SignallingSystemNo.

7
FromWikipedia,thefreeencyclopedia

SignallingSystemNo.7(SS7)isasetoftelephonysignalingprotocolsdevelopedin1975,whichisused
tosetupandteardownmostoftheworld'spublicswitchedtelephonenetwork(PSTN)telephonecalls.It
alsoperformsnumbertranslation,localnumberportability,prepaidbilling,ShortMessageService(SMS),
andothermassmarketservices.
InNorthAmericaitisoftenreferredtoasCCSS7,abbreviatedforCommonChannelSignallingSystem7.In
theUnitedKingdom,itiscalledC7(CCITTnumber7),number7andCCIS7(CommonChannel
InterofficeSignaling7).InGermanyitisoftencalledN7(SignalisierungssystemNummer7).
TheonlyinternationalSS7protocolisdefinedbyITUT'sQ.700seriesrecommendationsin1988.[1]Ofthe
manynationalvariantsoftheSS7protocols,mostarebasedonvariantsoftheinternationalprotocolas
standardizedbyANSIandETSI.NationalvariantswithstrikingcharacteristicsaretheChineseand
Japanese(TTC)nationalvariants.
TheInternetEngineeringTaskForce(IETF)hasdefinedlevel2,3,and4protocolscompatiblewithSS7
whichusetheStreamControlTransmissionProtocol(SCTP)transportmechanism.Thissuiteofprotocols
iscalledSIGTRAN.

Contents
1 History
2 Functionality
2.1 Signalingmodes
3 Physicalnetwork
4 SS7protocolsuite
5 Protocolsecurityvulnerabilities
6 Seealso
7 References
8 Furtherreading
9 Externallinks

History

SS5andearliersystemsusedinbandsignaling,inwhichthecallsetupinformationwassentbyplaying
specialmultifrequencytonesintothetelephonelines,knownasbearerchannels.Asthebearerchannel
wasdirectlyaccessiblebyusers,itwasexploitedwithdevicessuchasthebluebox,whichplayedthetones
requiredforcallcontrolandrouting.Asaremedy,SS6andSS7implementedoutofbandsignaling,carried
inaseparatesignalingchannel,[2]:141thuskeepingthespeechpathseparate.SS6andSS7arereferredtoas
commonchannelsignaling(CCS)protocols,orCommonChannelInterofficeSignalling(CCIS)systems.
Since1975,CCSprotocolshavebeendevelopedbymajortelephonecompaniesandtheInternational
TelecommunicationUnionTelecommunicationStandardizationSector(ITUT)in1977theITUTdefined
thefirstinternationalCCSprotocolasSignallingSystemNo.6(SS6).[2]:145Inits1980YellowBook
Q.7XXseriesrecommendationsITUTdefinedtheSignallingSystemNo.7asaninternationalstandard.[1]
SS7replacedSS6withitsrestricted28bitsignalunitthatwasbothlimitedinfunctionandnotamenableto
digitalsystems.[2]:145SS7alsoreplacedSignallingSystemNo.5(SS5),whileR1andR2variantsarestill
usedinnumerouscountries.
TheInternetEngineeringTaskForce(IETF)definedSIGTRANprotocolssothecommonchannelsignaling
paradigmcouldbetranslatedtoIPMessageTransferPart(MTP)level2(M2UAandM2PA),Message
TransferPart(MTP)level3(M3UA)andSignallingConnectionControlPart(SCCP)(SUA).While
runningonatransportbaseduponIP,theSIGTRANprotocolsarenotanSS7variant,butsimplytransport
existingnationalandinternationalvariantsofSS7.[3]

