SMS to 911 White Paper Final October 2010
Transcript of SMS to 911 White Paper Final October 2010
-
8/6/2019 SMS to 911 White Paper Final October 2010
1/76
4GAmericasOctober2010 1
-
8/6/2019 SMS to 911 White Paper Final October 2010
2/76
4GAmericasOctober2010 2
4GAMERICAS TEXTING TO 911 WHITEPAPER TABLEOF CONTENTS
EXECUTIVESUMMARY...................................................................................................................................................5
1. INTRODUCTION.....................................................................................................................................................8
2. SMSOVERVIEW...................................................................................................................................................10
2.1 SMSHISTORY.................................................................................................................................................10
2.2 SMSTECHNOLOGYOVERVIEW......................................................................................................................12
2.2.1 CONCATENTATIONOFSMSMESSAGES...............................................................................................15
2.2.2 INTERCONNECTIONWITHOTHERNETWORKS....................................................................................16
2.2.3 SMSMISCONCEPTIONS ........................................................................................................................18
2.3
HOW
SMS
WORKS
.........................................................................................................................................
19
2.3.1 MOBILEORIGINATEDSMS...................................................................................................................27
2.3.2 MOBILETERMINATEDSMS..................................................................................................................29
2.3.3 SMSVIAEMAILORWEBCLIENTS........................................................................................................30
2.3.4 SMSAGGREGATORS............................................................................................................................31
2.4 MULTIMEDIAMESSAGING............................................................................................................................32
2.5 MOBILEINSTANTMESSAGING......................................................................................................................34
2.6 SMSOVERGENERICIPCONNECTIVITYACCESSNETWORK(IPCAN).............................................................36
2.7 SOCIALNETWORKING...................................................................................................................................37
2.8 EXAMPLEIMPLICATIONSOFTEXTINGSERVICESANDAPPLICATIONS..........................................................39
2.8.1 SMARTPHONEALERTINGAPPLICATION..............................................................................................39
2.8.2 FREESMSANDSMSBYPASSAPPLICATIONSANDSERVICES.........................................................40
3. SECURITYASPECTSANDVULNERABILITIES..........................................................................................................41
3.1 SMSSPOOFING..............................................................................................................................................41
3.2 SMSFLOODING.............................................................................................................................................43
3.3 SMSSPAM.....................................................................................................................................................44
3.4 DENIALOFSERVICEATTACKS........................................................................................................................45
3.5 FRAUDULENTPSAP........................................................................................................................................46
-
8/6/2019 SMS to 911 White Paper Final October 2010
3/76
4GAmericasOctober2010 3
3.6 PRIVACY.........................................................................................................................................................46
3.7 SMSPHISHING...............................................................................................................................................46
4. IDENTIFEDSMSANDNETWORKSHORTFALLS.....................................................................................................47
4.1 SMSTOVOICEEMERGENCYCALLCOMPARISON..........................................................................................48
4.2 IDENTIFIEDSHORTFALLSFORSMS................................................................................................................48
4.2.1 CALLBACKINFORMATION....................................................................................................................49
4.2.2 ROUTINGSMSMESSAGETOAPPROPRIATEPSAP...............................................................................49
4.2.3 BESTEFFORTSERVICE..........................................................................................................................50
4.2.4 SUBSCRIBERMOBILEDURINGMESSAGINGWITHPSAP......................................................................51
4.2.5 NOLOCATIONCAPABILITIESFORSMS.................................................................................................51
4.2.6 NODELIVERYACKNOWLEDGEMENTS .................................................................................................51
4.2.7 RECOGNITIONOF911ASVALIDSMSDESTINATION........................................................................52
4.2.8 INTERNATIONALEMERGENCYNUMBERS............................................................................................52
4.2.9 UNAUTHORIZEDORFRAUDULENTMOBILEDEVICES..........................................................................53
4.3 CONSIDERATIONSFORPSAPSYSTEMS..........................................................................................................53
4.3.1 CONNECTIVITYOFSUBSCRIBERTOSPECIFICCALLTAKER/DISPATCHER ATPSAP................................53
4.3.2 ASSEMBLYOFMESSAGESINTOLOGICALSEQUENCE..........................................................................53
4.3.3 MESSAGEFORWARDINGTOPROPERPSAP.........................................................................................54
4.3.4 SMSSPAMMINGTOPSAP....................................................................................................................54
4.4 CANADAREPORTTOCRTCBYEMERGENCYSERVICESWORKINGGROUP(ESWG)..................................54
4.5 CONSIDERATIONSFORMIGRATIONTONEXTGENERATION........................................................................56
5. USERCONSIDERATIONS FOREMERGENCYSERVICES..........................................................................................56
5.1
CONSIDERATIONS
FOR
WIRELESS
SUBSCRIBER
.............................................................................................
56
5.1.1 AVAILABILITY .....................................................................................................................................57
5.1.2 ACCESSIBILITY ....................................................................................................................................58
5.1.3 RELIABILITY ........................................................................................................................................59
5.1.4 USERLOCATION ................................................................................................................................59
-
8/6/2019 SMS to 911 White Paper Final October 2010
4/76
4GAmericasOctober2010 4
5.2 CONSIDERATIONSFORPSAPCALLTAKER.....................................................................................................60
5.2.1 EVALUATION OF CALLER..................................................................................................................60
5.2.2 ANCILLARYINFORMATION ..............................................................................................................61
5.2.3 OVERLOAD POTENTIAL.....................................................................................................................61
5.2.4 LANGUAGESAN DTERMINOLOGY ...................................................................................................61
5.2.5 POTENTIALIMPACTOF VIRTUALREALITY.....................................................................................62
5.3 SIMPLESMSTO911SCENARIO...............................................................................................................62
6. PEOPLEWITHDISABILITIES..................................................................................................................................69
7. CONCLUSIONS......................................................................................................................................................71
8. ACKNOWLEDGEMENTS ........................................................................................................................................73
APPENDIXA. ACRONYMSANDDEFINITIONS........................................................................................................74
A.1 ACRONYMS....................................................................................................................................................74
A.2 DEFINITIONS..................................................................................................................................................76
-
8/6/2019 SMS to 911 White Paper Final October 2010
5/76
4GAmericasOctober2010 5
EXECUTIVE SUMMARY
A citizens ability to send text messages to 911 emergency services (e.g., PSAP) is a topic that is undergoing
significant discussions in the emergency services community, the people with disabilities community, and the
wirelessindustry.Thetermtextisusedinthegeneralsenseduringthesediscussionstextsignifieseverything
from the short message service (SMS), to instant messaging (IM), to social networks such as Twitter and
Facebook.Understandably,thepeoplewithdisabilitiescommunityinparticularhasexpressedinterestintextto
911usingtheexistingcapabilitiesoftheirmobiledevices,asanalternativetousingbulky,cumbersomeaddon
TTYdevices.Thewireless industryfullyunderstandsthedesiresofthepeoplewithdisabilitiescommunityand is
focusedon findingareliablesolution fortheirneeds.Thisanalysis focusesonSMSasameans tocontact911
emergencyservices,withagoaltoprovideaviewofthecapabilities,limitations,threatsandvulnerabilitiesofthis
meansofcommunications.
Texting,particularlySMS,hasexplodedinthepastdecade. Citizensrelyontextingfortheirsocialcommunications
needs.TherearemillionsofSMSmessagessenteachdayandthereisaperceptionthatSMSisreliable;however,
SMS was never designed as a reliable means for lifesaving critical communications. SMS was designed to be
secondary
to
voice
calls
and
was
never
designed
to
provide
the
full
and
robust
communications
citizens
have
come
toexpectwithvoicecalls. SMShassignificant limitationsandshortcomings that donotmakeSMSsuitable for
emergencycommunications,especiallyunderlifethreateningconditions.
It is importanttounderstandthatSMS isnotandneverwillbearealtimecommunicationsservice. SMSby its
verydesignisanonrealtime,besteffort,storeandforwardservice. SMSisnotasessionbasedprotocol;without
session based communications, SMS makes correlation of multiple messages from a citizen to a particular
emergencyimpossible.Withthesecharacteristics,SMSmessagesmayhaveadelayeddelivery,maybedeliveredin
adifferentorderthanthesenderintended,ormaybelostordiscarded.
A critical component to providing emergency services in a timely manner to citizens in distress is for the
emergencyinformationtoberoutedtotheappropriatePSAP,andforthatPSAPtobeabletoobtainthecurrent
locationofthecitizenwhoisrequestingtheemergencyservices. RoutingtotheappropriatePSAPisfacilitatedby
therough locationofthesubscriberwhenthey initiateavoicecall.Theabilitytoobtainmoreaccurate location
information is available when there is a voice call; however, there is no location information available for the
routing function or for the PSAP to obtain location information when a citizen initiates an SMSmessage and it
traversesthenetwork. Whilethereareapplicationsthatmakeuseof locationcapabilitiesofthemobiledevice,
locating the nearest pizza restaurant is significantly different from the location accuracy required to direct an
emergencyresponse.
Since SMS was never intended for robust missioncritical communications, SMS was not designedwith security
mechanisms. SMS has a number of security vulnerabilities including SMS spoofing, Denial of Service
vulnerabilities,SPAM,Malware,etc. Thesesecurityvulnerabilitiesareprimarilyduetothelackofauthentication
ofSMSmessagesandtheabilitytoinjectSMSmessagesintothenetworkfromexternalsources.
RelatedtoSMSspoofingareemergingsmartphoneapplicationsandthirdpartynetworkservicescommonlycalled
Free SMS or SMS Bypass. These applications provide SMS capability without using the wireless operator
messagingcapabilities. ThesesmartphoneapplicationsevenhavescreensthatlookverysimilartotherealSMS
services. ThewirelessoperatornetworkhasnoknowledgeorcontroloftheseotherSMSapplications. Someof
thesespecialSMSservicesdontevenrequireamobiledevice. TheseservicescanbedoneviaaPCandcantotally
bypasswirelessnetworks. However,totherecipient,theseSMSmessagescouldlookliketheyarecomingfroma
-
8/6/2019 SMS to 911 White Paper Final October 2010
6/76
4GAmericasOctober2010 6
mobiledevice. AsaresultaPSAPcouldbesubjecttomassiveamountsofSPAMorDenialofServiceattacksfrom
whatappeartobelegitimateSMSmessagescomingfrommobiledevicesonwirelessnetworks.
Withoutclearrequirementsandastandardizeddesignfornonvoiceemergencycommunications,theresultwillbe
a patchwork implementation that will be a source of confusion to the wireless users since they will have no
indication of when they arewithin a PSAPboundary andserved by a wirelessoperatorwhichsupportsSMS to
911andwhentheyareoutsideoftheareathatsupportsSMSto911. Theremayalsobeinconsistentvendor
specificimplementationsacrossPSAPsandwirelessoperators.Thisconfusioncouldresultinevenfurtherdelaysin
obtainingtheemergencyservicesthattheuserrequires.
