1 CONCATENTATION OF SMS MESSAGES

Messageslongerthanwhatcanbesentinthisunusedcontrolchannelspacecanbesupportedbybreakingthe

messageintoshortsegments(whicharemarkedasbeinglinkedtogetherbutarestillsentasindividualmessages)

and reassembled in the destination mobile device. Segmentation and reassembly is deployed by a wireless

operator

and

must

be

supported

both

in

the

senders

and

recipient

mobile

devices.

This

segmentation

and

reassemblyiscalledconcatenatedSMSmessages.AnSMSmessagelongerthan160charactersisbrokenupinto

smallersegments,eachofwhichcan fit intothe160character field.Anadditionaluserdataheader isaddedto

eachsegmenttoprovideinformationtotherecipientmobiledeviceforreassembleofthemessageinthecorrect

order,ifthatissupported.Thereceivingmobiledeviceisresponsibleforreassemblingthemessageandpresenting

ittotheuserasonelongmessage.Whilethestandardtheoreticallypermitsupto255segments,6to8segment

SMSmessagesarethepracticalmaximum.Eachsegmentofthelongmessageisalsotreatedindependentlyinthe

transmission,reception,andthroughoutthenetwork,sodeliverytothemobiledeviceintheexactsequenceorder

isnotguaranteed.

Figure3:SMSMessageConcatenation


16/76


OnewayofsendingconcatenatedSMS(CSMS)istosplitthemessageinto1537bitcharacters(134octetsofdata),

andsendingeachpartwithaUserDataHeader (UDH)added to thebeginningof thesegmentedmessage.The

headerisusedtolettherecipientmobiledeviceknowhowlongtheheaderis,areferencenumbersotherecipient

mobiledevicecanassociatethepartsofthemessage,thetotalnumberofpartsthemessagewasbrokeninto,and

anumbersequenceindicatingwherethispartfallsinthesequence.AsampleUDHfora2segmentmessagemight

look

like

the

following:

050003CC0201[messagepart1]

050003CC0202[messagepart2]

2.2.2 INTERCONNECTION WITHOTHER NETWORKS

Asdescribedearlier,theoriginalintentofSMSwasforawirelessnetworkoperatortosendinformationsuchasa

voicemailnotificationtoasubscribersmobiledevice.Astheservicegrew,itexpandedtoprovidethecapability

forsendingshorttextmessagesbetweenmobiledevices.Today,SMStextcommunications isaservicecomponent

ofphone,webormobilecommunicationssystems,allowingtheexchangeofshorttextmessagesbetween fixed

lineormobiledevices.

To achieve this SMS message exchange across networks, Short Message Service Centers must be able to

communicatewiththePublicLandMobileNetwork(PLMN)orPublicSwitchedTelephoneNetwork(PSTN)through

whatareknownasInterworkingandGatewayMSCs.

WhenamobilesubscriberoriginatesSMSmessages,theyaretransportedfromthemobiledevice,throughthecell

tower,radioaccessnetwork(RAN),andMobileSwitchingCenter(MSC),andontoaShortMessageServiceCenter

(SMSC).Thesemobile originatedSMS messages may be destined for another mobileuser,a, subscribersona

fixednetwork,orterminatedtoanapplicationalsoknowasaValueAddedServiceProviders(VASPs).

SMSmessagesdestinedtoasubscribersmobiledevices,ormobileterminatedmessages,aretransportedfrom

the originator (another mobile device, a web site an email client, or a VASP), sent to the SMSC within the

destinationsubscribersnetwork,throughtheMSCandcelltowerthatispresentlyservingthesubscribersmobile

device,anddeliveredtothedestinationmobiledevice. ThesemobileterminatedSMSmessagesmayoriginate

frommobileuser, from fixednetworksubscriber (e.g., Internetoremail),or fromothersourcessuchasVASPs.

VASPswhichprovidethecontentmaysubmit theSMSmessage to thewirelessoperator'sSMSCusingaTCP/IP

protocolsuchastheShortMessagePeertoPeer(SMPP)protocolortheExternalMachineInterface(EMI).


17/76


Figure4:NetworkInterconnectionArchitecture

MobiletoMobileSMSmessagesaresenttothedestinationmobiledevices10digitphonenumber,e.g.555555

5555.However,itmaybedifficultforasubscribertoremember10digitphonenumbersforvalueaddedservices

orothernonmobiledestinations. Tohelpwiththis,shortcodeshavebeendeveloped.TheseallowaVASPto

obtainashortcode fromthewirelessoperator,andsubscriberssend textstothatnumber insteadofa10digit

phone number. When a mobile subscriber originates the SMS message and uses a short code, it is sent to the

SMSC, and the SMSC identifies the Short Code as a special or premium service. The SMSC will then direct the

contentofthetextmessagetotheVASPorotherserviceindicatedbytheshortcode,typicallyusinganIPprotocol

suchasSMPPorEMI.

Thestandardlengthsforinteroperableshortcodesarefiveandsixdigits.Wirelessoperatorsuseshortcodeswith

fewerdigitsforcarrierspecificprograms e.g.,Text611toseehowmanyminutesyouhaveremainingonyour

plan. Codes starting with 1 are not permitted. Common short codes in the U.S. are administered by NeuStar,

underanarrangementwithCommonShortCodeAdministration CTIA8.

Some wireless operators allow nonsubscribers the ability send SMS messages to a subscriber's mobile device

usingwhatisknownasanEmailtoSMSgateway,ormayprovidethecapabilitytosendtheSMSmessagefromthe

8Seehttp://www.usshortcodes.com/csc_press053106.html


18/76


wireless operators website. Many third party websites also offer the capability to send SMS messages to any

subscriberthroughtheseinterfaces;examplesofsuchservicesarenews,weather,andalertinformationsources.

Forexample,an AT&T subscriber whosephonenumber is5555555555 may receiveanSMS message on their

mobiledevicewhenthesenderinitiatesanemailto5555555555@txt.att.net;thiscanbedonefromanysourcefor

generatinganemail. TheAT&TsubscriberscanthenreplytothisSMSmessageandtheSMSreplyissentbackto

the

original

email

address

of

the

sender.

2.2.3 SMS MISCONCEPTIONS

ThefollowingaresomeofthecommonSMSmisconceptionsthathopefullywillbeclearedinthispaper:

Misconception#1Cellularnetworksconstantlykeeptrackofthelocationofmobiledevices

FALSEAllthatisknowniswhichMSCandwhichpagingareatotry

Misconception#2SMSoperatesoveraseparatenetwork

FALSE

The

radio

resources

are

the

same,

the

backhaul

is

the

same,

and

the

signaling

network

is

the

same

Misconception#3SMSisareliable,realtimeservice

FALSESMSisastore&forward(nonrealtime)besteffortservice

Misconception#4SMSisatwowaysessionbasedservice

FALSESMSisnotsessionbased,andisaonewaypointtopointservice

Misconception#5SMScanprovide911locationaccuracy

FALSESMScannotprovide the locationaccuracyofa911call because themobile ison thecontrol

channelforashortperiodoftime(networkbasedTDOArequiresupto30secondsofmeasurementsona

trafficchanneltogetrequiredaccuracy).