Functionality
Signalingintelephonyistheexchangeofcontrolinformationassociatedwiththesetupandreleaseofa
telephonecallonatelecommunicationscircuit.[4]:318Examplesofcontrolinformationarethedigitsdialed
bythecallerandthecaller'sbillingnumber.
Whensignalingisperformedonthesamecircuitastheconversationofthecall,itistermedchannel
associatedsignaling(CAS).Thisisthecaseforearlieranaloguetrunks,multifrequency(MF)andR2
digitaltrunks,andDSS1/DASSPBXtrunks.
Incontrast,SS7usescommonchannelsignaling,inwhichthepathandfacilityusedbythesignalingis
separateanddistinctfromthetelecommunicationschannelsthatcarrythetelephoneconversation.With
CCS,itbecomespossibletoexchangesignalingwithoutfirstseizingavoicechannel,leadingtosignificant
savingsandperformanceincreasesinbothsignalingandchannelusage.
BecauseofthemechanismsusedbysignalingmethodspriortoSS7(batteryreversal,multifrequencydigit
outpulsing,AandBbitsignaling),theseoldermethodscouldnotcommunicatemuchsignaling
information.Usuallyonlythedialeddigitsweresignaled,andmerelyduringcallsetup.Forchargedcalls,
dialeddigitsandchargenumberdigitswereoutpulsed.SS7,beingahighspeedandhighperformance
packetbasedcommunicationsprotocol,cancommunicatesignificantamountsofinformationwhensetting
upacall,duringthecall,andattheendofthecall.Thispermitsrichcallrelatedservicestobedeveloped.
Someofthefirstsuchserviceswerecallmanagementrelated,callforwarding(busyandnoanswer),voice
mail,callwaiting,conferencecalling,callingnameandnumberdisplay,callscreening,maliciouscaller
identification,busycallback.[4]:Introductionxx

TheearliestdeployedupperlayerprotocolsintheSS7suitewerededicatedtothesetup,maintenance,and
releaseoftelephonecalls.[5]TheTelephoneUserPart(TUP)wasadoptedinEuropeandtheIntegrated
ServicesDigitalNetwork(ISDN)UserPart(ISUP)adaptedforpublicswitchedtelephonenetwork(PSTN)
callswasadoptedinNorthAmerica.ISUPwaslaterusedinEuropewhentheEuropeannetworksupgraded
totheISDN.Asof2015NorthAmericahasnotaccomplishedfullupgradetotheISDN,andthe
predominanttelephoneserviceisstilltheolderPlainOldTelephoneService.Duetoitsrichnessandthe
needforanoutofbandchannelforitsoperation,SS7ismostlyusedforsignalingbetweentelephone
switchesandnotforsignalingbetweenlocalexchangesandcustomerpremisesequipment.
BecauseSS7signalingdoesnotrequireseizureofachannelforaconversationpriortotheexchangeof
controlinformation,nonfacilityassociatedsignalling(NFAS)becamepossible.NFASissignalingthatis
notdirectlyassociatedwiththepaththataconversationwilltraverseandmayconcernotherinformation
locatedatacentralizeddatabasesuchasservicesubscription,featureactivation,andservicelogic.This
makespossibleasetofnetworkbasedservicesthatdonotrelyuponthecallbeingroutedtoaparticular
subscriptionswitchatwhichservicelogicwouldbeexecuted,butpermitsservicelogictobedistributed
throughoutthetelephonenetworkandexecutedmoreexpedientlyatoriginatingswitchesfarinadvanceof
callrouting.Italsopermitsthesubscriberincreasedmobilityduetothedecouplingofservicelogicfromthe
subscriptionswitch.AnotherISUPcharacteristicSS7withNFASenablesistheexchangeofsignaling
informationduringthemiddleofacall.[4]:318
SS7alsoenablesNonCallAssociatedSignaling,whichissignalingnotdirectlyrelatedtoestablishinga
telephonecall.[4]:319Thisincludestheexchangeofregistrationinformationusedbetweenamobile
telephoneandahomelocationregisterdatabase,whichtracksthelocationofthemobile.Otherexamples
includeIntelligentNetworkandlocalnumberportabilitydatabases.[4]:433

Signalingmodes
Apartfromsignalingwiththesevariousdegreesofassociationwithcallsetupandthefacilitiesusedto
carrycalls,SS7isdesignedtooperateintwomodes:associatedmodeandquasiassociatedmode.[6]
Whenoperatingintheassociatedmode,SS7signalingprogressesfromswitchtoswitchthroughthePublic
SwitchedTelephoneNetworkfollowingthesamepathastheassociatedfacilitiesthatcarrythetelephone
call.Thismodeismoreeconomicalforsmallnetworks.Theassociatedmodeofsignalingisnotthe
predominantchoiceofmodesinNorthAmerica.[7]
Whenoperatinginthequasiassociatedmode,SS7signalingprogressesfromtheoriginatingswitchtothe
terminatingswitch,followingapaththroughaseparateSS7signalingnetworkcomposedofsignaltransfer
points.Thismodeismoreeconomicalforlargenetworkswithlightlyloadedsignalinglinks.Thequasi
associatedmodeofsignalingisthepredominantchoiceofmodesinNorthAmerica.[8]