Currentvoiceemergencyservicessupportemergencycallsto911formobiledevicesthatdonothaveaninstalled
smartcard(SIMorUICC)orwhichmaynotbeauthorizedforregularvoiceservicesintheservingnetwork(for
example,aprepaiddevicethathasdepletedthefundsforservice). Mobiledevicesthatdontcontainasmartcard
orarenotauthorizedforuseontheservingnetworkcannotinitiateSMSmessagesduetothefundamentaldesign
ofthenetworkprotocols.
Thewirelessindustryrecognizesthattherearenumerousregulatorydiscussionsinprogress,andisveryengaged
intheseregulatorydiscussions. However,theviabilityofscalableSMSto911servicecannotbesolvedsimplyby
thestrokeofaregulatorspen.Aswillbedetailedthroughoutthiswhitepaper,multipletechnicalissuesinherent
inSMSdesignandimplementationshowthatSMSto911isnotarationaltechnicalpossibility.
ImplementationofSMSto911emergencyservicescouldhavesignificantimpactsontheresourcesandpersonnel
ofthePSAPs. SMScanbeoriginatedthroughanumberofsources includingwirelessdevices,the Internet,and
thirdpartyapplicationsonsmartphones.Theonlywaytocontroltheauthenticityofthesetextmessagesisatthe
destination,whichwillrequiresignificantSPAMfilteringandotherprotectionsatthePSAPs.
TheNationalEmergencyNumberAssociation(NENA)iscurrentlydefiningthenextgenerationemergencyservices
requirementsandenvironment.RecentincreasedcooperationbetweenNENAandthewirelessindustry,including
theAllianceofTelecommunicationsIndustrySolutions(ATIS)andthe3rdGenerationPartnershipProject(3GPP),is
leadingtoauniformapproachacrossaccesstechnologies(wireline/wireless).Thiswillnodoubtbenefitboththe
consumeraswellasthePSAPs.Theseareongoing,multiyeareffortsthatwillimposesignificantcostsandpromise
majorbenefits. Effortstoaddressthe legacySMSstandardswilldetractfromresourcesthatcouldotherwisebe
used to advance next generation systems; hence delaying a better solution in order to deploy a limited and
constrainedone.
Inconclusion,therearesignificantlimitationsinherentinthedesignofthecurrentShortMessageServiceswhich
makeitimpracticaltobeusedforemergencyservice.However,theindustryisfullyawarethatitisimportantto
address the requirements for people with disabilities as soon as possible. To that end, it is recommended that
techniques which are readily available today, such as silent 911 calls, along with accelerating research and
developmentintoemergingtechnologiessuchasTTYEmulation,beundertakenwhilethenextgenerationsystems
arebeingdesigned.Thefollowingconsiderationsmustbetakenintoaccount:
SMSto911isabesteffortservicewithnodeliveryorperformanceguarantees,thereforeFULLliabilityprotectionmustbeprovidedforwirelessoperatorsandotherstakeholders.LiabilityprotectionsforSMS
to911havetobefargreaterthanthoseforvoicebecausetheprobabilityofsomethinggoingwrongis
somuchgreaterandtherearemoreareaswherethingscangowrong.
-
8/6/2019 SMS to 911 White Paper Final October 2010
7/76
4GAmericasOctober2010 7
Thereneedstobeaneducationprocessforbothcalltakersandconsumersontheexperienceexpectedastheexperienceforboththecalltakerandenduserfortextingto911willbesignificantlydifferentthan
voiceorTTYto911.
Routingofa"911"SMSmaybeprovidedtoaNENAdefinedcentralserverforhandlingandroutingtoaPSAP.Thewirelessnetworkoperatorisnotresponsibleforrouting.
No location information isprovidedby theoriginatingnetworkormobiledevice.Location issubject towhatever is put in the message by the originator and subject to mobile device and other functional
elementcapabilities/limitations.
NopriorityorspecialhandlingisgiventoSMSmessages. SMSto911messagesshouldlessthan160charactersinlengthtoeliminatetheneedforsegmentation
andreassemblyof longSMSmessages.LongSMSmessagesarebrokenintoasequenceof independent
messages.Each segmentcanbe delayed resulting in outof order delivery of themessages resulting in
confusion,anddevicesareinconsistentinthewaytheyreassemblelongmessages.
Noacknowledgmentsofsent,deliveredorreadSMSmessagesareprovided(bytheoriginatingnetwork). Nosecurity,authentication,ornonrepudiationofanySMSmessageisprovided. Theoriginatingnetworkwillnotpreventanyspam,SMSspoofing,ordenialofservice (DoS)attackson
messagesdeliveredtothe"911"centraladdress.
Anoriginatingnetworkreservesallrightstoprotectitsnetworkfromnetworkspikes,DoSattemptsandothercongestionissues.Thismustbepartofthoseliabilityprotections.
SMS isnotasessionbasedprotocol.Therefore it isaPSAP (E911Authorityasapplicable) function tomanage routing ofallmessages toor from theappropriatePSAPcall taker for eachSMSmessage. If
thereisaseriesofSMSmessagesintheexchangebetweenthecallerandPSAPcalltaker,thenthePSAPis
responsible for association of those messages, ensuring routing to the same call taker if that is their
desire,andappropriateroutingtoanotherPSAPifapplicable.Originatingnetworksdonotmaintainthis
association.
o NOTE: If thecaller ismovingandcrossesPSAPboundaries,messagesmaybesent todifferentPSAPs based on caller location, cell site boundaries, etc. Management of messages in this
environment isnottheresponsibilityoftheoriginatingnetwork. It isnotclearhowthismight
workatPSAPboundaries.
-
8/6/2019 SMS to 911 White Paper Final October 2010
8/76
4GAmericasOctober2010 8
1. INTRODUCTION
Thepurposeofthis4GAmericaswhitepaperistoexaminetheuseofShortMessageService(SMS)messagingto
911emergencyservicesviaPublicSafetyAnsweringPoints(PSAPs). Thiswhitepaperwillprovidethereaderwith
thefollowinginformation:
AbriefhistoryofSMS AnoverviewofhowSMSworks SecurityaspectsandvulnerabilitiesofSMS IdentifiedlimitationsandshortfallsforSMSbasedemergencyservices RegulatoryconsiderationsrelatedtoSMSbasedemergencyservices WirelesssubscriberconsiderationsforSMSbasedemergencyservices PSAPcalltakerconsiderationsforSMSbasedemergencyservices Considerationsforthepeoplewithdisabilities Conclusions
TheabilityforacitizentobeabletosendSMStextmessagesto911emergencyservices(e.g.,PSAP) isatopic
thatisreceivingsignificant interestandundergoingsignificantdiscussions intheemergencyservicescommunity,
the people with disabilities community,and the wireless industry.The termtext is used in the general sense
duringthesediscussionstextsignifieseverythingfromtheshortmessageservice(SMS),toinstantmessaging
(IM),tosocialnetworkssuchasTwitterandFacebook.Understandably,thepeoplewithdisabilitiescommunity
inparticularhasexpressedinterestintheSMStextto911functionalityonusingtheirexistingcapabilitiesoftheir
mobiledevices,asanalternativetousingspecializedbulky,cumbersomeaddonTTYdevices.Thewirelessindustry
fully understands the desires of the people with disabilities community and is focused on finding a good and
reliablealternativesolutionfortheirneeds.ThisanalysisfocusesonSMSasameanstocontact911emergency
services,withagoaltoprovideaviewofthecapabilities,limitations,threatsandvulnerabilitiesofsuchmeansof
communications.
Texting,particularlySMS,hasexplodedinthepastdecade. Citizensrelyontextingfortheirsocialcommunications
needs.TherearemillionsofSMSmessagessenteachdayandthereisaperceptionthatSMSisreliable;however,
SMSwasneverdesignedtobeusedasareliablemeansforlifesavingcriticalcommunications. SMSwasdesigned
tobesecondarytovoicecallsandwasneverdesignedtoprovidethelevelofcommunicationsthatcitizenshave
cometoexpectwithvoicecalls. SMShasseveralsignificantlimitationsandshortcomingswhichdonotmakeSMS
suitableforemergencycommunications especiallyunderlifethreateningconditions.
SMSisatextbasedmessagingserviceandthereisacomplementaryservicecalledMultimediaMessagingService
(MMS).MMSisamultimediaservicewhichsupportsavarietyofmultimediaformatsincludingtext,pictures,and
videoclips. The issuesand limitations forMMSbasedemergencycommunicationsaresimilartothe issuesand
limitationsforSMSbasedemergencycommunications.
-
8/6/2019 SMS to 911 White Paper Final October 2010
9/76
-
8/6/2019 SMS to 911 White Paper Final October 2010
10/76
4GAmericasOctober2010 10
2. SMS OVERVIEW
ThissectionprovidesanoverviewofSMSincludingdiscussionsonthefollowing:
ThehistoryofSMS AnintroductiontohowSMSworksincludingconcatenationofSMSmessages,SMSinterconnectionwith
othernetworks,andcommonmisconceptionsaboutSMS
AdescriptionofhowSMSworksforSMSmessagesoriginatingfromthemobiledevices,forSMSmessagesbeingdeliveredtoSMSdevices,andforSMSsentviaemail
AdescriptionofSMSviaemailorwebclients AdescriptionofSMSaggregators AdescriptionofMultimediaMessagingService(MMS) AdescriptionofMobileInstantMessaging(MIM) AdescriptionofSMSviaagenericIPconnectivityaccessmethod AdiscussionofsocialnetworkingasrelatedtoSMS Adiscussionofexampletextingservicesandapplicationsandtheirassociatedimplications
2.1 SMS HISTORY
SMSwasoriginallydesignedinthe1980s,beforemoreadvancedwirelessdataservicesexisted. Theoriginalintent
ofSMS was tousesparesignalingcapacity toprovide some basic data transferand information services. SMS
transportedmessagesonthesignalingpathsneededtocontrolthetelephonytrafficduringtimeperiodswhenno
signaling traffic existed (i.e., during the periods of lowest wireless activities), making productive use of idle
channels. Subsequently,SMSwasexpandedtosendshortblocksofinformationsuchasweather,sports,financial,
etc.,thatwereneithertimesensitivenormissioncritical.