NotealsothatwhilesomemobiledeviceshavebuiltinGPSorAssistedGPSwherethenetworkassiststhe

mobiledeviceinfindingsatellitesignalsthatareweak(suchas indoors),theGPSisnotactivelytracking

themobiledeviceandlocatingthemobiledevicecanstilltakeupto30seconds.

Misconception #6 A cellular network can handle every subscriber that wants to make a call or send a text

messagesimultaneously.

FALSEThecapacityofthecellularnetworkislimitedbymanyfactorsincludingthespectrumavailable.

Networks are engineered to handle expected traffic loads at the busiest time of the day, and are

physicallynotabletosupporteverysubscribersimultaneously.


19/76


2.3 HOWSMS WORKS

Aspreviouslydiscussed,therearetwotypesofpointtopointSMSservice:MobileOriginatedShortMessage(MO

SM) service and MobileTerminatedSM (MTSM) service. The architecture and message flow for each are

highlightedbelow.

Figure5:BasicSMSServices

AMOSMissentbyasubscriberfromthemobiledeviceandtransportedacrossthecellularnetworktoanSMSC.

InaMOSMSscenario,theoriginator(Brian)hasamessagetosend(HiAliceIllmeetyouatStarbucks).Brian

opens the SMS application on his mobile device, types in the message, and sends the message. Once Brians

mobile device gains access to the control channel on the cell tower serving it, the mobile device notifies the

network he has a message to send, and the MSC authorizes the ability for Brians mobile device to send the

message.BriansmessageisthensentasanSMSmessageoverthecontrolchannelbeingusedonthecelltower

and on to the MSC. The MSC then forwards Brians SMS message to the SMSC; the address of the SMSC is

provisioned inBriansmobiledeviceSubscriber IdentityModule (SIM)and thatSMSC is located inBrianshome

wirelessoperatorsnetwork, regardlessofwhatnetworkmaybeservingBrianat thepresenttime. IfBrianwas

roamingintoanotherwirelessoperatornetworkoutsidehishomewirelessoperatorsnetwork,thentheMOtext

messageisroutedtoBrianshomewirelessoperatorsSMSC,nomatterwhereintheworldthatSMSCislocated.

TheSMSChasnoknowledgeofBrianslocationotherthentheidentityoftheparticularMSCitreceivedtheSMS

messagefrom(andsinceeachMSCservesmanycelltowersoverawidegeographicarea,anMSCprovidesnoreal

geographiclocationofthesubscriber). TheSMSCacknowledgestotheMSCthatitreceivedtheSMSmessage,and

itisnowuptotheSMSCtofigureoutwhoandwhereAliceisandhowtoforwardthatSMSmessageontoher.


20/76


BrianisonlyawarethattheSMSmessagemayhavelefthismobiledevice,andhasnoindicationofwhereitisor

whatthestatusofthedeliveryis.

Figure6:MobileOriginatedSMS

HowdoesBrianinformthenetworkIhaveamessagetosend? Tounderstandthis,itisimportanttounderstand

thethreebasictypesofchannelsinacellularsystemthecontrolchannel,thetrafficchannel,andthedata

channel.ControlChannels (CCH)areused forsignalingbetweencelltowerbasestationsandmobiledevices.

ControlchannelsareusedtodeliverSMSmessageswhenthemobiledeviceisnotengagedinaphonecall.Traffic

Channelsareusedtodelivervoicetraffictothemobiledevice,anddatachannelsareusedtodeliverdatatothe

mobiledevice.Awirelessoperatorneedstoengineerthelimitednumberofchannelsithasavailable(spectrum).

Each wireless operator is allocated a portion of the total frequency band. There is not enough spectrum

(channels)availabletoalloweveryonewhohasamobiledevicetomakeavoicecallorsendatextmessageallat

once.Thewirelessoperatorsengineering isbasedonbusyhournetworkplanning,andthewirelessoperator

deploys transmitters and receivers in the available frequency band into each cell site, and divides these into

control,trafficanddatachannels,asillustratedbelow:


21/76


Figure7:ExampleChannelConfiguration

Anidlemobiledeviceismonitoringcontrolchannelsfromthecelltowerwaitingforphonecalls,SMSmessages,or

other system activity. When Brian makes or receives a call, the mobile device is switched over to a traffic

channel;ifengagedinadatasession,themobiledeviceisonadatachannel.WhenBriantypesinamessageand

hits send, the MOSMS sends the data on the control channel, effectively holding the channel for up to 45

seconds (asopposedtoavoicecallthatholdsatrafficchannel forseveralminutesormore).Thisshorthold

time of the control channel when sending an MOSMS is why there is a greater chance of getting a MOSMS

throughinacongestednetwork,butthisisnotguaranteed!

BriansmobiledevicemayalsosendorreceiveanSMSwhileonatrafficchannelthroughwhatisknownasan

associatedcontrolchannelthatexistsonthetrafficchannelifthenetworkandhandsetsupportit.

Figure8:MobileDeviceChannels


22/76


On3GUMTSnetworks,servicesareassignedaQualityofService(QoS)classesforfourtypesoftraffic:

Conversationalclass(voice,videotelephony,videogaming) Streamingclass(multimedia,videoondemand,webcast) Interactiveclass(webbrowsing,networkgaming,databaseaccess) Backgroundclass(email,SMS,downloading)

SMSissentinthebackgroundclassasitislowpriority,nonrealtimetraffic.

Sointhescenario,howdoweknowwhereAliceis?Alicecouldbeasubscriberofanywirelessoperator,roaming

onanynetworkintheworld,orcanbeafixednetworkemailaccount,oraVASP.

Figure9:WheresDestinationMobileDevice?

Forthisscenario,assumeAliceisusinganothermobiledevice.Inthiscase,thedeliveryofBriansmessagetoAlice

willbeaMTSMthatistransportedfromanSMSC,acrossthecellularnetwork,anddeliveredtoamobiledeviceso

thatitcanbeviewedbyasubscriber.

But how do we find Alice? The simplest case is when both Brian and Alice have the same wireless network

operator;inthiscase,BriansSMSCalsoknowsaboutAlice,andcanbegintofindAlicedirectly.TheSMSCinthis

casewillqueryanothernetworkentityknownastheHomeLocationRegisterorHLR,andaskessentiallyWhere

isAlice?IfAlicesmobiledevicewasonthenetworkrecently,theMSCservingAlicewillhavenotifiedtheHLRof

Aliceswhereabouts(downtotheMSClevel).TheHLRcanthenreportbacktotheSMSCthatAlicelastcheckedin

on MSC xyz. The SMSC will then forward Brians SMS message to MSC xyz and ask it to deliver Brians SMS

messagetoAlice,whoisbelievedtobeonacellsitewithinMSCxyzscontrol,andtheMTSMSprocesswillbegin.


