Signaling System No. 7 (SS7) is a set of telephony signaling protocols which are used to set up and tear down most of the world’s public switched telephone network (PSTN) telephone calls. It provides an interface for various network elements to exchange information about calls and services, thus enabling text messages and voice calls are connected from different operators. In order to understand the interconnections of mobile and border station systems we must first get a bit familiar with how SS7 works.
It is a protocol designed for functions such as number translation, prepaid billing and mobile roaming. It essentially communicates messages between different network nodes, covering services from call setup to entitlements for SMS. The importance of SS7 in sustaining connectivity and service integrity for those who follow the more technical aspects of telecommunications cannot be stressed sufficiently.
With its pivotal role in enabling network operators to manage their systems effectively, SS7 is both a backbone and an enabler of the features that users rely on daily. Exploring the intricacies of SS7 will shed light on the unseen processes that make modern communication possible.
SS7, or Signaling System No. 7, is a protocol suite used to set up and manage phone calls within and between telephone networks, especially in public switched telephone networks (PSTNs). Developed in the 1970s, SS7 enables various essential functions in telecommunications, including:
- Call Setup, Management, and Teardown: SS7 sets up the connection between the calling and receiving parties, keeps the call active, and disconnects it when done.
- Routing and Number Translation: It helps in translating phone numbers to find the correct end destination.
- Text Message (SMS) Handling: SS7 is used to route SMS messages through the network.
- Billing and Toll Processing: Tracks and logs call information for billing purposes.
- Roaming: It helps coordinate when a user is using a different carrier’s network while traveling.
SS7 has known security vulnerabilities since it was designed before cybersecurity was a significant concern. Attackers who gain access to SS7 can intercept calls and SMS messages, track user locations, and even spoof caller identities, raising privacy and security concerns.
How Does SS7 Network Work?
SS7 works by enabling the exchange of control signals between network devices and telephone switches, allowing for the management of calls, SMS routing, and various network services. The protocol doesn’t carry the actual voice or message data; instead, it coordinates and sets up the connection. Here’s a breakdown of how SS7 operates:
1. Signaling Points (SPs)
SS7 networks are made up of three primary elements called Signaling Points (SPs):
- Service Switching Points (SSPs): These are the network switches where calls originate and terminate.
- Signal Transfer Points (STPs): These function like routers, directing the signaling messages between SSPs and SCPs.
- Service Control Points (SCPs): These store network databases and handle functions like number translation, call routing, and mobile roaming.
2. Message Transfer
SS7 uses packets of data, called signal units, which contain information about the call. These packets include details like the origin and destination of the call, the type of call setup, and routing information. When a call is made, SS7 signal units are sent between network switches and servers to set up the connection.
3. SS7 Protocol Layers
SS7 uses a layered structure, somewhat similar to the OSI model, to organize different signaling functions:
- MTP (Message Transfer Part): The foundation, handling message transport and network management.
- MTP Level 1 & 2: Manage physical connection and error correction.
- MTP Level 3: Directs message routing and ensures delivery.
- ISUP (ISDN User Part): Handles the call setup, management, and teardown. It’s crucial for connecting voice calls.
- TCAP (Transaction Capabilities Application Part): Manages non-voice services, like SMS and other signaling functions that don’t require a voice channel.
- SCCP (Signaling Connection Control Part): Provides additional addressing and routing functions for higher-level protocols like TCAP.
4. Establishing a Call (Basic Steps)
When you make a call, SS7 carries out several essential steps:
- Call Setup: An SSP signals an STP to request the start of a call. The STP routes the call setup message to the appropriate SSP at the other end.
- Verification: The network may perform checks, such as validating if the number is correct or whether the caller is authorized to make the call.
- Routing: STPs route messages to connect the call across various network segments.
- Call Connection: After routing, a voice path is established between the caller and the receiver.
- Teardown: When the call ends, the SS7 network initiates disconnection.
5. Handling SMS and Mobile Services
- For SMS, SS7 carries messages over TCAP. The protocol routes the SMS to the correct destination, even when the receiver is on a different network.
- For mobile roaming, SS7 communicates with databases like the HLR (Home Location Register) and VLR (Visitor Location Register), allowing users to move between networks while keeping their service active.
6. Vulnerabilities in SS7
The core security issue with SS7 is its open-trust design. Once an entity is allowed to connect to the SS7 network, it has access to all signaling capabilities, often without modern security checks. This allows attackers to intercept calls, SMS messages, or track devices’ locations if they can access SS7 signals.
Conclusion
In conclusion, SS7 is a foundational telecommunications protocol that facilitates essential services like call setup, SMS routing, and roaming in phone networks. By leveraging signaling points and layered protocol functions, SS7 efficiently manages connections and non-voice services across networks. However, due to its original open-trust design, SS7 remains vulnerable to interception, tracking, and other attacks, highlighting the need for improved security measures in modern telecommunications.