Physicalnetwork
SS7separatessignallingfromthevoicecircuits.AnSS7networkmustbemadeupofSS7capable
equipmentfromendtoendinordertoprovideitsfullfunctionality.Thenetworkcanbemadeupofseveral
linktypes(A,B,C,D,E,andF)andthreesignalingnodesServiceSwitchingPoints(SSPs),Signal

TransferPoints(STPs),andServiceControlPoints(SCPs).Eachnodeisidentifiedonthenetworkbya
number,asignallingpointcode.ExtendedservicesareprovidedbyadatabaseinterfaceattheSCPlevel
usingtheSS7network.
Thelinksbetweennodesarefullduplex56,64,1,536,or1,984kbit/sgradedcommunicationschannels.In
Europetheyareusuallyone(64kbit/s)orall(1,984kbit/s)timeslots(DS0s)withinanE1facilityinNorth
Americaone(56or64kbit/s)orall(1,536kbit/s)timeslots(DS0AsorDS0s)withinaT1facility.Oneor
moresignalinglinkscanbeconnectedtothesametwoendpointsthattogetherformasignalinglinkset.
Signalinglinksareaddedtolinksetstoincreasethesignalingcapacityofthelinkset.
InEurope,SS7linksnormallyaredirectlyconnectedbetweenswitchingexchangesusingFlinks.This
directconnectioniscalledassociatedsignaling.InNorthAmerica,SS7linksarenormallyindirectly
connectedbetweenswitchingexchangesusinganinterveningnetworkofSTPs.Thisindirectconnectionis
calledquasiassociatedsignaling,whichreducesthenumberofSS7linksnecessarytointerconnectall
switchingexchangesandSCPsinanSS7signalingnetwork.[9]
SS7linksathighersignalingcapacity(1.536and1.984Mbit/s,simplyreferredtoasthe1.5Mbit/sand2.0
Mbit/srates)arecalledhighspeedlinks(HSL)incontrasttothelowspeed(56and64kbit/s)links.High
speedlinksarespecifiedinITUTRecommendationQ.703forthe1.5Mbit/sand2.0Mbit/srates,and
ANSIStandardT1.111.3forthe1.536Mbit/srate.[10]Therearedifferencesbetweenthespecificationsfor
the1.5Mbit/srate.HighspeedlinksutilizetheentirebandwidthofaT1(1.536Mbit/s)orE1(1.984
Mbit/s)transmissionfacilityforthetransportofSS7signalingmessages.[10]
SIGTRANprovidessignalingusingSCTPassociationsovertheInternetProtocol.[4]:456Theprotocolsfor
SIGTRANareM2PA,M2UA,M3UAandSUA.

SS7protocolsuite
TheSS7protocolstackmaybepartiallymappedtothe
SS7protocolsuite
OSIModelofapacketizeddigitalprotocolstack.OSI
layers1to3areprovidedbytheMessageTransferPart
SS7protocolsbyOSIlayer
(MTP)andtheSignallingConnectionControlPart
Application
(SCCP)oftheSS7protocol(togetherreferredtoasthe
INAP,MAP,IS41...
NetworkServicePart(NSP))forcircuitrelated
TCAP,CAP,ISUP,...
signaling,suchastheBTIUP,TelephoneUserPart
(TUP),ortheISUP,theUserPartprovideslayer7.
Network
MTPLevel3+SCCP
Currentlytherearenoprotocolcomponentsthatprovide
Datalink
MTPLevel2
OSIlayers4through6.[1]TheTransactionCapabilities
Physical
MTPLevel1
ApplicationPart(TCAP)istheprimarySCCPUserin
theCoreNetwork,usingSCCPinconnectionlessmode.
SCCPinconnectionorientedmodeprovidestransportlayerforairinterfaceprotocolssuchasBSSAPand
RANAP.TCAPprovidestransactioncapabilitiestoitsUsers(TCUsers),suchastheMobileApplication
Part,theIntelligentNetworkApplicationPartandtheCAMELApplicationPart.
TheMessageTransferPart(MTP)coversaportionofthefunctionsoftheOSInetworklayerincluding:
networkinterface,informationtransfer,messagehandlingandroutingtothehigherlevels.Signalling
ConnectionControlPart(SCCP)isatfunctionalLevel4.TogetherwithMTPLevel3itiscalledthe

NetworkServicePart(NSP).SCCPcompletesthefunctionsoftheOSInetworklayer:endtoend
addressingandrouting,connectionlessmessages(UDTs),andmanagementservicesforusersofthe
NetworkServicePart(NSP).[11]TelephoneUserPart(TUP)isalinkbylinksignalingsystemusedto
connectcalls.ISUPisthekeyuserpart,providingacircuitbasedprotocoltoestablish,maintain,andend
theconnectionsforcalls.TransactionCapabilitiesApplicationPart(TCAP)isusedtocreatedatabase
queriesandinvokeadvancednetworkfunctionality,orlinkstoIntelligentNetworkApplicationPart(INAP)
forintelligentnetworks,orMobileApplicationPart(MAP)formobileservices.