23/76


Figure10:FindDestinationMobileDevice

IfAliceandBrianarenotservedbythesamewirelessnetworkoperator,findingAlicebecomesmorecomplicated.

Inthiscase,BriansSMSChasnoknowledgeofAliceotherthenAlicedoesnotreceiveservicebythesamewireless

network operatorasBrian. BriansSMSC passeshisSMSmessage off toanother entity known as the Gateway

SMSC,

or

G

SMSC.

The

G

SMSC

can

determine

from

Alices

phone

number

which

wireless

network

operator

providesservicetoAlice,andforwardsBriansSMSmessagetotheGatewayMSC(GMSC)ofthewirelessnetwork

operator providing Alices service. The GSMSC in Alices home network forwards Brians SMS message to the

SMSCservingAlice.AlicesSMSCthengoesthroughthequeryoftheHLRtoidentifytheMSCwhereAlicewaslast

reported.


24/76


Figure11:FindDestinationMobileDeviceAlternative#2

IfAlice(thedestinationoftheMOSMS)isnotanothermobiledevice,butashortcode,thedestinationaddress

shortcodeistranslatedinthehomewirelessoperatorsSMSCtoanaddresswheretheSMSmessageisroutedfor

handlingtheservice.Thus,ifAlicesSMSCdoesnotunderstandtheshortcodeusedintheroamedintoarea,the

SMSmessagemaygetlostsinceAlicesSMSCwillnotknowwheretorouteit. Orworseifthereistheshortcode

usedforanotherservicebyAliceshomenetwork,theSMSmessagewillgetroutedtothewrongdestination.This

isan importantpoint ifashortcode isproposed foruse forSMS to911; theremustbeconsistencyacrossall

wirelessoperatorsandnetworksorconfusionandpotentialmisroutingofSMSmessageswillbetheresult.

WhenanSMSisdeliveredtoamobiledevice,itusestheMTSMSprocess.TodemonstratetheMTSMSprocess,

assume Alice desires to send the message Ill meet you at 3 pm at Starbucks to Brian using the previously

describedMOSMSprocess. TheSMSmessagewillarriveatBriansSMSCaspreviouslydescribed.BriansSMSC

mustnowfindoutifBrianisavailableonthenetwork,andifso,where?BriansSMSCsendsasignalingmessageto

BriansHLRaskingWhere isBrian? IfBrianwasrecentlyonthenetwork,theHLRknowswhichMSCBrian last

reportedfrom.ThatMSCnumber,MSC1234inthiscase,isreportedbacktotheSMSC.TheSMSCthenforwards

theSMSmessagetotheindicatedMSC,indicatingthattheSMSmessageisdestinedforBrian.However,asingle

MSCtypicallyhascontrolofalargenumberofcelltowerswithinalargegeographicarea.WhichcelltowerisBrian

currentlyon,especiallysinceinamobileenvironmenthecouldbemovingfromtowertotower?Thisisthesame

problemasifavoicecallwastobedeliveredtoBrianhecouldbeononeofanumberofcelltowersinthearea.


25/76


Figure12:FindingMobileDeviceforMobileTerminatedSMS

Themethodusedto locatetheparticularcelltowerBrian is locatedon isthroughaprocessknownaspaging.

ThisprocessisthesamewhethertheMSCisdeliveringaphonecalltoBrian,ordeliveringanSMSmessage.Thisis

akeypointthesamenetworkandradioresourcesareusedinthisprocessregardlessofwhetherthisisaphone

callorSMSdelivery;however,thepagingprocessisprioritizedsovoicecallsareprocessedfirst.Inanetworkunder

hightraffic loads,SMSmessageswillbedelayedbydesign.Also,therearea limitednumberofpagingchannels

available,basedonnetworkengineeringof theavailablespectrum.Duringextremebusyhourconditions, there

maynotbeenoughpagingchannelstohandleboththevoicetrafficandtheSMStraffic. Inthisevent,callsand

SMSmessagesarenotdeliveredandtheSMSmessagesarestoredintheSMSCforlaterretry.

MSC1234sendsamessageoutonanumberofcelltowerstofindBrian;thisisapagemessage.Thispaging

processstartsinitiallyatagroupofcelltowersinBrianslastknownlocationarea,andifBriandoesnotanswer,

the MSC sends out the page to larger areas until either Brian is found, or the MSC assumes Brian is no longer

availableandgivesup.IfBriansdevicehearsthepage,hisdeviceessentiallyreturnsaHereIam!messageto

theMSC.TheMSCnowknowswhichcelltowerBrianison.

Once

Brians

mobile

device

is

located

on

a

particular

cell

tower,

the

MT

SM

message

is

delivered

to

the

mobile

device.There isaphysical limitonthe rateatwhichMTSMSmessagescanbedeliveredonthe radiochannels

availableatypicalruleofthumbrateatwhichtheactualMTSMSmessagemaybedeliveredis2SMSmessages

persecondpersector. IftherearealargenumberofSMSmessagesgoingtosubscribersonasingletower/sector,

SMSmessageswillbebackedupandprocessedinorderuntiltheyaredelivered.


26/76


IfBriansmobiledeviceacknowledgestheSMSmessagewasreceived,theMSCacknowledgestoBriansSMSCthat

theSMSmessagewasdeliveredandtheSMSCdoesnothavetoworryaboutretryingtodelivertheSMSmessage

later.

Figure13:DeliveryofMobileTerminatedSMS

NotethatnoacknowledgmentissentbacktoAlicesoAlicehasnoindicationthatBrianreceivedtheSMSmessage.

WhathappensifBriansdevicecannotbefound?Briansdevicemaynotrespondtothepagebecauseofanumber

ofreasonsincluding:

Heisinapoorradiocoveragearea Hemovedoutsidethepagingarea Heturnedoffhismobiledevice Thecellsiteiscongestedwithvoicecallpages

IfBriansmobiledevicedoesnotrespondtothepage,anindicationissenttotheSMSCthattheSMSmessagewas

notdeliveredandisstoredforlaterretryrecallbydesignSMSisastore&forwardsystem.Theretryperiodis

variableanddependsonnetworkconfiguration,andeachretrygoesthroughthesamepagingprocess.IfBrians

mobiledevicecannotbefoundafterseveralretries,thentheSMSCgivesup,storestheSMSmessage,andasksthe

HLRtoinformitwhenBriansmobiledeviceisavailableonthenetwork.Afteraperiodoftime,theSMSCmaygive

upentirelyanddeletetheSMSmessagefromitqueue.Alicehasnoindicationthatthishashappened.


27/76


AnSMSCisabletosendonlyoneMTSMtoasubscriberaddressatatime.Themobiledeviceisabletoreceiveone

MTSMandsendoneMOSMatatime.

ThefollowingsectionsdescribetheSMSsignalingflowinmoredetail.

