Signaling System No. 7

Signaling System No. 7
Name	Signaling System No. 7
Status	In widespread use, being replaced
Year started	0 1975
Organization	International Telecommunication Union
Related standards	Signaling System No. 6

Signaling System No. 7. Commonly abbreviated as SS7 or C7, it is a set of telephony signaling protocols developed in the 1970s to set up and manage public switched telephone network calls. It introduced out-of-band signaling, separating the control plane from the voice circuit, which greatly increased the efficiency and feature set of global telecommunications. The protocol suite is defined by the International Telecommunication Union Telecommunication Standardization Sector and remains a critical, though aging, backbone for landline and mobile phone networks worldwide.

Overview

Developed to replace the earlier Signaling System No. 6, SS7 was created to support the burgeoning demand for intelligent network services like toll-free calling, local number portability, and Integrated Services Digital Network. Its architecture separates the signaling path, known as the signaling link, from the actual voice or data bearer channels, a fundamental shift from previous in-band systems. This design allows network switches, such as service switching points, to communicate with centralized databases and other network elements with high reliability and speed. The system's deployment was pivotal for the automation of long-distance calling and the development of cellular networks like GSM, where it handles critical functions such as mobile subscriber authentication and handover.

Protocol architecture

The SS7 protocol stack is broadly aligned with the Open Systems Interconnection model, though it predates the full OSI framework. At the lower levels, the Message Transfer Part provides reliable, connection-oriented packet delivery and network routing functions across the signaling network. Above this, the Signaling Connection Control Part adds addressing capabilities to route messages to specific applications within a network node. The primary user parts include the ISDN User Part for managing basic call setup and teardown in the PSTN, and the Transaction Capabilities Application Part, which is essential for querying databases to enable services like 800 number translation. For mobile networks, the Mobile Application Part, an extension of TCAP, handles mobility management, call routing, and short message service operations.

Signaling network components

An SS7 network is composed of several key node types interconnected by signaling links. A service switching point is a telephone exchange that originates or terminates signaling messages, typically found in central offices. A service control point is a centralized database node, such as a Home Location Register in GSM networks, that provides routing and subscriber information to SSPs. A signal transfer point is a packet switch that routes signaling messages between other SS7 nodes, forming the backbone of the signaling network. These elements are often deployed in mated pairs for redundancy, connected via A-links, B-links, and C-links as defined in the Bell System standards, ensuring high availability even during network congestion or node failure.

Common signaling procedures

A fundamental procedure is call setup, where an SSP sends an Initial Address Message via the ISUP to reserve a voice trunk and route a call to its destination exchange. For toll-free telephone number resolution, an SSP queries an SCP database using TCAP to translate the dialed number into a routable destination. In mobile networks, the MAP protocol facilitates procedures like location update, where a Mobile Switching Center informs the HLR of a subscriber's current location, and call delivery, which involves querying the HLR and the serving Visitor Location Register to route an incoming call. SMS delivery also relies on a series of MAP messages between the Short Message Service Centre, HLR, and MSC.

Security and vulnerabilities

Originally designed for a closed, trusted network of telecom operators, SS7 lacks inherent authentication and encryption for many of its signaling messages. This architectural assumption has led to significant security vulnerabilities exposed by researchers and entities like GSM Association. Exploits allow attackers to intercept SMS messages, track a mobile phone's location in real-time, and even redirect or eavesdrop on calls. These weaknesses have been leveraged for espionage and fraud, such as SIM swap attacks to bypass two-factor authentication. While network-layer security measures like firewalls and intrusion detection system monitoring can be deployed, the fundamental protocol limitations are a primary driver for its planned replacement by more secure architectures.

Evolution and replacement

While still ubiquitous, SS7 is considered a legacy technology. Its evolution within the PSTN saw extensions for broadband services via the Broadband Integrated Services Digital Network standards. For mobile telephony, its MAP protocol was crucial for 2G and 3GPP networks. The primary successor for call control in all-IP networks is the Session Initiation Protocol, which is central to Voice over IP and IP Multimedia Subsystem architectures. In mobile networks, the Diameter protocol is replacing MAP for 4G LTE and 5G core network functions, offering improved security, scalability, and support for IP-based services. The transition is gradual, with many networks operating SS7 and IP-based signaling in parallel during a long migration period.

Category:Telecommunications standards Category:Telephony signaling protocols