Signaling System 7
Department: Networking and Telecommunication
Subject: Broadband Communication
Student: Mohammed Ahmed Elmadani
Overview
Introduction
Background
SS7 network Elements
Addressing
Applications of SS7
SS7 problems
Introduction
What is SS7 ?
It’s the core of global PSTN
It ensures Global voice and SMS connectivity
SS7/C7 is the protocol suite that is employed globally, across
telecommunications networks, to provide signaling.
Uses out of band channel which make it more reliable and more secure
This is the Network Control Protocol for telephone service providers worldwide.
One of the most important and basic use of the SS7 system is to control the
network
It is used for data transfer for both landline and wireless telephone systems and
has become standard for signaling across the globe.
Background
AT&T developed SS7/C7 in 1975, and the International Telegraph and
Telephone Consultative Committee (CCITT) adopted it in 1980 as a
worldwide standard.
Earlier signaling implementations, such as Signaling System 5, used in-
band signaling, where the same channel used for voice also carried the
signal tones to control calls. This caused many issues.
Background
There are two types of channels that carry voice:
Channel Associated Signaling (CAS)
CAS the signaling is included in the same channel as the voice call.
Common Channel Signaling (CCS)
With CCS the signaling is provided in a separate channel.
CAS and CSS
CAS and CSS
Common channel signaling advantages:
More efficient use of voice path/circuit
More bandwidth available for the signaling
More secure
More flexible architectures
The channel that is used for signaling is only accessible to the underlying
infrastructure and not the end callers, increasing security.
SS7 Network Element
There are three main types of signaling nodes in a SS7 network:
Service Switching Points (SSPs)
SSPs originate or terminate a call and are the initial point on the SS7 network
Signal Transfer Points (STPs)
The control signals are routed through various STPs, which operate as interconnected
switches on the SS7 network.(act as a router)
Service Control Points (SCPs)
The SCPs determine how to route a call or set up and manage some special feature.
It also store some related information about the point code in it’s database
SS7 Network Element
Ssp:service switching point
Stp :signal transfer point
Scp:service control point
Addressing
Point code
An SS7 point code is similar to an IP address in an IP network. It is a unique
address for a node (Signaling Point, or SP), used in MTP(Message transfer part)
layer 3 to identify the destination of a message signal unit (MSU).
Depending on the network, a point code can be 24 bits (North America, China), 16
bits (Japan), or 14 bits (ITU standard, International SS7 network and most
countries)
OPC Originating Point Code
DPC Destination Point Code
ISPC International Signaling Point Code
Addressing
SS7 Network suite MTP:Message Transfer part
SCCP:Signalling Connection Control Part
TCAP:Transaction Capabilities Application Part
ISUP: Integrated Services User Part
TUP: Telephone User Part
MAP: Mobile Application Part
SS7 application
PSTN network
GSM
automated voicemail
conference calling
subscriber authentication and extended billing
SMS
mobile phone roaming and tracking
SS7 over IP network
The signaling transport (SIGTRAN) protocols provide interoperability of SS7
signaling to operate over Internet Protocol (IP)-based networks. This enables
PSTN service to operate over legacy, analog plain old telephone service
systems and modern IP networking equipment. SIGTRAN uses its own
Stream Control Transmission Protocol, as opposed to
Transmission Control Protocol or User Datagram Protocol.
It is still the current standard for telephone calls and is in use for both
landline and mobile phone service all the way up to and including 5G.
SS7 Problems
The primary security on the SS7 network is that it is a closed system; only
telecom operators have access to it
telecom providers operating as bad actors or governmental agencies with
legal access have relatively unrestricted access to all the information
available in the SS7 network.
Given the rich feature set and nonexistent security of SS7, this gives
these threat actors unprecedented access to user information. It also gives
governments the ability to track mobile users' location anywhere in the world,
even without the use of the Global Positioning System.(GPS)
SS7 Problems cons
SMS messages are sent unencrypted over the SS7 network and can be easily
read.
This type of snooping is called a SS7 probe or international mobile subscriber
identity catcher
the only way not to be at risk is to not use telephone service
SS7 Problems cons MSC:Mobile Switch
VLS:visitor location Register
HLR:Home Location register
Home Location Register (HLR) and Visitors Location Register
(VLR) are databases that contain the mobile subscriber information
as per the GSM architecture
SS7 Problems cons
Uplink
downlink
Locate Users
SS7 Problems cons
This would entail disabling telephone and mobile data service on a cellphone
to prevent tracking
Voice and text messages should be sent using encrypted IP-based services,
such as iMessage, WhatsApp, Telegram or Signal.
Your location could be being tracked at any stage when you have your mobile
phone on. The only way to avoid it is to turn off your phone or turn off its
connection to the mobile phone network and rely on Wi-Fi instead.
References
SS7 hack explained: what can you do about it? | Hacking | The Guardian
What is Signaling System 7 (SS7)? (techtarget.com)
Signaling System No. 7: The Role of SS7 > Signaling System No. 7-Based Servic
es | Cisco
Press
Signaling System - an overview | ScienceDirect Topics
Q.700 : Introduction to CCITT Signalling System No. 7 (itu.int)
The End
