Short Message Service (sms) security solution for mobile devices

8. 
SMS Center (SMSC) Security 
The SMSC is often considered an integral part of the GSM network. 
However, with the rapid growth in SMS applications, many independent SMSC 
operators have sprouted in the industry. They lease connections from the 
telecommunications service provider and provide services such as SMS 
advertising, news broadcasts, chats, etc. In terms of security, this has huge 
implications.
a.
Policy Enforcement 
Originally, the GSM network could be considered a relatively closed 
network with connections only to other telecommunications operators. The 
telecommunications operator owns the infrastructure, including the radio links. 
Thus, a unified security policy could be applied across the entire network, 
assuming that the operator has a minimal set of security policies that make a 
difference. Any security breaches from employees in the network could be 
investigated easily. With a connection to a third party SMSC, the trust is 
essentially extended to the SMSC. However, the telecommunications operator 
does not own the SMSC. Therefore, there is no way of ensuring that the same 
level of security can be enforced at the SMSC. Even though the connection may 
be secured with a Virtual Private Network, the host security of the SMSC cannot 
be determined.
b. Host 
Security 
Although SMSC provides a specialized service, the applications are 
usually hosted on platforms that run general purpose Operating Systems, like 
Unix or Windows. These Operating Systems have their own set of security 
vulnerabilities and require regular patching. Security mechanisms, such as 
access control, physical security, policy enforcement, and security administration, 
need to be in place to ensure the security of SMSC.

---

 16