Voicecallswereconsideredtobetheprimaryserviceformobiledevices,andeventodaywiththegrowthofdata
services,voiceisstilltheprimaryservice.SMSwasdesignedasasecondaryservicetousesignalingchannelsand
otherresourceswhentheywerenotbeingused forvoicecalls. SinceSMS isasecondaryservice,therewasno
intenttosupportemergencyservicecapabilities (aswasdone forvoicecalls),orhighreliability, lowdelay,real
time2waymessaging,with location,orsecuritycapabilities. As a result, the deliveryofSMSmessagescanbe
delayedwhensystemresourcesareneededtohandlevoicecalls. Asaconsequence,SMSwasdesignedasastore
andforwardserviceifthemobiledeviceorsystemresourcesarenotavailable,theSMSmessageisstoreduntil
they became available. Unlike voice calls (which setup an endtoend path from originator to receiver), SMS
messagesarestoredandhandedoffbetweenthenetworkentitiesastheytraversefromsourcetodestination. If
thedeliveryofanSMSmessagetoamobiledevicefails(e.g.,ifthemobiledeviceisoutofcoverageorpoweredoff
orforwhateverreasonunabletoreceivetheSMS),thatSMSmessageisstoredinthenetworkforaperiodoftime
andthedeliveryoftheSMSmessageisretriedatafuturetime. AnundeliverableSMSmessagewilleventuallybe
deletedbythenetworkbaseduponthenumberofretriesorbasedupontheageoftheSMSmessage.Alsosince
SMS is a secondary service, there was no intent to support any level of service such as the emergency service
-
8/6/2019 SMS to 911 White Paper Final October 2010
11/76
4GAmericasOctober2010 11
capabilities of voice calls. Therefore, the SMS service is not designed with high reliability, low delay, realtime
2way messaging, location, or security. Because the SMS service was designed and deployed to use only
temporarilyvacantcapacityinthenetworks,wirelessoperatorshavealwaysdescribedservice/reliabilitylevelsas
best efforts onlyor equivalent. Subscribers know thatSMS messagesmay bedelayed, sometimes for lengthy
periods;HappyNew YearSMS messages canbedelayed formanyhoursoreven days;Presidentialcandidate
Obama
used
SMS
to
announce
Joe
Biden
as
his
VP
candidate
this
message
was
delayed
12
hours
or
more
after
it
wassentat3:00AM.
BythetimethatSMSwasdeployed intheearly1990s3,voicecallminuteswere increasingrapidlyeveryyearas
peopleacquiredmoremobiledevices. EvenwhenSMS initiationfrommobiledeviceswasaddedasaserviceto
subscribers, itwasconsidered tobean interesting featurethatwouldhave limitedusagesimplybecause itwas
viewedtobemucheasiertomakeaphonecallthanitistotypealimitedcharactermessageonamobiledevice
keypadwithonly12keys.
AstheSMSserviceprogressed,someviewedSMSasanalternativetothebeeperorpagersthatwerethen in
widespreaduse.Thecapabilitytoreceiveashorttextmessageonamobiledevicebecamemoreattractive.But
again,thiswasaonewaynonmissioncriticalserviceanddidnothavethereliabilityofpagingservices(whichuses
asignificantlydifferenttechnologydesignedforapagingpurpose).
However, what wasnotpredictedwas themassiveshift insocial behavior thathas occurredover the past few
years. Wellaheadofmobiledevicesforteenagers,InstantMessagingonPCsshiftedtheyoungergenerationaway
fromvoicecallstotextbasedcommunicationswithitsownspecializedvocabulary. Asmobiledevicesandwireless
plans became cheaper, teenagers started getting mobile devices and started accelerating the usage of text
messaging. Forexample,priortothismajorevolutioninsocialbehavior,theaveragewirelesssubscriberhadan
averageof0.4SMSmessagespermonthwiththevastmajorityofsubscribersnotevenusingtheSMSservices.
Today,SMSusagehasexploded.IntheU.S.in2009,thenumberofannualizedSMSmessages4was1.56trillion,or
152.7billionmonthlySMSmessages.EachoneofthesebillionsofSMSmessagesiscontendingforthatunused
space,
which
can
be
viewed
as
a
funnel:
3ThefirstSMSmessagewassentovertheVodafoneGSMnetworkintheUnitedKingdomon3December1992.
4Source:CTIA
-
8/6/2019 SMS to 911 White Paper Final October 2010
12/76
4GAmericasOctober2010 12
Figure1:SMSTrafficFunnelDiagram
2.2 SMS TECHNOLOGY OVERVIEW
Short
Message
Service,
also
known
as
SMS,
is
a
service
originally
created
in
the
GSM
family
mobile
communicationssystem,usingstandardizedcommunicationsprotocolsthatenablethe interchangeofshorttext
messages between mobiledevices. With SMS becoming so widely used incellularnetworks, the term SMS is
oftenusedasasynonymforanytextmessageortheactofsendingatextmessage,thoughinrealitytherecould
beanumberofdifferentmethodsorprotocolsbeingused.Inthispaperweintroducethe3GPPSMStechnology,
and use the term SMS to refer to 3GPP SMS, not any other text messaging applications such as Instant
Messaging.
SMS allows the sending of text messages up to 160 characters in length (including spaces), to and from other
mobile devices. SMS is supported in other technologies including cdma2000 networks, as well as satellite and
landlinenetworks.SupportovermultipletechnologiesallowsSMSmessagestobesenttomobiledevicesacross
networks.MostSMSmessagesaremobiletomobiletextmessages.
TheinnovationinSMSistousethetelephonyoptimizedsystemtotransportSMSmessagesonthesignalingpaths
needed tocontrol the telephony trafficduring timeperiodswhennosignaling trafficexists. In thiswayunused
resources in the systemcan beused to transport SMS messages without additionalcost. It is because the SMS
messageshadtofit intotheexistingsignalingformats iswhytheSMSmessage lengthwas limitedto128bytes,
-
8/6/2019 SMS to 911 White Paper Final October 2010
13/76
4GAmericasOctober2010 13
which is roughly140alphanumericcharacters (using astandard7bitcoding foreachalphanumeric character)5.
However, later improvement increased thecapacityto140bytesor1607bitcharacters. It is the fundamental
designofSMStofittheSMSmessageintotheexistingsignalingslots,asnamedSHORTMessageService.
SMS is implemented inmobiledevicesand in thenetwork, including radio andcorecomponents.SMS requires
engineeringof the radiocapacityand network transport infrastructure to transport the SMSmessages, aseach
controlchannelcanonlyhandlethetransmissionanddeliveryofafixednumberofSMSmessagespersecond.SMS
requires a network element called a Short Message Service Center (SMSC), or Message Center or Message
ServiceCenterforshort.TheSMSCisthestoreandforwardentityintheSMSnetwork.
AsthenumberofSMSmessagetrafficincreases,thisextraloadonthenetworkrequiresengineeringthesignaling
capacityandpotentiallyaddingmoreSMSCs. WithalargebaseofSMScapablemobiledevices,ortoenableevery
mobiledeviceforSMSemergencyservice,networkcapacityneedstobeplannedaccordinglytosupporttheSMS.
The resources dedicated to providing cellular service in a particular area are calculated based on a number of
variables.Factors includingpopulationdensity, theexpectedaverage lengthofaphonecalland theprobability
thatattemptstousethenetworkwillencounterabusysignalorblocking,areallcarefullybalancedduringthis
phase.6
SMS isapointtopointserviceasopposedtoabroadcastservice.ApointtopointservicesendsaSMSmessage
frompointAtopointB,asindicatedinthefollowingfigure:
5Seewhytextmessagesarelimitedto160characters,LosAngelesTimes,
http://latimesblogs.latimes.com/technology/2009/05/inventedtextmessaging.html6 3G Americas White Paper, Characterizing the Limitations of ThirdParty EAS over Cellular Text Messaging
Services,PatrickTraynor,Ph.D.,September2008
-
8/6/2019 SMS to 911 White Paper Final October 2010
14/76
4GAmericasOctober2010 14
Figure2:SMSasPointtoPointService
AbroadcastservicealsoexistsinGSMandUMTSandwillbeusedforservicessuchastheCommercialMobileAlert
System(CMAS).
TheSMSPointtoPointserviceisdefinedinthe3GPPstandardTS23.0407.SMSmessagesaresenttoanSMSCthat
providesastoreandforwardmechanismtoqueuetheSMSmessageandforwardittotherecipient. Ifarecipient
isnotreachable,theSMSCrequeuestheSMSmessagetoberetriedlater.SomeSMSCswillretryonlyonce(or
twice)andthendiscardtheSMSmessage.SMSmessagedeliveryisabesteffortservice;therearenoguarantees
thataSMSmessagewillactuallybedeliveredtoitsrecipient,anddelayorcompletelossofaSMSmessageisfairly
common,particularlywhensendingSMSmessagesbetweennetworks.
Anoptionalfeature intheSMSstandards(whichrequiressupportbythewirelessoperatornetworkandmaybe
supportedbysomeofthenewermobiledevices)enablesausertorequestconfirmationthattheSMSmessage
wasdeliveredtoitsrecipients.ThistradesoffthelossofSMSmessageswithblindretransmissionfromtheSMS
message sender, regardless of the problems this causes and any consideration of network impacts (such as
congestion). SMSdoesnothavetheabilitytohandleretransmissioninagoodneighborwaythat,intheeventof
congestion,avoidsexacerbatingtheproblem. Bycontrast,someprotocols(suchasTCP)havemechanismsthatdo
retransmissionwithbackofftoreducecongestion,andwitheveryone'sSMSmessagesmorelikelytogetthrough.
Even thoughSMS isusedextensivelybysubscriberstoday, italso is inusebythewirelessoperator forsending
binarycontenttothemobiledeviceand/orsmartcard,suchasOvertheAir(OTA)programmingorconfiguration
data.
7Seehttp://www.3gpp.org/ftp/Specs/htmlinfo/23040.htm
-
8/6/2019 SMS to 911 White Paper Final October 2010
15/76
4GAmericasOctober2010 15
2.2.1 CONCATENTATION OF SMS MESSAGES
Messageslongerthanwhatcanbesentinthisunusedcontrolchannelspacecanbesupportedbybreakingthe
messageintoshortsegments(whicharemarkedasbeinglinkedtogetherbutarestillsentasindividualmessages)
and reassembled in the destination mobile device. Segmentation and reassembly is deployed by a wireless
operator
and
must
be
supported
both
in
the
senders
and
recipient
mobile
devices.
This
segmentation
and
reassemblyiscalledconcatenatedSMSmessages.AnSMSmessagelongerthan160charactersisbrokenupinto
smallersegments,eachofwhichcan fit intothe160character field.Anadditionaluserdataheader isaddedto
eachsegmenttoprovideinformationtotherecipientmobiledeviceforreassembleofthemessageinthecorrect
order,ifthatissupported.Thereceivingmobiledeviceisresponsibleforreassemblingthemessageandpresenting
ittotheuserasonelongmessage.Whilethestandardtheoreticallypermitsupto255segments,6to8segment
SMSmessagesarethepracticalmaximum.Eachsegmentofthelongmessageisalsotreatedindependentlyinthe
transmission,reception,andthroughoutthenetwork,sodeliverytothemobiledeviceintheexactsequenceorder
isnotguaranteed.
Figure3:SMSMessageConcatenation
-
8/6/2019 SMS to 911 White Paper Final October 2010
16/76
4GAmericasOctober2010 16
OnewayofsendingconcatenatedSMS(CSMS)istosplitthemessageinto1537bitcharacters(134octetsofdata),
andsendingeachpartwithaUserDataHeader (UDH)added to thebeginningof thesegmentedmessage.The
headerisusedtolettherecipientmobiledeviceknowhowlongtheheaderis,areferencenumbersotherecipient
mobiledevicecanassociatethepartsofthemessage,thetotalnumberofpartsthemessagewasbrokeninto,and
anumbersequenceindicatingwherethispartfallsinthesequence.AsampleUDHfora2segmentmessagemight
look
like
the
following:
050003CC0201[messagepart1]
050003CC0202[messagepart2]
2.2.2 INTERCONNECTION WITHOTHER NETWORKS
Asdescribedearlier,theoriginalintentofSMSwasforawirelessnetworkoperatortosendinformationsuchasa
voicemailnotificationtoasubscribersmobiledevice.Astheservicegrew,itexpandedtoprovidethecapability
forsendingshorttextmessagesbetweenmobiledevices.Today,SMStextcommunications isaservicecomponent
ofphone,webormobilecommunicationssystems,allowingtheexchangeofshorttextmessagesbetween fixed
lineormobiledevices.