2.3.1

MOBILE

ORIGINATED

SM S

GSM/PLMN

network

MO-SM MT-SM

SME application

SMSC

Figure14:SMSSystemDiagram

A subscriber can originate a short message to another subscriber even when the recipients mobile device is

switchedofforisnotreachable.ThesenderisnotsentanacknowledgmentwhentheSMarrivesattherecipient.

TheSM issent independentlyofthevoiceservice.SMscanbesentandreceivedduringvoicecalls,but ittakes

moretime.


28/76


ThefollowingfiguredepictstheflowofanMOSMcase:

MSCMO-ForwardSM

3

SMS-IWMSC

1

VLR

2

4

SMSC

MT-SM

5

6

Figure15:MobileOriginatedShortMessageService

1. ThemobiledevicesendsanSMviathecontrolsignalingchannelontheradiointerface;theSMincludestheaddressoftheSMEwheretheSMSCeventuallyattemptstoforwardtheSM.

2. TheservingMSCchecksthedataofsubscriberfromtheVLR.3. TheMSCroutestheSMtoSMSIWMSC(InterworkingMSC).4. TheSMisroutedviaaspecialOSIorTCP/IPapplicationtotheSMSC.5. SMSCstorestheSMandtriesMTSMwhentherecipientterminalisconnected.6. MTSMprovidesSMSCthedeliveryreporttoSMSCforanyretransmissionifneeded.


29/76


2.3.2 MOBILETERMINATED SMS

ThefollowingfiguredepictsaMTSMcase:

MSC

MT-ForwardSM

4SMS-GMSC

2

HLR

3

6

SMSC

7

9

5

VLR

8

MO-SM

1

Figure16:MobileTerminatedShortMessageService

TheSMSCreceivestheshortmessageovertheMOSMservice,storestheSMSmessage,andforwards ittothe

recipientovertheMTSMservice.

Themessageflowisdepictedasbelow:

1. MOSMsendstheSMtotheSMSC.2. TheSMSCsendstheSMtotheSMSGMSC.3. TheSMSGMSCrequeststheVMSCorSGSNaddressfromtheHLR.4. TheSMSGMSCroutestheSMtotheVMSC/SGSN.5. TheVMSCaskstheVLRforthestatusandlocationareaoftheMSoftherecipient.6. If the recipient is in idle mode, the VMSC starts paging and delivers the SM to it through the control

signalingchannelofthebasestation.Iftherecipientisinbusymode,theVMSCsendstheSMthroughthe

controlchannel.TherecipientsendsadeliveryreporttotheVMSCafterreceivingtheSM.


30/76


7. The VMSC sends the delivery report to the SMSGMSC using global title analysis to find the routingaddressoftheSMSC.

8. Ifneeded,theSMSGMSCsendsthedeliveryreporttotheHLR.9. TheSMSGMSCsendsthedeliveryreporttotheSMSCeitherconfirmingthattheMShasreceivedtheSM

orinformingtheSMSCthecausewhythedeliveryfailed.

No delivery acknowledgement is supported from the SMSC towards the SM sender since there is no signaling

mechanismavailablefromtheMOSM.

2.3.3 SMS VI A EMAIL ORWE B CLIENTS

SMSmessagesmayalsobeinitiatedfromanemailclient,suchasMicrosoftOutlook,orfromawebpage.Email

initiated SMS uses a protocol called SMTP9 (Simple Mail Transfer Protocol), which can deliver emails as text

messages via SMTP gateways at the entry point into the wireless operators network. SMTP is a standard for

supportingemailacrossIPnetworks,forexample,theInternet. SMTPgatewayswereneverintendedtosupport

urgentortimecriticalmessagingandarenotcapableofdeliveringthelevelofreliabilityandperformancesuited

tonotificationservices.ThereisnoformalrelationshipbetweenthesenderoftheSMSmessageandthewireless

operatorwhenSMSmessagesaresenttotheSMTPGateway.

TherearealsoaddonsforemailprogramssuchasMicrosoftOutlookthatfacilitatethesendingandreceivingof

SMSmessagesdirectlyfromtheemailclient,aswellaswebclientsthatallowsendingandreceivingSMSmessages

usingawebbrowser. InstantMessagingapplicationssuchasWindowsLiveMessengerandYahoo!Messenger

alsosupporttheabilitytosendandreceiveSMSmessages.

Figure17:SMSviaEmail

9SeeIETFRFC5321, http://tools.ietf.org/html/rfc5321


31/76


ToinitiateanemailtoSMS,thesenderconstructsanemailmessagewithanaddressconstructedfromthe10digit

phone number and the domain name for the email gateway of the wireless operator. The domain names are

publishedbythewirelessoperatorsandarereadilyavailableontheInternet.AnexampleofanaddresstoanAT&T

mobiledeviceis5555555555@txt.att.net.EmailtoSMScanalsobeusedtosendSMSmessagesinternationally.

Asdescribed later,SPAM isa hugeconcern forwireless operators.SMTPmessaginggatewaysare the targetof

millions of SPAM messages each day. A significant percentage of SMS requests via email are SPAM. Wireless

operatorsareaggressivelymanagingthisproblemthroughsophisticatedSPAMdetection&filtering.Sincethereis

no formalrelationshipbetweentheSMSmessagesenderandthewirelessoperator,SMSmessagessentviathe

SMTPGatewaymaybepronetofiltering,especiallyiftheyappeartobeSPAM.

Figure

18:

SMS

SPAM

via

Email

2.3.4 SMS AGGREGATORS

Typically,SMScontentprovidersdonotconnecttoawirelessoperatornetworkdirectly,andanSMTPGateway

haschallengesespeciallyifthecontentprovidersmessagehasthecharacteristicsofSPAM.AnothertypeofSMS

gateway is known as an SMS broker or aggregator. An SMS aggregator provides connectivity with wireless

operatorsbyofferingagatewaytobothsendandreceivemessagesandothermultimediaordigitalcontent. The

aggregator model is based on business agreements between SMS content providers, the aggregator, and the

wirelessoperator.Anaggregatorisabusinessentitythatnegotiatesagreementswithwirelessoperatorsandacts

asamiddlemanprovidingaccesstoacellularnetworkforthirdpartieswhohavenodirectrelationshipwiththe

wirelessoperator10

.AnSMSaggregatorhasdirectconnectionstomostwirelessoperatorstodelivertextmessages

throughtheirgateways.Suchgatewaysarenecessarybecause it isvirtually impossibletoconnectdirectlytothe

wirelessoperatorsasasinglecompany.Anaggregatorcanenablethesendingofbulktrafficandmayalsomanage

therentalofshortcodestothecontentproviders.

10SeeJeffBrown,BillShipman,RonVetter,"SMS:TheShortMessageService,"Computer,vol.40,no.12,pp.106

110,Dec.2007,doi:10.1109/MC.2007.440


32/76


Figure19:SMSAggregatorNetworkArchitecture11

2.4 MULTIMEDIA MESSAGING

TheMultimediaMessagingService(MMS)wasdevelopedby3GPPandismaintainedbytheOpenMobileAlliance

(OMA). MMSsupportssendingmessagesthatincludemultimediacontent(text,audio,video,pictures,etc.)toand

frommobiledevicesthatsupportthefeature.MMSisasubscriptionserviceandisfunctionallydifferentthanthe

SMSservice.Technically,multimediamessagesaredelivered inacompletelydifferentway thanSMSmessages.

