Over the Air (OTA) Steering Vulnerabilities

Steering of roaming refers to the ability of the home network to choose the hosting network of their subscriber while roaming. Network-based (Signaling) steering or SIM-based (OTA) steering is the two Steering techniques.

Network-based Steering of Roaming

Signaling Steering functions by allowing Update Location messages for the preferred network to pass while preventing messages from non-preferred networks (s). Utilizes the SS7 gateway next to the SCCP gateways on the home network side. A request using SS7 signaling is sent to the home network when the subscriber tries to connect to a network while roaming. The subscriber will instantly be redirected to try another network if the attempting network is not preferred by the home network (this may take several attempts).

SIM-based Steering of Roaming

Delivering an OTA message which includes preferred mobile operators (PLMN) to the roaming subscriber's SIM is how OTA steering operates. The list is updated using messages that are sent to the subscriber’s SIM card over the air (OTA). In accordance with the preferences established by the home network and taking into account business requirements, an application on the SIM card reads the list and compels the selection of the appropriate mobile provider.

Many operators prefer to employ OTA Steering since it typically provides roaming subscribers with a much better experience and enables them to immediately connect to a network. However, as far as the vulnerabilities of OTA Steering are concerned, a hybrid steering solution, a combination of Network-based and SIM Based Steering is required. Options that OTA simply cannot offer to the Mobile Network Operator can be provided by signaling steering:

• Roaming subscribers must first be registered on a network in order to get the OTA update messages. During a subscriber's initial attach in a country, prior to receiving the update messages, roamers may connect to a non-preferred network. In such cases, only signaling steering can guarantee that the roamer only connects to the preferred network.

• Even if the OTA message is received, the handset may potentially choose a non-preferred network for a number of reasons (for instance, the preferred network is not currently available or there is a temporary loss of coverage). OTA Steering cannot handle this circumstance, thus once a roamer is connected to a non-preferred network, s/he will stay there until the non-preferred network loses radio coverage. The non-preferred network remains on the SIM card even when the handset is turned off, and it will be chosen at the next power-up.

• Additionally, OTA steering will be useless if the first attached network experiences a malfunction or if the network rejects the message. A hybrid system can be set up to employ signaling-based steering first to prevent the subscriber from accessing a network that is not preferred. An OTA update can then be deployed to keep the user connected to their preferred network once they have done so.

• OTA Steering had a bunch of problems such as not acting in real time, lack of adaptability and inaccuracy. If the preferred PLMN list in the SIM is updated, the device has not taken that into consideration until it is powered on and off. Another problem was that the list given via OTA to update the preferred PLMN list has been consistently the same and directs traffic to the first preferred without providing feedback in the event that traffic commitments are exceeded. Additionally, when there had been an alteration on the preferred networks, upgrading all SIMs for changing preferred partners had taken a long time. Those constraints are partially solved by using a "Refresh" OTA Command, however, there may be problems involving many handset vendors that make this strategy unworkable.

• Some devices, especially older ones, do not support OTA, or OTA upgrades are not possible. The home network operator may only be able to direct these subscribers to the preferred network by using signaling steering.

• The delivery of OTA messages to the subscriber's mobile device is necessary for SIM-based Steering. OTA Steering is useless if there is a problem with this delivery of the OTA server. In the event that OTA delivery fails, signaling steering can again fill this gap by imposing steering to the desired network.

• Some OTA steering systems might not be flexible enough to function with complex steering algorithms. For example, it just delivers the identical list to every roaming subscriber in a nation. The ability to manage several discount agreements in a single country is not possible this way. A system must monitor the number of roamers in each nation and network at any given time in order to function properly. Systems that don't accomplish this have very limited ability to provide value.

Network operators have the best potential solution when Over the Air Steering of roaming and Signalling Based Steering of Roaming are combined. This approach combines the benefits of both and avoids their inherent drawbacks. The mobile network operator can choose whether to use pure OTA steering, pure signaling steering, or a hybrid approach utilizing DiRoam's Steering of Roaming which is a fully configurable service.

References:

[1] GSMA Association, 2022, IR.73 - Steering of Roaming Implementation Guidelines V9.0