What is the SS7 protocol?

SS7, or signaling system 7, is the legacy protocol used by the Traditional telephony system. SS7 standards are defined by the standardization body ITU-T(International Telecommunication Union Telecommunication Standardization Sector ). For physical connectivity, E1 or T1 cables are used.

An E1 port has 32-time slots (links), and T1 has 24-time slots. There are variants also, but those are specific to fewer countries, e.g., J1 in Japan. The protocol stack is based on the layered architecture, which follows the OSI model partially. In the stack, a layer below is a service provider, and a layer above is the service user.

The trunks are set up between telephone exchanges to carry protocol messages for voice and signaling. An SS7 trunk has multiple circuits (time slots). Imagine a trunk like a pipe with a bundle of wires inside. When a call setup message (ISUP signaling) originates from a switch/exchange, a circuit from the trunk is reserved for that call.

With the emergence of IP-based telephony (VOIP). Telephone exchanges may also have VoIP trunks. You can learn more about VoIP by learning SIP Trunking. In this tutorial, we will discuss the ss7 only.

What are the layers in an SS7 Protocol stack?

SS7 protocol stack has the following layers.

Message Transfer Part 1 (MTP1) – Physical Layer

Transfers bits over a physical channel in the form of electrical signals. Have physical ports to connect the cables. A card may have its CPU and RAM. When someone buys an SS7 card, it also comes with MTP2. An SS7 card may have multiple ports with multiple channels (32 – E1, 24 -T1).

Message Transfer Part 2( MTP2) – Data Link Layer

Transfers the error-free frames between two directly connected nodes. It maintains the receiver and sender windows. It uses sliding window protocol and retransmissions for flow and error control.

What are the functions of the MTP2 layer?

Error Control- checks the error in a received frame based on 16 bits CRC. Re-transmits lost message or error message.
Message Sequencing– maintains the sequencing of messages between directly connected nodes. Forward and backward sequencing numbers are maintained for sequence and retransmissions.
Link Alignment– provides link alignment procedures when requested from its user(MTP3).
Flow control– if the receiver is slow, sending mtp2 gives an indication to its user for congestion.
Link Status– link status is given to the user. The status may be, in service(UP), out of service(DOWN), or congestion(CONGESTED).

Message Transfer Part 3(MTP3) – Network Layer

This is the network layer that implements the mtp3 protocol. This does end-to-end routing of SS7 messages. This is the network layer in the ss7 protocol stack. For routing mtp3 routing, the level is defined. The routing level is defined in the MTP3 header, which contains OPC, DPC, and SLS. Mtp3 specification is given in Q.704. DPC is the point code of the destination ss7 node, OPC is the originating point code, and SLS is used for the load distribution of MTP3 user messages over links.

When a message is passed from MTP2 to MTP3, the routing level, SIO, and MTP3 user data are passed in the message. MTP3 has two primary functions, discrimination, and distribution. The discrimination function decides if the message is for the self node or some distance node. The discrimination function uses DPC. If a message is for a self-node, it is passed to the distribution function.

The distribution function checks SI, which is part of SIO. The value of SI identifies the user of MTP3. For Eg, if SI is 5, the message is delivered to the ISUP layer over MTP3. If the value of SI is 3, then the message is delivered to the user (SCCP/ISUP).

What are the functions of MTP3?

Remote Point code status management, mtp3 maintains the configuration of remote point code and its status. The status may be available or unavailable. The user of mtp3 gets PAUSE or RESUME indications for a configured remote point code. During the routing of a message, the status of the remote point code is checked.

Link Alignment:

Once a link is configured at MTP2 and MTP3 levels, the MTP3 layer starts the link alignment by issuing an alignment primitive to the MTP2 layer. This starts link alignment at the mtp3 level. Once a link comes up on the mtp2 level. MTP3 receives an in-service indication from the MTP2 layer. MTP3 sends an SLTM message to the remote end. If SLTA is received in response to SLTM, the link is marked up at the mtp3 level. If the link is the first link in a link set, then it’s an emergency link alignment procedure, else it’s a normal link alignment procedure.

Transfer Prohibited (TFP):

This is the MTP3 procedure by which a signaling point code can mark a route unavailable for a destination point code. This updates the routing table for a destination point code when a signaling transfer point (STP) detects an unreachable point code.

Load Sharing does the load sharing over Linkset and links based on SLS received from the user.

Change Over, when a link fails, the failed link’s traffic is distributed to the available links.

Change Back, when a failed link comes back, the traffic is rerouted to the association.

Signaling Connection Control Part (SCCP) – Transport Layer

It works as a transport layer and uses the service of MTP3. Do the segmentation/reassembly of large messages if required. A user application is identified by an SSN (an integer value). An SSN is a standard numeric value identifying an application/node in the GSM network.

HLR – SSN 6
VLR-SSN 7
MSC – SSN 8
SGSN – SSN 149

In the telecom network, an SCCP layer is identified by a Global title. A global title is a sequence of digits that is unique globally. Your phone number with country code is an example of a global title. The SCCP layer does SSN management, global title translation, and other functions.

SSN management:

SSN configured on the SCCP layer can be local or remote. Before sending a message to a peer SSN, SCCP layers check the status of the remote SSN. If it is down, the message is dropped. To check the status of an SSN, a peer transmits the SST and waits for SSA. This procedure is optional. A remote SSN can be marked as available when a peer point code comes up after successful link alignment.