To achieve this SMS message exchange across networks, Short Message Service Centers must be able to
communicatewiththePublicLandMobileNetwork(PLMN)orPublicSwitchedTelephoneNetwork(PSTN)through
whatareknownasInterworkingandGatewayMSCs.
WhenamobilesubscriberoriginatesSMSmessages,theyaretransportedfromthemobiledevice,throughthecell
tower,radioaccessnetwork(RAN),andMobileSwitchingCenter(MSC),andontoaShortMessageServiceCenter
(SMSC).Thesemobile originatedSMS messages may be destined for another mobileuser,a, subscribersona
fixednetwork,orterminatedtoanapplicationalsoknowasaValueAddedServiceProviders(VASPs).
SMSmessagesdestinedtoasubscribersmobiledevices,ormobileterminatedmessages,aretransportedfrom
the originator (another mobile device, a web site an email client, or a VASP), sent to the SMSC within the
destinationsubscribersnetwork,throughtheMSCandcelltowerthatispresentlyservingthesubscribersmobile
device,anddeliveredtothedestinationmobiledevice. ThesemobileterminatedSMSmessagesmayoriginate
frommobileuser, from fixednetworksubscriber (e.g., Internetoremail),or fromothersourcessuchasVASPs.
VASPswhichprovidethecontentmaysubmit theSMSmessage to thewirelessoperator'sSMSCusingaTCP/IP
protocolsuchastheShortMessagePeertoPeer(SMPP)protocolortheExternalMachineInterface(EMI).
-
8/6/2019 SMS to 911 White Paper Final October 2010
17/76
4GAmericasOctober2010 17
Figure4:NetworkInterconnectionArchitecture
MobiletoMobileSMSmessagesaresenttothedestinationmobiledevices10digitphonenumber,e.g.555555
5555.However,itmaybedifficultforasubscribertoremember10digitphonenumbersforvalueaddedservices
orothernonmobiledestinations. Tohelpwiththis,shortcodeshavebeendeveloped.TheseallowaVASPto
obtainashortcode fromthewirelessoperator,andsubscriberssend textstothatnumber insteadofa10digit
phone number. When a mobile subscriber originates the SMS message and uses a short code, it is sent to the
SMSC, and the SMSC identifies the Short Code as a special or premium service. The SMSC will then direct the
contentofthetextmessagetotheVASPorotherserviceindicatedbytheshortcode,typicallyusinganIPprotocol
suchasSMPPorEMI.
Thestandardlengthsforinteroperableshortcodesarefiveandsixdigits.Wirelessoperatorsuseshortcodeswith
fewerdigitsforcarrierspecificprograms e.g.,Text611toseehowmanyminutesyouhaveremainingonyour
plan. Codes starting with 1 are not permitted. Common short codes in the U.S. are administered by NeuStar,
underanarrangementwithCommonShortCodeAdministration CTIA8.
Some wireless operators allow nonsubscribers the ability send SMS messages to a subscriber's mobile device
usingwhatisknownasanEmailtoSMSgateway,ormayprovidethecapabilitytosendtheSMSmessagefromthe
8Seehttp://www.usshortcodes.com/csc_press053106.html
-
8/6/2019 SMS to 911 White Paper Final October 2010
18/76
4GAmericasOctober2010 18
wireless operators website. Many third party websites also offer the capability to send SMS messages to any
subscriberthroughtheseinterfaces;examplesofsuchservicesarenews,weather,andalertinformationsources.
Forexample,an AT&T subscriber whosephonenumber is5555555555 may receiveanSMS message on their
mobiledevicewhenthesenderinitiatesanemailto5555555555@txt.att.net;thiscanbedonefromanysourcefor
generatinganemail. TheAT&TsubscriberscanthenreplytothisSMSmessageandtheSMSreplyissentbackto
the
original
email
address
of
the
sender.
2.2.3 SMS MISCONCEPTIONS
ThefollowingaresomeofthecommonSMSmisconceptionsthathopefullywillbeclearedinthispaper:
Misconception#1Cellularnetworksconstantlykeeptrackofthelocationofmobiledevices
FALSEAllthatisknowniswhichMSCandwhichpagingareatotry
Misconception#2SMSoperatesoveraseparatenetwork
FALSE
The
radio
resources
are
the
same,
the
backhaul
is
the
same,
and
the
signaling
network
is
the
same
Misconception#3SMSisareliable,realtimeservice
FALSESMSisastore&forward(nonrealtime)besteffortservice
Misconception#4SMSisatwowaysessionbasedservice
FALSESMSisnotsessionbased,andisaonewaypointtopointservice
Misconception#5SMScanprovide911locationaccuracy
FALSESMScannotprovide the locationaccuracyofa911call because themobile ison thecontrol
channelforashortperiodoftime(networkbasedTDOArequiresupto30secondsofmeasurementsona
trafficchanneltogetrequiredaccuracy).
NotealsothatwhilesomemobiledeviceshavebuiltinGPSorAssistedGPSwherethenetworkassiststhe
mobiledeviceinfindingsatellitesignalsthatareweak(suchas indoors),theGPSisnotactivelytracking
themobiledeviceandlocatingthemobiledevicecanstilltakeupto30seconds.
Misconception #6 A cellular network can handle every subscriber that wants to make a call or send a text
messagesimultaneously.
FALSEThecapacityofthecellularnetworkislimitedbymanyfactorsincludingthespectrumavailable.
Networks are engineered to handle expected traffic loads at the busiest time of the day, and are
physicallynotabletosupporteverysubscribersimultaneously.
-
8/6/2019 SMS to 911 White Paper Final October 2010
19/76
4GAmericasOctober2010 19
2.3 HOWSMS WORKS
Aspreviouslydiscussed,therearetwotypesofpointtopointSMSservice:MobileOriginatedShortMessage(MO
SM) service and MobileTerminatedSM (MTSM) service. The architecture and message flow for each are
highlightedbelow.
Figure5:BasicSMSServices
AMOSMissentbyasubscriberfromthemobiledeviceandtransportedacrossthecellularnetworktoanSMSC.
InaMOSMSscenario,theoriginator(Brian)hasamessagetosend(HiAliceIllmeetyouatStarbucks).Brian
opens the SMS application on his mobile device, types in the message, and sends the message. Once Brians
mobile device gains access to the control channel on the cell tower serving it, the mobile device notifies the
network he has a message to send, and the MSC authorizes the ability for Brians mobile device to send the
message.BriansmessageisthensentasanSMSmessageoverthecontrolchannelbeingusedonthecelltower
and on to the MSC. The MSC then forwards Brians SMS message to the SMSC; the address of the SMSC is
provisioned inBriansmobiledeviceSubscriber IdentityModule (SIM)and thatSMSC is located inBrianshome
wirelessoperatorsnetwork, regardlessofwhatnetworkmaybeservingBrianat thepresenttime. IfBrianwas
roamingintoanotherwirelessoperatornetworkoutsidehishomewirelessoperatorsnetwork,thentheMOtext
messageisroutedtoBrianshomewirelessoperatorsSMSC,nomatterwhereintheworldthatSMSCislocated.
TheSMSChasnoknowledgeofBrianslocationotherthentheidentityoftheparticularMSCitreceivedtheSMS
messagefrom(andsinceeachMSCservesmanycelltowersoverawidegeographicarea,anMSCprovidesnoreal
geographiclocationofthesubscriber). TheSMSCacknowledgestotheMSCthatitreceivedtheSMSmessage,and
itisnowuptotheSMSCtofigureoutwhoandwhereAliceisandhowtoforwardthatSMSmessageontoher.
-
8/6/2019 SMS to 911 White Paper Final October 2010
20/76
4GAmericasOctober2010 20
BrianisonlyawarethattheSMSmessagemayhavelefthismobiledevice,andhasnoindicationofwhereitisor
whatthestatusofthedeliveryis.
Figure6:MobileOriginatedSMS
HowdoesBrianinformthenetworkIhaveamessagetosend? Tounderstandthis,itisimportanttounderstand
thethreebasictypesofchannelsinacellularsystemthecontrolchannel,thetrafficchannel,andthedata
channel.ControlChannels (CCH)areused forsignalingbetweencelltowerbasestationsandmobiledevices.
ControlchannelsareusedtodeliverSMSmessageswhenthemobiledeviceisnotengagedinaphonecall.Traffic
Channelsareusedtodelivervoicetraffictothemobiledevice,anddatachannelsareusedtodeliverdatatothe
mobiledevice.Awirelessoperatorneedstoengineerthelimitednumberofchannelsithasavailable(spectrum).
Each wireless operator is allocated a portion of the total frequency band. There is not enough spectrum
(channels)availabletoalloweveryonewhohasamobiledevicetomakeavoicecallorsendatextmessageallat
once.Thewirelessoperatorsengineering isbasedonbusyhournetworkplanning,andthewirelessoperator
deploys transmitters and receivers in the available frequency band into each cell site, and divides these into
control,trafficanddatachannels,asillustratedbelow:
-
8/6/2019 SMS to 911 White Paper Final October 2010
21/76
4GAmericasOctober2010 21
Figure7:ExampleChannelConfiguration
Anidlemobiledeviceismonitoringcontrolchannelsfromthecelltowerwaitingforphonecalls,SMSmessages,or
other system activity. When Brian makes or receives a call, the mobile device is switched over to a traffic
channel;ifengagedinadatasession,themobiledeviceisonadatachannel.WhenBriantypesinamessageand
hits send, the MOSMS sends the data on the control channel, effectively holding the channel for up to 45
seconds (asopposedtoavoicecallthatholdsatrafficchannel forseveralminutesormore).Thisshorthold
time of the control channel when sending an MOSMS is why there is a greater chance of getting a MOSMS
throughinacongestednetwork,butthisisnotguaranteed!
BriansmobiledevicemayalsosendorreceiveanSMSwhileonatrafficchannelthroughwhatisknownasan
associatedcontrolchannelthatexistsonthetrafficchannelifthenetworkandhandsetsupportit.
Figure8:MobileDeviceChannels
-
8/6/2019 SMS to 911 White Paper Final October 2010
22/76
4GAmericasOctober2010 22
On3GUMTSnetworks,servicesareassignedaQualityofService(QoS)classesforfourtypesoftraffic:
Conversationalclass(voice,videotelephony,videogaming) Streamingclass(multimedia,videoondemand,webcast) Interactiveclass(webbrowsing,networkgaming,databaseaccess) Backgroundclass(email,SMS,downloading)
SMSissentinthebackgroundclassasitislowpriority,nonrealtimetraffic.
Sointhescenario,howdoweknowwhereAliceis?Alicecouldbeasubscriberofanywirelessoperator,roaming
onanynetworkintheworld,orcanbeafixednetworkemailaccount,oraVASP.