Protocolsecurityvulnerabilities
In2014,themediareportedaprotocolvulnerabilityofSS7bywhichnonstateactorscantrackthe
movementsofcellphoneusersfromvirtuallyanywhereintheworldwithasuccessrateofapproximately
70%.[12]Inaddition,eavesdroppingispossiblebyusingtheprotocoltoforwardcallsandalsofacilitate
decryptionbyrequestingthateachcallerscarrierreleaseatemporaryencryptionkeytounlockthe
communicationafterithasbeenrecorded.[13]Researcherscreatedatool(SnoopSnitch)whichcanwarn
whencertainSS7attacksoccuragainstaphoneanddetectIMSIcatchers.[14]

Seealso
SS7probe

References
1. ITUTRecommendationQ.700(http://www.itu.int/rec/TRECQ.700/en)
2. Ronayne,JohnP(1986).TheDigitalNetworkIntroductiontoDigitalCommunicationsSwitching(1ed.).
Indianapolis:HowardW.Sams&Co.,Inc.ISBN0672224984.
3. RFC2719(http://www.ietf.org/rfc/rfc2719.txt)FrameworkArchitectureforSignalingTransport
4. Russell,Travis(2002).SignalingSystem#7(4ed.).NewYork:McGrawHill.ISBN9780071387729.
5. ITUTRecommendationQ.700,03/93(http://www.itu.int/rec/TRECQ.700199303I/en/),Section3.2.1,p.7.
6. ITUTRecommendationQ.700(http://www.itu.int/rec/TRECQ.700199303I/en/),p.4.
7. (Dryburgh2004,pp.2223).
8. (Dryburgh2004,p.23).
9. ITUTRecommendationQ.700(http://www.itu.int/rec/TRECQ.700199303I/en/),Section2.2.3,"signalling
modes",pp.45.
10. "ITUTRecommendationQ.703,AnnexA,Additionsforanationaloptionforhighspeedsignallinglinks".
InternationalTelecommunicationUnion.pp.8186.
11. ITUTRecommendationQ.711(http://www.itu.int/rec/TRECQ.711200103I/en/),Section1,"Scopeandfield
ofapplication",pp12.
12. Timburg,Craig(24August2014)."Forsale:Systemsthatcansecretlytrackwherecellphoneusersgoaroundthe
globe".TheWashingtonPost.Retrieved27December2014.
13. Timburg,Craig(18December2014)."Germanresearchersdiscoveraflawthatcouldletanyonelistentoyour
cellcalls.".TheWashingtonPost.Retrieved19December2014.
14. KarstenNohl(20141227)."Mobileselfdefence"(PDF).ChaosCommunicationCongress.

Furtherreading
Dryburgh,LeeJeffHewitt(2004).SignallingSystemNo.7(SS7/C7):Protocol,Architecture,and

Services.Indianapolis:CiscoPress.ISBN1587050404.Citeusesdeprecatedparameter
|coauthors=(help)
Ronayne,JohnP.(1986)."TheDigitalNetwork".IntroductiontoDigitalCommunicationsSwitching
(1sted.).Indianapolis:HowardW.Sams&Co.,Inc.ISBN0672224984.
Russell,Travis(2002).SignalingSystem#7(4thed.).NewYork:McGrawHill.ISBN978007
1387729.

Externallinks
SS7opensourceproject(http://www.openss7.org/)
Retrievedfrom"https://en.wikipedia.org/w/index.php?title=Signalling_System_No._7&oldid=687919753"
Categories: ITUTrecommendations SignalingSystem7 Telephony Networkprotocols
Thispagewaslastmodifiedon28October2015,at13:31.
TextisavailableundertheCreativeCommonsAttributionShareAlikeLicenseadditionaltermsmay
apply.Byusingthissite,youagreetotheTermsofUseandPrivacyPolicy.Wikipediaisa
registeredtrademarkoftheWikimediaFoundation,Inc.,anonprofitorganization.