(MMS is closer conceptually to email than to SMS.) However, MMS uses both SMS and the data network for

deliveryofthemessage.NoteverymobiledeviceorsubscriptionsupportsMMS.

11SeeJeffBrown,BillShipman,RonVetter,"SMS:TheShortMessageService,"Computer,vol.40,no.12,pp.106

110,Dec.2007,doi:10.1109/MC.2007.440


33/76


Figure20:MultimediaMessagingService

Todeliveramultimediamessage,anSMScontrolmessageissenttothedevicewithaURLtotriggerthedevices

browsertoopenadataconnectionandreceivethemultimediacontent.AdditionalSMSmessagesareexchanged

toreportstatusoftheretrieval.MMSrequiressignificantlymorenetworkresourcesthanSMS.

MMS isanonrealtimedeliverysystem(as isSMS).Primeexamplesofnonrealtimemessagingservices include

traditionalemailavailableontheInternetandwirelessmessagingsystemssuchaspagingormessaging.

MMS does not support location determination or routing to the correct PSAP based on the sender's current

location.

Multimedia Messaging (MMS) offer no solutions to the limitations of SMS to 911. Other subsequent text

messagingproducts,suchasMMS,mayactuallyuseSMStechnologyaspartofthedeliveryofthemessage.Thus,

alloftheexistingtechnicalshortcomingswithSMSto911willalsoexistwiththesemessagingmethodsaswell.

MMSalsointroducesanumberofchallengesbeyondthosewithSMS12

:

Contentadaptation: Multimedia content created by one mobile device may be incompatible with therecipientsmobiledevice.IntheMMSarchitecture,therecipientsMultimediaMessagingServiceCenter

(MMSC)isresponsibleforprovidingcontentadaptation(e.g.,imageresizing,audiocodectranscoding),if

this feature is enabled by the wireless network operator. When content adaptation is supported by a

wirelessnetworkoperator,itsMMSsubscribersenjoycompatibilitywithalargernetworkofMMSusers

thanwouldotherwisebeavailable.

12Seehttp://en.wikipedia.org/wiki/Multimedia_Messaging_Service


34/76


Bulkmessaging:TheflowofpeertopeerMMSmessaginginvolvesseveralovertheairtransactionsthatbecomeinefficientwhenMMSisusedtosendmessagestoalargenumbersofsubscribers,asistypically

thecaseforVASPs.

MobileDeviceConfiguration:UnlikeSMS,MMS requiresanumberofmobiledeviceparameters tobeset.Poormobiledeviceconfigurationisoftenblamedasthefirstpointoffailureformanyusers.Service

settingsare sometimes preconfigured on the mobile device,but wireless operators are now lookingat

newdevicemanagement technologiesasameansofdelivering thenecessarysettings fordataservices

(MMS,WAP,etc.)viaovertheairprogramming(OTA).

2.5 MOBILE INSTANT MESSAGING

Instantmessaging(IM)isaformofrealtimedirecttextbasedcommunicationsbetweentwoormorepeopleusing

personal computers or other devices, along with shared software clients. The text is conveyed over a network,

suchastheInternet.Moreadvancedinstantmessagingclientsalsoallowothermodesofcommunications,suchas

live voice or video calling. There are numerous IM clients available, and many have proprietary, incompatible

protocols.Therehavebeenseveralattemptstocreateaunifiedstandardforinstantmessaging:IETF'sSIP(Session

InitiationProtocol)andSIMPLE(SIPforInstantMessagingandPresenceLeveragingExtensions),APEX(Application

Exchange), PRIM (Presence and Instant Messaging Protocol), the open XMLbased XMPP (Extensible Messaging

andPresenceProtocol),andOMA's(OpenMobileAlliance)IMPS(InstantMessagingandPresenceService)created

specificallyformobiledevices.

MostattemptsatcreatingaunifiedstandardforthemajorIMprovidershavefailed,andeachcontinuestouseits

ownproprietaryprotocol.ForthisreasonusershavetoeitherusethesameIMclients,oruseaclientthatsupports

multipleprotocols,ortheIMserverneedstodotheprotocolconversion.

Inamobileenvironment,IMisconstrainedbybandwidthandtheformfactor/userinterfaceofthemobiledevice.

Mobile IM (MIM) allows connection to an IM application via the mobile device. There are two distinct

methodologiestoenablemobileinstantmessaging:

Embedded Clients tailored IM client for every specific mobile device with a special backend serverinstalledwithinthewirelessoperatornetwork.

ClientlessPlatform a browser based application which enables users to connect to their Internet IMservicewithouttheneedforanysupportbythewirelessoperator.

MIMmayuseSMSorthedatanetworktoprovideconnectivitytotheIMserver.SMSmaybeusedasabearerfor

MIM.Forexample,IMapplicationssuchasYahoo!MessengerofferaclientbasedonSMS13

. However,SMSdoes

notincludealiascapabilitiesnordoesitallowforconfirmationthattheintendedrecipientisavailable.SMSmakes

itimpossiblefortherecipienttoreceivetheMIMmessageinrealtimebecauseSMSistransactionbasedandnot

sessionbased. MIMdoesnotfixthe limitationsandvulnerabilitiesoftheunderlyingSMStransport (ifSMS is

usedforthetransport).

3GPPhasdefinedspecificationsthatenableinterworkingbetweenSMSandIM(atbothservicelevelandtransport

level).Inaddition,OMAhasdefinedtheInstantMessagingandPresenceService(IMPS)14

,whichisanOMAenabler

13Seehttp://mobile.yahoo.com/messenger/sms

14SeeIMPSArchitecture,OMAADIMPSV1_320070123A,OpenMobileAlliance


35/76


thatisdesignedforexchanginginstantmessagesandpresenceinformationnotonlybetweenmobiledevicesbut

alsobetweenmobileandfixeddevices.ThefollowingfigureshowstheIMPSarchitecture:

Figure21:OMAIMPSArchitecture

AclientlessplatformMIMallowsthecommunityofuserstoregistertheirpresence,allowingformorerealtime

text messaging and communications than would be possible with traditional mobile messaging. Mobile IM

providespresencetotheIMserverwhichestablishesanIMsession.MIMwithanalwaysondataconnection

willprovidetheuserwithamorerealtime IMexperiencesimilartothe IMexperiencefromacomputeronthe

Internet. However, since this is a clientless platform, the basic wireless operator provided services (location,

routing,etc.)arenotavailablefortheIMsession.

ThereareIPrelayservicesoffered15

thatallowuserstocontactemergencyservicesviaIMthrougharelayservice.