Figure9:WheresDestinationMobileDevice?
Forthisscenario,assumeAliceisusinganothermobiledevice.Inthiscase,thedeliveryofBriansmessagetoAlice
willbeaMTSMthatistransportedfromanSMSC,acrossthecellularnetwork,anddeliveredtoamobiledeviceso
thatitcanbeviewedbyasubscriber.
But how do we find Alice? The simplest case is when both Brian and Alice have the same wireless network
operator;inthiscase,BriansSMSCalsoknowsaboutAlice,andcanbegintofindAlicedirectly.TheSMSCinthis
casewillqueryanothernetworkentityknownastheHomeLocationRegisterorHLR,andaskessentiallyWhere
isAlice?IfAlicesmobiledevicewasonthenetworkrecently,theMSCservingAlicewillhavenotifiedtheHLRof
Aliceswhereabouts(downtotheMSClevel).TheHLRcanthenreportbacktotheSMSCthatAlicelastcheckedin
on MSC xyz. The SMSC will then forward Brians SMS message to MSC xyz and ask it to deliver Brians SMS
messagetoAlice,whoisbelievedtobeonacellsitewithinMSCxyzscontrol,andtheMTSMSprocesswillbegin.
-
8/6/2019 SMS to 911 White Paper Final October 2010
23/76
4GAmericasOctober2010 23
Figure10:FindDestinationMobileDevice
IfAliceandBrianarenotservedbythesamewirelessnetworkoperator,findingAlicebecomesmorecomplicated.
Inthiscase,BriansSMSChasnoknowledgeofAliceotherthenAlicedoesnotreceiveservicebythesamewireless
network operatorasBrian. BriansSMSC passeshisSMSmessage off toanother entity known as the Gateway
SMSC,
or
G
SMSC.
The
G
SMSC
can
determine
from
Alices
phone
number
which
wireless
network
operator
providesservicetoAlice,andforwardsBriansSMSmessagetotheGatewayMSC(GMSC)ofthewirelessnetwork
operator providing Alices service. The GSMSC in Alices home network forwards Brians SMS message to the
SMSCservingAlice.AlicesSMSCthengoesthroughthequeryoftheHLRtoidentifytheMSCwhereAlicewaslast
reported.
-
8/6/2019 SMS to 911 White Paper Final October 2010
24/76
4GAmericasOctober2010 24
Figure11:FindDestinationMobileDeviceAlternative#2
IfAlice(thedestinationoftheMOSMS)isnotanothermobiledevice,butashortcode,thedestinationaddress
shortcodeistranslatedinthehomewirelessoperatorsSMSCtoanaddresswheretheSMSmessageisroutedfor
handlingtheservice.Thus,ifAlicesSMSCdoesnotunderstandtheshortcodeusedintheroamedintoarea,the
SMSmessagemaygetlostsinceAlicesSMSCwillnotknowwheretorouteit. Orworseifthereistheshortcode
usedforanotherservicebyAliceshomenetwork,theSMSmessagewillgetroutedtothewrongdestination.This
isan importantpoint ifashortcode isproposed foruse forSMS to911; theremustbeconsistencyacrossall
wirelessoperatorsandnetworksorconfusionandpotentialmisroutingofSMSmessageswillbetheresult.
WhenanSMSisdeliveredtoamobiledevice,itusestheMTSMSprocess.TodemonstratetheMTSMSprocess,
assume Alice desires to send the message Ill meet you at 3 pm at Starbucks to Brian using the previously
describedMOSMSprocess. TheSMSmessagewillarriveatBriansSMSCaspreviouslydescribed.BriansSMSC
mustnowfindoutifBrianisavailableonthenetwork,andifso,where?BriansSMSCsendsasignalingmessageto
BriansHLRaskingWhere isBrian? IfBrianwasrecentlyonthenetwork,theHLRknowswhichMSCBrian last
reportedfrom.ThatMSCnumber,MSC1234inthiscase,isreportedbacktotheSMSC.TheSMSCthenforwards
theSMSmessagetotheindicatedMSC,indicatingthattheSMSmessageisdestinedforBrian.However,asingle
MSCtypicallyhascontrolofalargenumberofcelltowerswithinalargegeographicarea.WhichcelltowerisBrian
currentlyon,especiallysinceinamobileenvironmenthecouldbemovingfromtowertotower?Thisisthesame
problemasifavoicecallwastobedeliveredtoBrianhecouldbeononeofanumberofcelltowersinthearea.
-
8/6/2019 SMS to 911 White Paper Final October 2010
25/76
4GAmericasOctober2010 25
Figure12:FindingMobileDeviceforMobileTerminatedSMS
Themethodusedto locatetheparticularcelltowerBrian is locatedon isthroughaprocessknownaspaging.
ThisprocessisthesamewhethertheMSCisdeliveringaphonecalltoBrian,ordeliveringanSMSmessage.Thisis
akeypointthesamenetworkandradioresourcesareusedinthisprocessregardlessofwhetherthisisaphone
callorSMSdelivery;however,thepagingprocessisprioritizedsovoicecallsareprocessedfirst.Inanetworkunder
hightraffic loads,SMSmessageswillbedelayedbydesign.Also,therearea limitednumberofpagingchannels
available,basedonnetworkengineeringof theavailablespectrum.Duringextremebusyhourconditions, there
maynotbeenoughpagingchannelstohandleboththevoicetrafficandtheSMStraffic. Inthisevent,callsand
SMSmessagesarenotdeliveredandtheSMSmessagesarestoredintheSMSCforlaterretry.
MSC1234sendsamessageoutonanumberofcelltowerstofindBrian;thisisapagemessage.Thispaging
processstartsinitiallyatagroupofcelltowersinBrianslastknownlocationarea,andifBriandoesnotanswer,
the MSC sends out the page to larger areas until either Brian is found, or the MSC assumes Brian is no longer
availableandgivesup.IfBriansdevicehearsthepage,hisdeviceessentiallyreturnsaHereIam!messageto
theMSC.TheMSCnowknowswhichcelltowerBrianison.
Once
Brians
mobile
device
is
located
on
a
particular
cell
tower,
the
MT
SM
message
is
delivered
to
the
mobile
device.There isaphysical limitonthe rateatwhichMTSMSmessagescanbedeliveredonthe radiochannels
availableatypicalruleofthumbrateatwhichtheactualMTSMSmessagemaybedeliveredis2SMSmessages
persecondpersector. IftherearealargenumberofSMSmessagesgoingtosubscribersonasingletower/sector,
SMSmessageswillbebackedupandprocessedinorderuntiltheyaredelivered.
-
8/6/2019 SMS to 911 White Paper Final October 2010
26/76
4GAmericasOctober2010 26
IfBriansmobiledeviceacknowledgestheSMSmessagewasreceived,theMSCacknowledgestoBriansSMSCthat
theSMSmessagewasdeliveredandtheSMSCdoesnothavetoworryaboutretryingtodelivertheSMSmessage
later.
Figure13:DeliveryofMobileTerminatedSMS
NotethatnoacknowledgmentissentbacktoAlicesoAlicehasnoindicationthatBrianreceivedtheSMSmessage.
WhathappensifBriansdevicecannotbefound?Briansdevicemaynotrespondtothepagebecauseofanumber
ofreasonsincluding:
Heisinapoorradiocoveragearea Hemovedoutsidethepagingarea Heturnedoffhismobiledevice Thecellsiteiscongestedwithvoicecallpages
IfBriansmobiledevicedoesnotrespondtothepage,anindicationissenttotheSMSCthattheSMSmessagewas
notdeliveredandisstoredforlaterretryrecallbydesignSMSisastore&forwardsystem.Theretryperiodis
variableanddependsonnetworkconfiguration,andeachretrygoesthroughthesamepagingprocess.IfBrians
mobiledevicecannotbefoundafterseveralretries,thentheSMSCgivesup,storestheSMSmessage,andasksthe
HLRtoinformitwhenBriansmobiledeviceisavailableonthenetwork.Afteraperiodoftime,theSMSCmaygive
upentirelyanddeletetheSMSmessagefromitqueue.Alicehasnoindicationthatthishashappened.
-
8/6/2019 SMS to 911 White Paper Final October 2010
27/76
4GAmericasOctober2010 27
AnSMSCisabletosendonlyoneMTSMtoasubscriberaddressatatime.Themobiledeviceisabletoreceiveone
MTSMandsendoneMOSMatatime.
ThefollowingsectionsdescribetheSMSsignalingflowinmoredetail.
2.3.1
MOBILE
ORIGINATED
SM S
GSM/PLMN
network
MO-SM MT-SM
SME application
SMSC
Figure14:SMSSystemDiagram
A subscriber can originate a short message to another subscriber even when the recipients mobile device is
switchedofforisnotreachable.ThesenderisnotsentanacknowledgmentwhentheSMarrivesattherecipient.
TheSM issent independentlyofthevoiceservice.SMscanbesentandreceivedduringvoicecalls,but ittakes
moretime.
-
8/6/2019 SMS to 911 White Paper Final October 2010
28/76
4GAmericasOctober2010 28
ThefollowingfiguredepictstheflowofanMOSMcase:
MSCMO-ForwardSM
3
SMS-IWMSC
1
VLR
2
4
SMSC
MT-SM
5
6
Figure15:MobileOriginatedShortMessageService
1. ThemobiledevicesendsanSMviathecontrolsignalingchannelontheradiointerface;theSMincludestheaddressoftheSMEwheretheSMSCeventuallyattemptstoforwardtheSM.
2. TheservingMSCchecksthedataofsubscriberfromtheVLR.3. TheMSCroutestheSMtoSMSIWMSC(InterworkingMSC).4. TheSMisroutedviaaspecialOSIorTCP/IPapplicationtotheSMSC.5. SMSCstorestheSMandtriesMTSMwhentherecipientterminalisconnected.6. MTSMprovidesSMSCthedeliveryreporttoSMSCforanyretransmissionifneeded.
-
8/6/2019 SMS to 911 White Paper Final October 2010
29/76
4GAmericasOctober2010 29
2.3.2 MOBILETERMINATED SMS
ThefollowingfiguredepictsaMTSMcase:
MSC
MT-ForwardSM
4SMS-GMSC
2
HLR
3
6
SMSC
7
9
5
VLR
8
MO-SM
1
Figure16:MobileTerminatedShortMessageService
TheSMSCreceivestheshortmessageovertheMOSMservice,storestheSMSmessage,andforwards ittothe
recipientovertheMTSMservice.
Themessageflowisdepictedasbelow:
1. MOSMsendstheSMtotheSMSC.2. TheSMSCsendstheSMtotheSMSGMSC.3. TheSMSGMSCrequeststheVMSCorSGSNaddressfromtheHLR.4. TheSMSGMSCroutestheSMtotheVMSC/SGSN.5. TheVMSCaskstheVLRforthestatusandlocationareaoftheMSoftherecipient.6. If the recipient is in idle mode, the VMSC starts paging and delivers the SM to it through the control
signalingchannelofthebasestation.Iftherecipientisinbusymode,theVMSCsendstheSMthroughthe
controlchannel.TherecipientsendsadeliveryreporttotheVMSCafterreceivingtheSM.