Global Title Translation:

An SCCP address has called party and calling party address in the SCCP header. Both addresses are global titles. Upon receiving, SCCP checks if GT matches the current node. If yes, then the Called Party GT is translated to the point code of the current node. The message is delivered to the local user identified by the called party SSN in the incoming messages.

If a message is not of local use, the GT can be translated into another GT or PC. Or it can be forwarded to the next hope. If the current nodes know the point code serving the called party address, the gt is translated on point code. Else forward to the next hop.

SCCP message classes:

^{Class 0, connection less non sequenced message.}
^{Class 1, connection less sequenced delivery of messages.}
^{Class 2, connection oriented without flow control.}
^{Class 3, connection oriented with flow control.}

User Primitives of SCCP Layer:

A user primitive is the interface a layer provides to access its services. SCCP Provides request primitives to request a service from the layer, and Indication primitives, to inform events received from the network.

Sccp Primitives (Connection Less)

SCCP Connection Less Messages — SCCP Connection-Less Messages

Belongs to classes 0 and 1. No prior logical connection is set up. The messages are routed based on the called party address parameter. Class 0 messages are delivered not in sequence, while class 1 messages are delivered in sequence. ISUP and TCAP use connectionless SCCP protocols.

Data Request, this sends the user data in the SCCP protocol message. In UDT or XUDT SCCP messages, it depends on the length of a user message.

Data Indication, When protocol data is received from the network in UDT or XUDT.

Sccp Primitives (Connection-Oriented)

SCCP Connection Oriented Messages — SCCP Connection-Oriented Messages

Belongs to message classes 2 and 3. A prior connection setup before sending user data. BSSMAP and RANAP use connection-oriented SCCP.

Connection Request (CR) starts a request towards the remote node for an SCCP connection.

Connection Confirmation (CC), remote SCCP user issues CC primitives to SCCP for sending a connection request response.

Connection Release request, user issues this primitive when a connection has to close.

Connection Release Confirmation, to confirm a release connection request.

Data Request issues a user to send data (e.g., RANAP ) to the remote peer.

Data Indication issues a user for received data from the network.

ISDN User Part or ISUP Protocol Layer

ISUP uses the services of MTP3. ISUP layer implements the protocol messages required for call control functionalities and voice circuit management. When a call starts, ISUP signaling traverses many intermediate telephone exchanges. The voice carries on SS7 circuits. These are E1 or T1 lines. Each E1 has 32 logical channels. A single channel is required for a call. Channel is identified by a circuit identification code (CIC).

Essential messages in the ISUP protocol:

Initial Address message (IAM) is the first message which sends by the call-originating SSP.

Address Complete Message (ACM) is the first message originated by the call terminating exchange in response to an IAM.

Answers Message (ANM), when the called party goes off-hook, the terminating exchange sends ANM to the calling exchange.

Release Message (REL), sent by the exchange from which the connected user (Called or Caller) goes on hook.

Release Complete message (RLC), Response of ISUP release message.

ISUP Call Flow :

TCAP Layer, This is the transaction layer. It’s the user of the SCCP layer. This layer provides the functionalities to its user for maintaining end-to-end dialogue with the peer node. TCAP message carriers application context name for the application running over TCAP. A TCAP dialogue starts with a TCAP begin protocol message. Begin message and originating transaction id and application context.

If the remote peer accepts the dialogue, then sends a TCAP end or a TCAP continue message, with dialogue response as accepted. In case of dialogue is not accepted, the peer sends an abort or reject. Abort is of two types. The user of the TCAP layer generates user abort. Protocol Abort, generated by the transaction layer.

A TCAP message may have user components. A component is for operation, from the sending application that wants to invoke on remote application.

MAP Layer is an application-level protocol provider. It implements the messages required for Roaming and Messaging for the GSM handset.

SS7 network elements or nodes:

SS7 network has three types of nodes. Each node has specific functionalities.

Signaling Switching Points (SSP)

This node terminates the wireless side (BSC/BTS) and connects to the rest of the network over SS7. An SSP may be connected to another SSP directly, or it may be connected via a signaling gateway. MSC, or mobile switching center, is an example of SSP. MSC provides roaming, messaging, billing, and call control functionalities.

Signaling Transfer Point (STP)

This node is working as a router in the SS7 network. The primary important role is to do Global Title Translation and select the next node for the message. The next node may be SSP or another STP.

Signaling Control Point (SCP)

This node has a database and maintains a centralized service. For a service, these nodes are contacted. Many SSPs can contact a single SCP. HLR or Home Location Register is an example of SCP in the GSM network. When a mobile phone is switched on, it tries to attach first to MSC (SSP), and then MSC sends a location update to the HLR. The MSC may change, but the HLR remains the same. A mobile operator can map location information with time.

Sigtran or SS7 Signaling over IP:

In earlier days, the internet was not such a strong, fast, and reliable network. With the advancement of hardware and software technologies, the internet is much faster and more reliable. Sigtran is the SS7 signaling over the IP network. With the invention of the SCTP protocol, Sigtran became possible. In Sigtran, the user applications are the same, and the SS7 user adaptation layers have been developed. A Sigtran layer uses the services of SCTP protocol and provides service to an SS7 layer.

M3UA or MTP3 user adaptation layer:

This layer is the service provider for the MTP3 user in the SS7 network. The MTP3 users are ISUP and SCCP, which means M3UA carries the signaling for ISUP and SCCP. The primitives provided to its users by this Sigtran layer are the same as the mtp3 layer.