Usersselect911fromtheirIMcontactlist,andopenasessionwiththerelayservice.Usershavetoprovidetheir

locationtotherelayservicethroughtheIMsessionsotherelayserviceknowswhichPSAPtocontact.

Crackers (malicious "hacker" or black hat hacker) have consistently used IM networks as ways for delivering

phishing attempts, "poison URLs", and virusladen file attachments. Hackers use two methods of delivering

maliciouscodethrough IM:deliveryofviruses,Trojanhorses,orspywarewithinan infected file,andtheuseof

"sociallyengineered"textwithawebaddressthatenticestherecipienttoclickonaURLconnectinghimorherto

a website that then downloads malicious code. Viruses, computer worms, and Trojans typically propagate by

15Seehttp://www.iprelay.com/im/


36/76


sendingthemselvesrapidlythroughtheinfecteduser'sbuddylist. Infectionsmayrangefromnuisancetocriminal,

andarebecomingmoresophisticatedeachyear.Considerationoftheseattacksmustbemadeforanyuseof IM

foremergencyservices.

IMconnectionsusuallytakeplace inplaintext,makingthemsusceptibletoeavesdropping.Inaddition, IMclient

softwareoftenrequirestheusertoexposeopenUDPportstotheworld,increasingthethreatposedbypotential

securityvulnerabilities.

2.6 SMS OVER GENERIC IP CONNECTIVITY ACCESS NETWORK (IPCAN)

3GPPhas defined theability to supportSMSoverageneric IP connectivityaccess network (IPCAN)16

. SMSvia

IPCAN requires a mobile device which supports IP Multimedia Subsystem (IMS) data services, and a wireless

operatornetworksupportingbothanIMSaswellasanIPSMSGateway. Thesearefuturecapabilitiesandarenot

availableinnetworksdeployedtoday.

ThereferencearchitectureforprovidingSMSviaIPCANisasshownbelow:

Figure22:SMSviaIPCAN

16See3GPPTS23.204,http://www.3gpp.org/ftp/Specs/htmlinfo/23204.htm


37/76


Thebasicprinciple isthatSMS flowsthroughthetraditionalSMSCandaGatewayor InterworkingMSCtoan IP

Short Message Gateway. From there, the SMS message is delivered to the mobile device via IP through the IP

MultimediaSubsystem (IMS).Note that this isahybridarchitecture, where the legacySMSC isstillusedas the

storeandforwardentity.Thus,thecharacteristicsofSMSwhenusingSMSviaIPCANarethesameasusingSMS

onthelegacycircuitswitchednetwork.

The IPShortMessageGatewayhasanadditionalfunctiontoprovidethecapabilityforservicelevelinterworking

betweenShortMessagesandInstantMessagesinIMS.Inmanyusertousermessageexchangesystems,message

sendersoftenwishtoknowifthehumanrecipientactuallyreceivedamessageorhasthemessagedisplayed.IETF

IMDN(InstantMessageDispositionNotification) fordeliverynotificationcanbesupportedaspartoftheservice

levelinterworkingwithIM.

2.7 SOCIALNETWORKING

From a technology perspective, social networking applications have similar network impacts as SMS. A Social

NetworkDiagramismadeupofnumerouspointtopointconnections,asindicatedinthefollowingfigure17

:

Figure23:SocialNetworkDiagram

Mostsocialnetworking applications requireadataconnection toaccess theapplication, andmay haveanSMS

componentsimilartoMMS.

17Seehttp://en.wikipedia.org/wiki/Social_network


38/76


SomesocialnetworkingapplicationsprovidetheabilitytoreceiveupdatesviaSMS.Forexample,Twitterallowsa

usertoreceiveTweetsthroughSMS,allowsausertopostupdatesviaSMS,andtohavedefinedshortcodesand

textcommandsthatperformspecificfunctionsviaSMS.

Manysocialnetworkingapplicationsareaddinglocationcapabilities.OnspecificmobiledevicessupportingHTML5

andgeolocation,thereisthecapabilitytoTweetwithyourLocationiftheuserauthorizestheapplicationtouse

thelocationfromthemobiledevice.Thelocationmaybeprovidedattheneighborhoodlevel,thetownlevel,oran

exactpoint.FacebookhasrecentlylaunchedFacebookPlacestotheirapplication,againforHTML5andgeo

locationsupportingmobiledevices.Placesallowsausertocheckintoaspecificlocationtoallowtheirfriends

seewheretheyare,andcanalsobeusedtotrackfriends.Theapplicationalsogivestheusertheabilitytoallow

thirdpartyapplicationstoobtainyourlocation(withpermission)totailorservicestoauserslocation.

Someagencies have started looking at incorporating Facebook, Twitter,MySpace, etc. into theiremergency

communications systems. However, these sites are typically used for general information sharing and not for

emergencies18

.MostpoliceagenciesdonotmonitorthesocialnetworkingsitesconstantlyfromtheirPSAPs.Social

networksareincreasinglybecomingthefirstwaypeoplelearnaboutsomethinghappening,andmaybebeneficial

forwordofmouthinformationsharing.

Therearecaseswheresocialnetworksreportedlyplayedaroleincontactingemergencyservices.In2009,Atlanta

councilmanKwanzaHallusedTwitteronhisBlackBerryinanefforttosummonmedicalassistanceatthescene

ofanaccidentbecausehewasconcernedthemobiledevicebatterywastoo lowtoplaceacall19

.HisTweet for

assistancewaspickedupbyseveralofhisfollowers,whocalled911andreportedit.However,itwasnotclearif

theTweetresultedinthemedicdispatchorwasaresultofotherbystandersmakingacallto911.Thisscenario

doesraiseseveralquestions,however:

If the followers are not in the same geographic location, how do they know whom to contact foremergencyservicesonbehalfoftheTweeter?

IftheTweeterdidnotspecifythelocationexactly,willthefollowerknowwhatcitytheemergencyisevenin?Forexample,Kwanza tweetedNeedaparamediconcornerof JohnWesleyDobbsandJacksonSt.

Womanonthegroundunconscious.PlsReTweet.Ifafollowerinanothercityreceivedthisandhewas

unawareitwasfromAtlanta,wouldthatfollowercall911inhiscityandreportit?

IftheTweeterhasalargenumberoffollowers,whatiftheyallcalled911onhis/herbehalf?Wouldthisoverwhelmthe911system?

WhowouldkeeparecordofTweetsforuseininvestigationsand/orlitigation?Whilethesesocialnetworkingtoolsmayseemvaluableforemergencyservices,significantsecurityissuesexist.As

theseapplications incorporate location features,significantsecurityandprivacyconcernsareraised.SMSbased

social

networking

applications

do

not

overcome

the

limitations

of

SMS.

Browser

based

social

networking

applications require an alwaysondata connection, andnewer applications require mobile devices that support

HTML5andgeolocation.