-
8/6/2019 SMS to 911 White Paper Final October 2010
30/76
4GAmericasOctober2010 30
7. The VMSC sends the delivery report to the SMSGMSC using global title analysis to find the routingaddressoftheSMSC.
8. Ifneeded,theSMSGMSCsendsthedeliveryreporttotheHLR.9. TheSMSGMSCsendsthedeliveryreporttotheSMSCeitherconfirmingthattheMShasreceivedtheSM
orinformingtheSMSCthecausewhythedeliveryfailed.
No delivery acknowledgement is supported from the SMSC towards the SM sender since there is no signaling
mechanismavailablefromtheMOSM.
2.3.3 SMS VI A EMAIL ORWE B CLIENTS
SMSmessagesmayalsobeinitiatedfromanemailclient,suchasMicrosoftOutlook,orfromawebpage.Email
initiated SMS uses a protocol called SMTP9 (Simple Mail Transfer Protocol), which can deliver emails as text
messages via SMTP gateways at the entry point into the wireless operators network. SMTP is a standard for
supportingemailacrossIPnetworks,forexample,theInternet. SMTPgatewayswereneverintendedtosupport
urgentortimecriticalmessagingandarenotcapableofdeliveringthelevelofreliabilityandperformancesuited
tonotificationservices.ThereisnoformalrelationshipbetweenthesenderoftheSMSmessageandthewireless
operatorwhenSMSmessagesaresenttotheSMTPGateway.
TherearealsoaddonsforemailprogramssuchasMicrosoftOutlookthatfacilitatethesendingandreceivingof
SMSmessagesdirectlyfromtheemailclient,aswellaswebclientsthatallowsendingandreceivingSMSmessages
usingawebbrowser. InstantMessagingapplicationssuchasWindowsLiveMessengerandYahoo!Messenger
alsosupporttheabilitytosendandreceiveSMSmessages.
Figure17:SMSviaEmail
9SeeIETFRFC5321, http://tools.ietf.org/html/rfc5321
-
8/6/2019 SMS to 911 White Paper Final October 2010
31/76
4GAmericasOctober2010 31
ToinitiateanemailtoSMS,thesenderconstructsanemailmessagewithanaddressconstructedfromthe10digit
phone number and the domain name for the email gateway of the wireless operator. The domain names are
publishedbythewirelessoperatorsandarereadilyavailableontheInternet.AnexampleofanaddresstoanAT&T
mobiledeviceis5555555555@txt.att.net.EmailtoSMScanalsobeusedtosendSMSmessagesinternationally.
Asdescribed later,SPAM isa hugeconcern forwireless operators.SMTPmessaginggatewaysare the targetof
millions of SPAM messages each day. A significant percentage of SMS requests via email are SPAM. Wireless
operatorsareaggressivelymanagingthisproblemthroughsophisticatedSPAMdetection&filtering.Sincethereis
no formalrelationshipbetweentheSMSmessagesenderandthewirelessoperator,SMSmessagessentviathe
SMTPGatewaymaybepronetofiltering,especiallyiftheyappeartobeSPAM.
Figure
18:
SMS
SPAM
via
Email
2.3.4 SMS AGGREGATORS
Typically,SMScontentprovidersdonotconnecttoawirelessoperatornetworkdirectly,andanSMTPGateway
haschallengesespeciallyifthecontentprovidersmessagehasthecharacteristicsofSPAM.AnothertypeofSMS
gateway is known as an SMS broker or aggregator. An SMS aggregator provides connectivity with wireless
operatorsbyofferingagatewaytobothsendandreceivemessagesandothermultimediaordigitalcontent. The
aggregator model is based on business agreements between SMS content providers, the aggregator, and the
wirelessoperator.Anaggregatorisabusinessentitythatnegotiatesagreementswithwirelessoperatorsandacts
asamiddlemanprovidingaccesstoacellularnetworkforthirdpartieswhohavenodirectrelationshipwiththe
wirelessoperator10
.AnSMSaggregatorhasdirectconnectionstomostwirelessoperatorstodelivertextmessages
throughtheirgateways.Suchgatewaysarenecessarybecause it isvirtually impossibletoconnectdirectlytothe
wirelessoperatorsasasinglecompany.Anaggregatorcanenablethesendingofbulktrafficandmayalsomanage
therentalofshortcodestothecontentproviders.
10SeeJeffBrown,BillShipman,RonVetter,"SMS:TheShortMessageService,"Computer,vol.40,no.12,pp.106
110,Dec.2007,doi:10.1109/MC.2007.440
-
8/6/2019 SMS to 911 White Paper Final October 2010
32/76
4GAmericasOctober2010 32
Figure19:SMSAggregatorNetworkArchitecture11
2.4 MULTIMEDIA MESSAGING
TheMultimediaMessagingService(MMS)wasdevelopedby3GPPandismaintainedbytheOpenMobileAlliance
(OMA). MMSsupportssendingmessagesthatincludemultimediacontent(text,audio,video,pictures,etc.)toand
frommobiledevicesthatsupportthefeature.MMSisasubscriptionserviceandisfunctionallydifferentthanthe
SMSservice.Technically,multimediamessagesaredelivered inacompletelydifferentway thanSMSmessages.
(MMS is closer conceptually to email than to SMS.) However, MMS uses both SMS and the data network for
deliveryofthemessage.NoteverymobiledeviceorsubscriptionsupportsMMS.
11SeeJeffBrown,BillShipman,RonVetter,"SMS:TheShortMessageService,"Computer,vol.40,no.12,pp.106
110,Dec.2007,doi:10.1109/MC.2007.440
-
8/6/2019 SMS to 911 White Paper Final October 2010
33/76
4GAmericasOctober2010 33
Figure20:MultimediaMessagingService
Todeliveramultimediamessage,anSMScontrolmessageissenttothedevicewithaURLtotriggerthedevices
browsertoopenadataconnectionandreceivethemultimediacontent.AdditionalSMSmessagesareexchanged
toreportstatusoftheretrieval.MMSrequiressignificantlymorenetworkresourcesthanSMS.
MMS isanonrealtimedeliverysystem(as isSMS).Primeexamplesofnonrealtimemessagingservices include
traditionalemailavailableontheInternetandwirelessmessagingsystemssuchaspagingormessaging.
MMS does not support location determination or routing to the correct PSAP based on the sender's current
location.
Multimedia Messaging (MMS) offer no solutions to the limitations of SMS to 911. Other subsequent text
messagingproducts,suchasMMS,mayactuallyuseSMStechnologyaspartofthedeliveryofthemessage.Thus,
alloftheexistingtechnicalshortcomingswithSMSto911willalsoexistwiththesemessagingmethodsaswell.
MMSalsointroducesanumberofchallengesbeyondthosewithSMS12
:
Contentadaptation: Multimedia content created by one mobile device may be incompatible with therecipientsmobiledevice.IntheMMSarchitecture,therecipientsMultimediaMessagingServiceCenter
(MMSC)isresponsibleforprovidingcontentadaptation(e.g.,imageresizing,audiocodectranscoding),if
this feature is enabled by the wireless network operator. When content adaptation is supported by a
wirelessnetworkoperator,itsMMSsubscribersenjoycompatibilitywithalargernetworkofMMSusers
thanwouldotherwisebeavailable.
12Seehttp://en.wikipedia.org/wiki/Multimedia_Messaging_Service
-
8/6/2019 SMS to 911 White Paper Final October 2010
34/76
4GAmericasOctober2010 34
Bulkmessaging:TheflowofpeertopeerMMSmessaginginvolvesseveralovertheairtransactionsthatbecomeinefficientwhenMMSisusedtosendmessagestoalargenumbersofsubscribers,asistypically
thecaseforVASPs.
MobileDeviceConfiguration:UnlikeSMS,MMS requiresanumberofmobiledeviceparameters tobeset.Poormobiledeviceconfigurationisoftenblamedasthefirstpointoffailureformanyusers.Service
settingsare sometimes preconfigured on the mobile device,but wireless operators are now lookingat
newdevicemanagement technologiesasameansofdelivering thenecessarysettings fordataservices
(MMS,WAP,etc.)viaovertheairprogramming(OTA).
2.5 MOBILE INSTANT MESSAGING
Instantmessaging(IM)isaformofrealtimedirecttextbasedcommunicationsbetweentwoormorepeopleusing
personal computers or other devices, along with shared software clients. The text is conveyed over a network,
suchastheInternet.Moreadvancedinstantmessagingclientsalsoallowothermodesofcommunications,suchas
live voice or video calling. There are numerous IM clients available, and many have proprietary, incompatible
protocols.Therehavebeenseveralattemptstocreateaunifiedstandardforinstantmessaging:IETF'sSIP(Session
InitiationProtocol)andSIMPLE(SIPforInstantMessagingandPresenceLeveragingExtensions),APEX(Application
Exchange), PRIM (Presence and Instant Messaging Protocol), the open XMLbased XMPP (Extensible Messaging
andPresenceProtocol),andOMA's(OpenMobileAlliance)IMPS(InstantMessagingandPresenceService)created
specificallyformobiledevices.
MostattemptsatcreatingaunifiedstandardforthemajorIMprovidershavefailed,andeachcontinuestouseits
ownproprietaryprotocol.ForthisreasonusershavetoeitherusethesameIMclients,oruseaclientthatsupports
multipleprotocols,ortheIMserverneedstodotheprotocolconversion.
Inamobileenvironment,IMisconstrainedbybandwidthandtheformfactor/userinterfaceofthemobiledevice.
Mobile IM (MIM) allows connection to an IM application via the mobile device. There are two distinct
methodologiestoenablemobileinstantmessaging:
Embedded Clients tailored IM client for every specific mobile device with a special backend serverinstalledwithinthewirelessoperatornetwork.
ClientlessPlatform a browser based application which enables users to connect to their Internet IMservicewithouttheneedforanysupportbythewirelessoperator.
MIMmayuseSMSorthedatanetworktoprovideconnectivitytotheIMserver.SMSmaybeusedasabearerfor
MIM.Forexample,IMapplicationssuchasYahoo!MessengerofferaclientbasedonSMS13
. However,SMSdoes
notincludealiascapabilitiesnordoesitallowforconfirmationthattheintendedrecipientisavailable.SMSmakes
itimpossiblefortherecipienttoreceivetheMIMmessageinrealtimebecauseSMSistransactionbasedandnot
sessionbased. MIMdoesnotfixthe limitationsandvulnerabilitiesoftheunderlyingSMStransport (ifSMS is
usedforthetransport).
