ussd: a communication technology to potentially oust sms ... - Aricent

This translation is normally performed by an Exchange TradedFunds (EFT) channel switch that switches transactions from thechannel to the appropriate area within the core banking system.Client-side applications refer to those applications that resideon the customer’s SIM card or mobile phone device. Client-sidetechnologies include J2ME. On the other hand, server-sideapplications are developed on a server away from customers’mobile phone or SIM card. Server-side technologies includeUSSD, IVR, SMS, and WAP.6.1.1 CRITICAL REVIEW OF SECURITY OPTIONS FORMOBILE BANKINGMobile banking brings new opportunities and new horizons, butalso comes with implicit risks to financial providers, carriers, andthe financial system. On the one hand, it holds out the prospectof adding convenience for accessing banking and paymentservices to customers. But the addition of a new channelalso brings new operational risks to providers, just as theintroduction of internet banking posed the risks a decade ago.For this reason, mobile Financial Service Providers (mFSP)seeking to enter the market have to assess their risks and developstrategies to mitigate those risks on an ongoing basis. Securityis a very sensitive issue for M-Banking, so this section comparesthe risks of using SMS and USSD messaging services.Data carried across the mobile network is protected by thestandard GSM security protocols at the communication layer.The subscriber identity is also protected across this chain. Therisk in transporting data across the GSM channel is directlydependent on the number of stoppages the data must makebefore reaching the bank.Data security with SMS bankingSMS service is deemed to be the least secured of the technologiessuggested for mobile banking because of the number of pointswhere the SMS data is available to others in a clear or unencryptedformat.The diagram below shows the entities involved across the GSMchannel in SMS banking.Base stationMSC SMSC BankFigure 8: SMS Banking GSM ChannelA customer initiates a transaction by sending an SMS to the bankusing the bank’s SMS short code. The SMS is stored on thehandset and is available to anyone who looks at the customer’sphone; hence, making it unsecure at the very first step. The SMSthen passes through the encrypted GSM communicationchannel through the base stations and terminates at the mobilenetwork operator’s SMSC. There, it is typically stored in anunencrypted form, making it unsecure at also the second step.The SMSC passes the message onto the bank’s wirelessapplication processor or mobile banking processor (which maybe a third party), where it is stored either in encrypted orunencrypted form. The third party then passes the message tothe bank across an encrypted fixed line to the bank, where it istypically stored in a secured environment.In all, there are three highly susceptive points of exposure duringthe transaction where the data is stored, making the SMS servicefar less secure.Data security with USSD bankingUnlike SMS, USSD message is not stored on customers’ mobile,making it secure at the first level. USSD opens a single sessionbetween the device and the supporting application at thenetwork operator/processor/bank.Base stationMSC USSD Gateway BankFigure 9: USSD Banking GSM ChannelThe data is also encrypted at the USSD gateway sitting at thenetwork operator/processor/bank, preventing any misuse ofthe data. This makes it secure at the second step. The end-to-endtransaction flow occurs across the encrypted GSMcommunication layer while the subscriber identity is also hidden.Hence, USSD service is safer than to SMS and other GSMtechnologies.However, there is one risk. If the GSM encryption (which is usedto carry the data within the communication layer by securedmeans) is broken, the data can be accessed–which can actuallyhappen with all GSM technologies (e.g., SMS, USSD, etc.). Toavoid this, the GSM encryption needs to be made more robust,much like how internet banking has evolved over the years.Excluding this generic threat, USSD appears to be the mostsuited technology for mobile banking application.USSD: A Communication Technology to Potentially Ouster SMS Dependency8