18SeePolice:Use911insteadofTwitter,Facebook,

http://www1.whdh.com/news/articles/local/12001917838482/policeuse911insteadoftwitterfacebook/19

SeeTwitterTrumps911,http://www.wired.com/epicenter/2009/05/twittertrumps911/


39/76


2.8 EXAMPLEIMPLICATIONS OF TEXTING SERVICES AND APPLICATIONS

Thissectionprovidestwoexamplesofothertextingservicesandapplicationswhichcouldhaveimplicationsforthe

support of emergency text messages to PSAPs. The first example describes the implications of an existing

smartphonebasedalertingapplication. Thesecondexampledescribesthe implicationsofthevarietyofexisting

FreeSMSandSMSbypassapplicationsandservices.

2.8.1 SMARTPHONE ALERTING APPLICATION

Availability ofa thirdparty emergency alerting application forapopular smartphoneplatform started inMarch

2010. Even though this particular version of an emergency alerting application is targeted for a specific

smartphone, futureversionsofthisapplicationorothersimilarsmartphoneapplicationscouldbedeveloped for

anyothertypeofsmartphone.

Whenthesubscriberinstallsthisemergencyalertingapplicationfortheirsmartphone,theyconfigureitwithphone

numbersforSMSmessagesandemailaddressesforwhomtheywishtonotifyiftheyneedhelp. Inanemergency

situation, this application can be activated without alerting onlookers or the potential attackers. When this

emergency alerting application is activated, it will send SMS and/or email messages to the configured list of

contactsapproximatelyevery60secondsuntildeactivatedbythesubscriber. Theemergencyalertmessagethatis

sent every 60 seconds identifies the subscriber indicates that they are having an emergency, and provides

approximatelocationinformationintheformofaURLtoGoogleMaps.

Thisemergencyalertingapplicationhasbeen receivingnumerousravereviewsonvarious Internetblogs,online

userjournals,andonlinenewspaperarticles.Thisapplicationhasalsoreceivedseveralendorsements. Allofthese

reviewsandendorsementsareencouragingsubscriberstoacquireandinstallthisapplication.

At this time, this application does not send these emergency alert messages to PSAPs because SMS or email

interfacestodosocurrentlydonotexist. IfaPSAPdefinesanSMSoremailaddresswherebycitizenscansend

messages,thereisnothingtorestricttheuseofthisapplicationforsendingmessagestothataddress.

Forthepurposeofthisanalysis,thefollowingassumptionswillbeapplied:

a. Theenvironmentisthecampusofalargeuniversity(e.g.,20,000students).

b. AmechanismhasbeendefinedforthestudentstosendSMSemergencymessagestothePSAPsupporting

thatuniversity,suchasaspecificshortcode.

c. Smartphonesareverypopularwithcollegestudentsand,therefore,alargenumberofuniversitystudents

have smartphones with the emergency alerting application installed and configured. For example, the

universitymightgivetheemergencyalertingapplicationtothestudentsforfreewiththeSMSaddressfor

theuniversityPSAPpreconfigured.

d. Threewirelessoperatorsprovidewirelesscoveragefortheuniversitycampuswitheachwirelessoperator

coveringthecampuswith5sectorseach.

An emergency situation such as a campus shooting occurs on the university campus. Hundreds and potentially

thousands of students activate the emergency alerting application on their smartphones. Assume that mobile

originated SMS messages are processed by each of the three networks at the rate of 2 mobile originated SMS

messages per second per sector. Based upon the coverage assumption, the wireless networks covering the

universitycampushaveamaximumcapacityof30mobileoriginatedSMSmessagespersecond. Withthe large


40/76


number of activations of the emergency alerting application on the students mobile devices, the wireless

networks covering the university campus will reach this maximum capacity very quickly. Due to the 60 second

retransmissioncapabilityoftheemergencyalertingapplication,thewirelessnetworkswillremainatthismaximum

leveluntiltheapplicationisdeactivatedonthesmartphonesbythestudents. Asdescribedabove,SMSdoesnot

have the kind of smart retransmission backoff included in protocols such as TCP, which could avoid each

application

making

the

situation

worse.

Based upon the assumption that the PSAP is one of the preconfigured recipients of the SMS based emergency

messagesfromthissmartphoneapplication,thePSAPwillbereceivingtheseemergencyalertmessagesattherate

of30SMSalertmessagespersecondwhichequatestoarateof1,800SMSmessagesperminuteor108,000SMS

messages per hour. The PSAP will continue to receive these alert messages at this rate until the students

deactivatetheemergencyalertingapplicationontheirsmartphones.

Many of these alert messages will be repeated alert messages, but these repeated alert messages may not be

exactduplicatesbecausethestudentmayhavemovedandconsequentlythelocationinformationportionofthe

messagecouldbedifferent.

Also, the alert messages for any other emergency incident that is occurring at the same time would be

intermingledwiththismassivequeueofalertmessagesandcouldbeoverlookedbythePSAPsystemand/orthe

PSAPcalltakers.

Due to movement of the students and due to the propagation characteristics of RF radio coverage, these

emergencyalertmessagesmayalsobesenttoPSAPsthatareservingthesurroundingneighborhoods.

2.8.2 FREESMS AND SMSBYPASSAPPLICATIONS AN D SERVICES

Thereareasignificantnumberofapplicationsandservicesavailabletowirelesssubscriberswhichareadvertised

asFreeSMSorSMSBypassservices. Thesearewebbasedandsmartphoneapplicationswhichprovidetexting

services without using the messaging capabilitiesof the wirelessoperators network. Theseapplications, when

downloadedtosmartphones,mayevenhavescreensthatlookverysimilartotheembeddedSMSservicesonthe

mobiledevice.

Toget asenseof thenumberand availabilityof these services andapplicationsjustenterFreeSMS orSMS

BypassinyourfavoriteInternetsearchengineorinyourfavoritesmartdeviceappstore.

ThetextingcapabilitiesprovidedbythewirelessoperatorSMSbasedmessagingservicesaredefinedby industry

standardsandarecompletelyseparatefromtheseothertypesoftextmessagingserviceseventhoughtheymay

appearonthesurfacetobethesame.

SincetheseareInternetbasedapplications,thewirelessoperatornetworkhasnoknowledgeorcontrolofthese

thirdpartyFreeSMSorSMSBypassdataservicesandapplications. Consequently,aswithSMS,thewireless

operator networks cannot perform the functions such as PSAP determination, PSAP routing, and call back

information.ThesupportoftheseemergencyservicesfunctionsbythesethirdpartyFreeSMSorSMSBypass

dataservicesandapplicationswillbeimpossible.

Someof these thirdpartiesFreeSMSorSMSBypassservicesdonteven requireamobiledevice. SMSlike

messages can be sent via a PC over any network (e.g., WiFi, cable, DSL) and will totally bypass the wireless

networks. However,totheendrecipient,thesethirdpartySMSlikemessagescouldappearasiftheyarecoming


41/76


from a mobile device. As a result, PSAPs could be subject to massive amounts of SPAM and Denial of Service

attacksfromwhatappeartobelegitimatemessagescomingfrommobiledevicesonwirelessnetworks.