3GPPhasdefinedspecificationsthatenableinterworkingbetweenSMSandIM(atbothservicelevelandtransport
level).Inaddition,OMAhasdefinedtheInstantMessagingandPresenceService(IMPS)14
,whichisanOMAenabler
13Seehttp://mobile.yahoo.com/messenger/sms
14SeeIMPSArchitecture,OMAADIMPSV1_320070123A,OpenMobileAlliance
-
8/6/2019 SMS to 911 White Paper Final October 2010
35/76
4GAmericasOctober2010 35
thatisdesignedforexchanginginstantmessagesandpresenceinformationnotonlybetweenmobiledevicesbut
alsobetweenmobileandfixeddevices.ThefollowingfigureshowstheIMPSarchitecture:
Figure21:OMAIMPSArchitecture
AclientlessplatformMIMallowsthecommunityofuserstoregistertheirpresence,allowingformorerealtime
text messaging and communications than would be possible with traditional mobile messaging. Mobile IM
providespresencetotheIMserverwhichestablishesanIMsession.MIMwithanalwaysondataconnection
willprovidetheuserwithamorerealtime IMexperiencesimilartothe IMexperiencefromacomputeronthe
Internet. However, since this is a clientless platform, the basic wireless operator provided services (location,
routing,etc.)arenotavailablefortheIMsession.
ThereareIPrelayservicesoffered15
thatallowuserstocontactemergencyservicesviaIMthrougharelayservice.
Usersselect911fromtheirIMcontactlist,andopenasessionwiththerelayservice.Usershavetoprovidetheir
locationtotherelayservicethroughtheIMsessionsotherelayserviceknowswhichPSAPtocontact.
Crackers (malicious "hacker" or black hat hacker) have consistently used IM networks as ways for delivering
phishing attempts, "poison URLs", and virusladen file attachments. Hackers use two methods of delivering
maliciouscodethrough IM:deliveryofviruses,Trojanhorses,orspywarewithinan infected file,andtheuseof
"sociallyengineered"textwithawebaddressthatenticestherecipienttoclickonaURLconnectinghimorherto
a website that then downloads malicious code. Viruses, computer worms, and Trojans typically propagate by
15Seehttp://www.iprelay.com/im/
-
8/6/2019 SMS to 911 White Paper Final October 2010
36/76
4GAmericasOctober2010 36
sendingthemselvesrapidlythroughtheinfecteduser'sbuddylist. Infectionsmayrangefromnuisancetocriminal,
andarebecomingmoresophisticatedeachyear.Considerationoftheseattacksmustbemadeforanyuseof IM
foremergencyservices.
IMconnectionsusuallytakeplace inplaintext,makingthemsusceptibletoeavesdropping.Inaddition, IMclient
softwareoftenrequirestheusertoexposeopenUDPportstotheworld,increasingthethreatposedbypotential
securityvulnerabilities.
2.6 SMS OVER GENERIC IP CONNECTIVITY ACCESS NETWORK (IPCAN)
3GPPhas defined theability to supportSMSoverageneric IP connectivityaccess network (IPCAN)16
. SMSvia
IPCAN requires a mobile device which supports IP Multimedia Subsystem (IMS) data services, and a wireless
operatornetworksupportingbothanIMSaswellasanIPSMSGateway. Thesearefuturecapabilitiesandarenot
availableinnetworksdeployedtoday.
ThereferencearchitectureforprovidingSMSviaIPCANisasshownbelow:
Figure22:SMSviaIPCAN
16See3GPPTS23.204,http://www.3gpp.org/ftp/Specs/htmlinfo/23204.htm
-
8/6/2019 SMS to 911 White Paper Final October 2010
37/76
4GAmericasOctober2010 37
Thebasicprinciple isthatSMS flowsthroughthetraditionalSMSCandaGatewayor InterworkingMSCtoan IP
Short Message Gateway. From there, the SMS message is delivered to the mobile device via IP through the IP
MultimediaSubsystem (IMS).Note that this isahybridarchitecture, where the legacySMSC isstillusedas the
storeandforwardentity.Thus,thecharacteristicsofSMSwhenusingSMSviaIPCANarethesameasusingSMS
onthelegacycircuitswitchednetwork.
The IPShortMessageGatewayhasanadditionalfunctiontoprovidethecapabilityforservicelevelinterworking
betweenShortMessagesandInstantMessagesinIMS.Inmanyusertousermessageexchangesystems,message
sendersoftenwishtoknowifthehumanrecipientactuallyreceivedamessageorhasthemessagedisplayed.IETF
IMDN(InstantMessageDispositionNotification) fordeliverynotificationcanbesupportedaspartoftheservice
levelinterworkingwithIM.
2.7 SOCIALNETWORKING
From a technology perspective, social networking applications have similar network impacts as SMS. A Social
NetworkDiagramismadeupofnumerouspointtopointconnections,asindicatedinthefollowingfigure17
:
Figure23:SocialNetworkDiagram
Mostsocialnetworking applications requireadataconnection toaccess theapplication, andmay haveanSMS
componentsimilartoMMS.
17Seehttp://en.wikipedia.org/wiki/Social_network
-
8/6/2019 SMS to 911 White Paper Final October 2010
38/76
4GAmericasOctober2010 38
SomesocialnetworkingapplicationsprovidetheabilitytoreceiveupdatesviaSMS.Forexample,Twitterallowsa
usertoreceiveTweetsthroughSMS,allowsausertopostupdatesviaSMS,andtohavedefinedshortcodesand
textcommandsthatperformspecificfunctionsviaSMS.
Manysocialnetworkingapplicationsareaddinglocationcapabilities.OnspecificmobiledevicessupportingHTML5
andgeolocation,thereisthecapabilitytoTweetwithyourLocationiftheuserauthorizestheapplicationtouse
thelocationfromthemobiledevice.Thelocationmaybeprovidedattheneighborhoodlevel,thetownlevel,oran
exactpoint.FacebookhasrecentlylaunchedFacebookPlacestotheirapplication,againforHTML5andgeo
locationsupportingmobiledevices.Placesallowsausertocheckintoaspecificlocationtoallowtheirfriends
seewheretheyare,andcanalsobeusedtotrackfriends.Theapplicationalsogivestheusertheabilitytoallow
thirdpartyapplicationstoobtainyourlocation(withpermission)totailorservicestoauserslocation.
Someagencies have started looking at incorporating Facebook, Twitter,MySpace, etc. into theiremergency
communications systems. However, these sites are typically used for general information sharing and not for
emergencies18
.MostpoliceagenciesdonotmonitorthesocialnetworkingsitesconstantlyfromtheirPSAPs.Social
networksareincreasinglybecomingthefirstwaypeoplelearnaboutsomethinghappening,andmaybebeneficial
forwordofmouthinformationsharing.
Therearecaseswheresocialnetworksreportedlyplayedaroleincontactingemergencyservices.In2009,Atlanta
councilmanKwanzaHallusedTwitteronhisBlackBerryinanefforttosummonmedicalassistanceatthescene
ofanaccidentbecausehewasconcernedthemobiledevicebatterywastoo lowtoplaceacall19
.HisTweet for
assistancewaspickedupbyseveralofhisfollowers,whocalled911andreportedit.However,itwasnotclearif
theTweetresultedinthemedicdispatchorwasaresultofotherbystandersmakingacallto911.Thisscenario
doesraiseseveralquestions,however:
If the followers are not in the same geographic location, how do they know whom to contact foremergencyservicesonbehalfoftheTweeter?
IftheTweeterdidnotspecifythelocationexactly,willthefollowerknowwhatcitytheemergencyisevenin?Forexample,Kwanza tweetedNeedaparamediconcornerof JohnWesleyDobbsandJacksonSt.
Womanonthegroundunconscious.PlsReTweet.Ifafollowerinanothercityreceivedthisandhewas
unawareitwasfromAtlanta,wouldthatfollowercall911inhiscityandreportit?
IftheTweeterhasalargenumberoffollowers,whatiftheyallcalled911onhis/herbehalf?Wouldthisoverwhelmthe911system?
WhowouldkeeparecordofTweetsforuseininvestigationsand/orlitigation?Whilethesesocialnetworkingtoolsmayseemvaluableforemergencyservices,significantsecurityissuesexist.As
theseapplications incorporate location features,significantsecurityandprivacyconcernsareraised.SMSbased
social
networking
applications
do
not
overcome
the
limitations
of
SMS.
Browser
based
social
networking
applications require an alwaysondata connection, andnewer applications require mobile devices that support
HTML5andgeolocation.
18SeePolice:Use911insteadofTwitter,Facebook,
http://www1.whdh.com/news/articles/local/12001917838482/policeuse911insteadoftwitterfacebook/19
SeeTwitterTrumps911,http://www.wired.com/epicenter/2009/05/twittertrumps911/
-
8/6/2019 SMS to 911 White Paper Final October 2010
39/76
4GAmericasOctober2010 39
2.8 EXAMPLEIMPLICATIONS OF TEXTING SERVICES AND APPLICATIONS
Thissectionprovidestwoexamplesofothertextingservicesandapplicationswhichcouldhaveimplicationsforthe
support of emergency text messages to PSAPs. The first example describes the implications of an existing
smartphonebasedalertingapplication. Thesecondexampledescribesthe implicationsofthevarietyofexisting
FreeSMSandSMSbypassapplicationsandservices.
2.8.1 SMARTPHONE ALERTING APPLICATION
Availability ofa thirdparty emergency alerting application forapopular smartphoneplatform started inMarch
2010. Even though this particular version of an emergency alerting application is targeted for a specific
smartphone, futureversionsofthisapplicationorothersimilarsmartphoneapplicationscouldbedeveloped for
anyothertypeofsmartphone.
Whenthesubscriberinstallsthisemergencyalertingapplicationfortheirsmartphone,theyconfigureitwithphone
numbersforSMSmessagesandemailaddressesforwhomtheywishtonotifyiftheyneedhelp. Inanemergency
situation, this application can be activated without alerting onlookers or the potential attackers. When this
emergency alerting application is activated, it will send SMS and/or email messages to the configured list of
contactsapproximatelyevery60secondsuntildeactivatedbythesubscriber. Theemergencyalertmessagethatis
sent every 60 seconds identifies the subscriber indicates that they are having an emergency, and provides
approximatelocationinformationintheformofaURLtoGoogleMaps.
Thisemergencyalertingapplicationhasbeen receivingnumerousravereviewsonvarious Internetblogs,online
userjournals,andonlinenewspaperarticles.Thisapplicationhasalsoreceivedseveralendorsements. Allofthese
reviewsandendorsementsareencouragingsubscriberstoacquireandinstallthisapplication.
At this time, this application does not send these emergency alert messages to PSAPs because SMS or email
interfacestodosocurrentlydonotexist. IfaPSAPdefinesanSMSoremailaddresswherebycitizenscansend
messages,thereisnothingtorestricttheuseofthisapplicationforsendingmessagestothataddress.
Forthepurposeofthisanalysis,thefollowingassumptionswillbeapplied:
a. Theenvironmentisthecampusofalargeuniversity(e.g.,20,000students).
b. AmechanismhasbeendefinedforthestudentstosendSMSemergencymessagestothePSAPsupporting
thatuniversity,suchasaspecificshortcode.
c. Smartphonesareverypopularwithcollegestudentsand,therefore,alargenumberofuniversitystudents
have smartphones with the emergency alerting application installed and configured. For example, the
universitymightgivetheemergencyalertingapplicationtothestudentsforfreewiththeSMSaddressfor
theuniversityPSAPpreconfigured.
d. Threewirelessoperatorsprovidewirelesscoveragefortheuniversitycampuswitheachwirelessoperator
coveringthecampuswith5sectorseach.