TheseSMSlike messages from FreeSMSorSMSBypassservicesarecompletelyanonymousandcannotbe

tracedbacktoanoriginatingmobiledeviceorsubscriber.

3. SECURITYASPECTSAND VULNERABILITIES

SMS does not provide any type of authentication or security. Millions of spam SMS messages hit the wireless

operatorsnetworkseveryday,andprotectionsareputintoplacetoprotectthecustomersfromthesemessages.

Therefore, it is very easy to transmit malicious SMS messages either to a 911 center or to a subscriber.

Fraudsters can use this fact tocreatedenial of serviceattacks on 911centers; international trialsof text to

911 functions resulted in very high percentage of fraudulent/hoax messages, including the delivery of

pornographiccontenttothePSAP.Inaddition,virussoftwareandmalwareisnowbeingseendeliveredviaSMS.

Additionally, terrorists or other criminals can send fraudulent SMS messages to 911 call takers produce some

reaction(e.g.,Amheldbymenwithmachinegunsinsidestoreatcornerof5thandMain.Theysaytheyaregoing

tokillme.HELP!).Theresultingfirstresponderreactioncanthenbetargetedformaliciousexploitation.

SMS issubjecttomaliciousattacksthatwouldaffectSMSaccessto911emergencyservices,andwouldcreate

newproblemsforPSAPsandpotentiallyforwirelessnetworks. Theuseofsmartphonesthatcanbeprogrammed

to repeatedly send SMS messages also creates the potential for inadvertent transmission of a large number of

shortmessagesthatcouldfloodaPSAP.

3.1 SMS SPOOFING

SMSSpoofing(alsoknownasBlowbackandJoeJob)occurswhenasendermanipulatesaddressinformation

to impersonate a subscriber and send a short message. It is possible to spoof SMS messages and make them

appeartocome fromotherpeoplesmobiledevices.SenderstransmittingSMSmessages fromonlinecomputer

networks normally spoof their own number in order to properly identify themselves. SMS spoofing can be

conductedatthenationalandinternationallevel.

AnSMSSpoofingattackisoftenfirstdetectedbyanincreaseinthenumberofSMSerrorsencounteredduringa

billrun.Theseerrorsarecausedbythespoofedsubscriberidentities.Wirelessoperatorscanrespondbyblocking

different source addresses in their Gateway MSCs, but fraudsters can change addresses easily to bypass these

measures.Iffraudstersmovetousingsourceaddressesatamajorinterconnectpartner,itmaybecomeunfeasible

toblocktheseaddresses,duetothepotentialimpactonnormalinterconnectservices.

AnexampleofSMSspoofing is thatmessagessent fromGooglearesentwiththeSender IDGoogle.Skype

sendsmessagesfromitsuserswiththemobilenumbertheyregisteredwith.Inthiscase,whenauserattemptsto

replytotheSMSmessage,thelocalsystemmayormaynotallowthereplyingmessagetobesentthroughtothe

spoofed origin. Another example is to send a spoofed SMS message to Twitter. Twitter uses the SMS

originatortoauthenticatetheuser.HoaxMailisusedtospooftheSMSmessageandthereforecouldtrickTwitter

topostthemessageonthevictimsTwitterpage.

IfSMSmessagescouldbesentto911,afraudstercouldusespoofingtoimpersonateavalidsubscriberandsend

amaliciousmessageto911. ManyproblemscouldthenariseforPSAPsandforvalidsubscribersincluding:


42/76


InvalidSMSmessagecontentsreceivedbythePSAP;

PSAP responsemessages would be sent to the valid subscriber who did not send the original SMS

message (which could then start a an exchange of SMSmessages between the PSAP and the valid

subscriber);

ThePSAPmaydispatchafirstrespondertoalocationspecifiedintheSMSmessage;

PSAPresourcesdivertedtohandleincidentstriggeredbyspoofedmessages;

PotentiallyblockinglegitimateSMSmessagesatthePSAPtodefendagainstspoofing.

Wireless network resources would be wasted in transporting spoofed SMSmessages to 911. Any tools

employedby awireless serviceprovideror thePSAP todetect andblock spoofing couldblock legitimate SMS

messagesto911.

Thefollowingexamplefromthe3GAmericaswhitepaper,CharacterizingtheLimitationsofThirdPartyEASover

Cellular TextMessaging Services,20

illustrates the issue of distinguishing fraudulentmessages from legitimate

messages.

Figure24:ExampleofForgedEmergencyMessage

This is a forgedemergencymessagewarning theuserof anoncampus shootingand claims tobe sentby the

Police.

Therearesignificant implicationstothisshortfall.Forinstance,intheeventofanemergencysuchasachemical

leak,itwouldbeeasyforamaliciouspartytosendanallclearmessagebeforethesituationwasdeemedsafe.

Becauseitwouldnotbepossibleforuserstoverifythesourceoftheinformation,maliciouslyinducedconfusionis

arealthreat.

ExamplesofSMSspoofingarecommonandcanbeexpectedwithanySMSbasedservice (includingemergency

services)duetothelackofsecurity.

In2009followinganearthquakeinIndonesia,ahoaxtextmessagesbegancirculatingwarningofanew,stronger

earthquake21.Itwasclaimedtohavebeensentfromalegitimategovernmentagency.

20 3G AmericasWhite Paper, Characterizing the Limitations of ThirdParty EAS over Cellular TextMessaging

Services,PatrickTraynor,Ph.D.,September2008


43/76


Alsoin2009,ahoaxAmberAlertmessagewascirculated22

sayinga3yearoldboywaskidnappedbyamanina

2003MitsubishiEclipsewithOregonlicenseplate98B351.AmberAlertsfromunknownsourcescouldleadtoa

delayedresponsefromthepublicandjeopardizestheintegrityoftheentireAmberAlertplan,saidStatePoliceLt.

MollyCotter,OregonAmberAlertcoordinator.

SMSspoofinghasresultedinpanic hoaxtextmessageswereusedtospreadstsunamiterrorinIndonesia(June,

200723).ThousandsofpeoplefledtheirhomesinpanicontheIndonesiancoastafterhoaxtextmessagesspread

warningthemthatatsunamiwillhittheregion.ThepossibilityisthatatsunamimaytakeplaceonJune7,said

partofashorttelephonetextmessage(SMS)thatiswidelycirculatinginvariouscoastalareasofNusaTenggara

province.

InMay2005,anSMStsunamirumorhitsSumatra24

.Rumorsthatavolcaniceruptionhadsentatsunamicrashing

toward the coast spread through a seaside town on Indonesia's Sumatra Island early Tuesday, prompting

thousandsofpanickedresidentstofleetohighground.ItwasunclearhowTuesday'srumorbegan,butitquickly

spreadbywordofmouthandSMStextmessage,thestatenewsagencyAntarareported.Byabout2A.M.,almost

all the mosques in the town were broadcasting tsunami wa

Documents

SMS to 911 White Paper Final October 2010