An emergency situation such as a campus shooting occurs on the university campus. Hundreds and potentially
thousands of students activate the emergency alerting application on their smartphones. Assume that mobile
originated SMS messages are processed by each of the three networks at the rate of 2 mobile originated SMS
messages per second per sector. Based upon the coverage assumption, the wireless networks covering the
universitycampushaveamaximumcapacityof30mobileoriginatedSMSmessagespersecond. Withthe large
-
8/6/2019 SMS to 911 White Paper Final October 2010
40/76
4GAmericasOctober2010 40
number of activations of the emergency alerting application on the students mobile devices, the wireless
networks covering the university campus will reach this maximum capacity very quickly. Due to the 60 second
retransmissioncapabilityoftheemergencyalertingapplication,thewirelessnetworkswillremainatthismaximum
leveluntiltheapplicationisdeactivatedonthesmartphonesbythestudents. Asdescribedabove,SMSdoesnot
have the kind of smart retransmission backoff included in protocols such as TCP, which could avoid each
application
making
the
situation
worse.
Based upon the assumption that the PSAP is one of the preconfigured recipients of the SMS based emergency
messagesfromthissmartphoneapplication,thePSAPwillbereceivingtheseemergencyalertmessagesattherate
of30SMSalertmessagespersecondwhichequatestoarateof1,800SMSmessagesperminuteor108,000SMS
messages per hour. The PSAP will continue to receive these alert messages at this rate until the students
deactivatetheemergencyalertingapplicationontheirsmartphones.
Many of these alert messages will be repeated alert messages, but these repeated alert messages may not be
exactduplicatesbecausethestudentmayhavemovedandconsequentlythelocationinformationportionofthe
messagecouldbedifferent.
Also, the alert messages for any other emergency incident that is occurring at the same time would be
intermingledwiththismassivequeueofalertmessagesandcouldbeoverlookedbythePSAPsystemand/orthe
PSAPcalltakers.
Due to movement of the students and due to the propagation characteristics of RF radio coverage, these
emergencyalertmessagesmayalsobesenttoPSAPsthatareservingthesurroundingneighborhoods.
2.8.2 FREESMS AND SMSBYPASSAPPLICATIONS AN D SERVICES
Thereareasignificantnumberofapplicationsandservicesavailabletowirelesssubscriberswhichareadvertised
asFreeSMSorSMSBypassservices. Thesearewebbasedandsmartphoneapplicationswhichprovidetexting
services without using the messaging capabilitiesof the wirelessoperators network. Theseapplications, when
downloadedtosmartphones,mayevenhavescreensthatlookverysimilartotheembeddedSMSservicesonthe
mobiledevice.
Toget asenseof thenumberand availabilityof these services andapplicationsjustenterFreeSMS orSMS
BypassinyourfavoriteInternetsearchengineorinyourfavoritesmartdeviceappstore.
ThetextingcapabilitiesprovidedbythewirelessoperatorSMSbasedmessagingservicesaredefinedby industry
standardsandarecompletelyseparatefromtheseothertypesoftextmessagingserviceseventhoughtheymay
appearonthesurfacetobethesame.
SincetheseareInternetbasedapplications,thewirelessoperatornetworkhasnoknowledgeorcontrolofthese
thirdpartyFreeSMSorSMSBypassdataservicesandapplications. Consequently,aswithSMS,thewireless
operator networks cannot perform the functions such as PSAP determination, PSAP routing, and call back
information.ThesupportoftheseemergencyservicesfunctionsbythesethirdpartyFreeSMSorSMSBypass
dataservicesandapplicationswillbeimpossible.
Someof these thirdpartiesFreeSMSorSMSBypassservicesdonteven requireamobiledevice. SMSlike
messages can be sent via a PC over any network (e.g., WiFi, cable, DSL) and will totally bypass the wireless
networks. However,totheendrecipient,thesethirdpartySMSlikemessagescouldappearasiftheyarecoming
-
8/6/2019 SMS to 911 White Paper Final October 2010
41/76
4GAmericasOctober2010 41
from a mobile device. As a result, PSAPs could be subject to massive amounts of SPAM and Denial of Service
attacksfromwhatappeartobelegitimatemessagescomingfrommobiledevicesonwirelessnetworks.
TheseSMSlike messages from FreeSMSorSMSBypassservicesarecompletelyanonymousandcannotbe
tracedbacktoanoriginatingmobiledeviceorsubscriber.
3. SECURITYASPECTSAND VULNERABILITIES
SMS does not provide any type of authentication or security. Millions of spam SMS messages hit the wireless
operatorsnetworkseveryday,andprotectionsareputintoplacetoprotectthecustomersfromthesemessages.
Therefore, it is very easy to transmit malicious SMS messages either to a 911 center or to a subscriber.
Fraudsters can use this fact tocreatedenial of serviceattacks on 911centers; international trialsof text to
911 functions resulted in very high percentage of fraudulent/hoax messages, including the delivery of
pornographiccontenttothePSAP.Inaddition,virussoftwareandmalwareisnowbeingseendeliveredviaSMS.
Additionally, terrorists or other criminals can send fraudulent SMS messages to 911 call takers produce some
reaction(e.g.,Amheldbymenwithmachinegunsinsidestoreatcornerof5thandMain.Theysaytheyaregoing
tokillme.HELP!).Theresultingfirstresponderreactioncanthenbetargetedformaliciousexploitation.
SMS issubjecttomaliciousattacksthatwouldaffectSMSaccessto911emergencyservices,andwouldcreate
newproblemsforPSAPsandpotentiallyforwirelessnetworks. Theuseofsmartphonesthatcanbeprogrammed
to repeatedly send SMS messages also creates the potential for inadvertent transmission of a large number of
shortmessagesthatcouldfloodaPSAP.
3.1 SMS SPOOFING
SMSSpoofing(alsoknownasBlowbackandJoeJob)occurswhenasendermanipulatesaddressinformation
to impersonate a subscriber and send a short message. It is possible to spoof SMS messages and make them
appeartocome fromotherpeoplesmobiledevices.SenderstransmittingSMSmessages fromonlinecomputer
networks normally spoof their own number in order to properly identify themselves. SMS spoofing can be
conductedatthenationalandinternationallevel.
AnSMSSpoofingattackisoftenfirstdetectedbyanincreaseinthenumberofSMSerrorsencounteredduringa
billrun.Theseerrorsarecausedbythespoofedsubscriberidentities.Wirelessoperatorscanrespondbyblocking
different source addresses in their Gateway MSCs, but fraudsters can change addresses easily to bypass these
measures.Iffraudstersmovetousingsourceaddressesatamajorinterconnectpartner,itmaybecomeunfeasible
toblocktheseaddresses,duetothepotentialimpactonnormalinterconnectservices.
AnexampleofSMSspoofing is thatmessagessent fromGooglearesentwiththeSender IDGoogle.Skype
sendsmessagesfromitsuserswiththemobilenumbertheyregisteredwith.Inthiscase,whenauserattemptsto
replytotheSMSmessage,thelocalsystemmayormaynotallowthereplyingmessagetobesentthroughtothe
spoofed origin. Another example is to send a spoofed SMS message to Twitter. Twitter uses the SMS
originatortoauthenticatetheuser.HoaxMailisusedtospooftheSMSmessageandthereforecouldtrickTwitter
topostthemessageonthevictimsTwitterpage.
IfSMSmessagescouldbesentto911,afraudstercouldusespoofingtoimpersonateavalidsubscriberandsend
amaliciousmessageto911. ManyproblemscouldthenariseforPSAPsandforvalidsubscribersincluding:
-
8/6/2019 SMS to 911 White Paper Final October 2010
42/76
4GAmericasOctober2010 42
InvalidSMSmessagecontentsreceivedbythePSAP;
PSAP responsemessages would be sent to the valid subscriber who did not send the original SMS
message (which could then start a an exchange of SMSmessages between the PSAP and the valid
subscriber);
ThePSAPmaydispatchafirstrespondertoalocationspecifiedintheSMSmessage;
PSAPresourcesdivertedtohandleincidentstriggeredbyspoofedmessages;
PotentiallyblockinglegitimateSMSmessagesatthePSAPtodefendagainstspoofing.
Wireless network resources would be wasted in transporting spoofed SMSmessages to 911. Any tools
employedby awireless serviceprovideror thePSAP todetect andblock spoofing couldblock legitimate SMS
messagesto911.
Thefollowingexamplefromthe3GAmericaswhitepaper,CharacterizingtheLimitationsofThirdPartyEASover
Cellular TextMessaging Services,20
illustrates the issue of distinguishing fraudulentmessages from legitimate
messages.
Figure24:ExampleofForgedEmergencyMessage
This is a forgedemergencymessagewarning theuserof anoncampus shootingand claims tobe sentby the
Police.
Therearesignificant implicationstothisshortfall.Forinstance,intheeventofanemergencysuchasachemical
leak,itwouldbeeasyforamaliciouspartytosendanallclearmessagebeforethesituationwasdeemedsafe.
Becauseitwouldnotbepossibleforuserstoverifythesourceoftheinformation,maliciouslyinducedconfusionis
arealthreat.
ExamplesofSMSspoofingarecommonandcanbeexpectedwithanySMSbasedservice (includingemergency
services)duetothelackofsecurity.
In2009followinganearthquakeinIndonesia,ahoaxtextmessagesbegancirculatingwarningofanew,stronger
earthquake21.Itwasclaimedtohavebeensentfromalegitimategovernmentagency.
20 3G AmericasWhite Paper, Characterizing the Limitations of ThirdParty EAS over Cellular TextMessaging
Services,PatrickTraynor,Ph.D.,September2008
-
8/6/2019 SMS to 911 White Paper Final October 2010
43/76
4GAmericasOctober2010 43
Alsoin2009,ahoaxAmberAlertmessagewascirculated22
sayinga3yearoldboywaskidnappedbyamanina
2003MitsubishiEclipsewithOregonlicenseplate98B351.AmberAlertsfromunknownsourcescouldleadtoa
delayedresponsefromthepublicandjeopardizestheintegrityoftheentireAmberAlertplan,saidStatePoliceLt.
MollyCotter,OregonAmberAlertcoordinator.
SMSspoofinghasresultedinpanic hoaxtextmessageswereusedtospreadstsunamiterrorinIndonesia(June,
200723).ThousandsofpeoplefledtheirhomesinpanicontheIndonesiancoastafterhoaxtextmessagesspread
warningthemthatatsunamiwillhittheregion.ThepossibilityisthatatsunamimaytakeplaceonJune7,said
partofashorttelephonetextmessage(SMS)thatiswidelycirculatinginvariouscoastalareasofNusaTenggara
province.
InMay2005,anSMStsunamirumorhitsSumatra24
.Rumorsthatavolcaniceruptionhadsentatsunamicrashing
toward the coast spread through a seaside town on Indonesia's Sumatra Island early Tuesday, prompting
thousandsofpanickedresidentstofleetohighground.ItwasunclearhowTuesday'srumorbegan,butitquickly
spreadbywordofmouthandSMStextmessage,thestatenewsagencyAntarareported.Byabout2A.M.,almost
all the mosques in the town were broadcasting tsunami wa