SS7 & Signaling Basics

SS7 — Signalling System No. 7 — is the out-of-band signalling network that mobile and fixed operators use to set up calls, deliver SMS, and support roaming. "Out-of-band" means signalling travels on a separate control channel from the voice or message payload.

SS7 was designed in an era when only a small, trusted group of national carriers could reach the network. That trust assumption — every peer is legitimate — is the root of many security problems that surfaced once the network became globally interconnected.

Despite being decades old, SS7 still carries core interworking functions. Understanding it is prerequisite to understanding SMS delivery, roaming, and the firewalls built to defend the signalling layer.

SS7 is layered. MTP (Message Transfer Part) provides the lower transport layers. SCCP (Signalling Connection Control Part) adds global-title addressing and routing, so a message can be addressed to a logical network element rather than a fixed point code.

TCAP (Transaction Capabilities Application Part) carries transactional dialogues on top of SCCP, and MAP (Mobile Application Part) is the application protocol that expresses mobile-specific operations — locating subscribers, authenticating them, and routing SMS.

Two addressing concepts recur: point codes (OPC / DPC — originating and destination point codes) identify nodes at the network level, while global titles (typically an E.164-style address) let SCCP route to elements like an HLR without knowing their point code.

SMS delivery leans on a small set of MAP operations. To terminate a message, the sending SMSC issues SRI-SM (Send Routing Info for Short Message) toward the recipient's HLR (Home Location Register) to discover which serving node the subscriber is currently attached to.

The HLR returns the address of the serving MSC/VLR, and the SMSC delivers the message there with MT-ForwardSM. If the subscriber is unreachable, the network sets a flag and notifies the SMSC when the handset becomes available again.

This flow is exactly what home-routing and signalling firewalls manipulate: by intercepting SRI-SM, an operator can force terminating traffic through a controlled checkpoint, which is the mechanism behind MT-bypass protection.

Modern networks rarely run SS7 over legacy TDM links end to end. SIGTRAN is the family of protocols that transports SS7 signalling over IP, using SCTP (Stream Control Transmission Protocol) as a reliable transport with adaptation layers such as M3UA to carry MTP-level traffic.

SIGTRAN preserves the SS7 application protocols — MAP and TCAP are unchanged — while modernising the transport beneath them. This is what lets an operator interconnect signalling over IP networks rather than dedicated links.

For a messaging platform, SIGTRAN is the layer at which many direct operator interconnects are actually implemented today, so signalling security is an IP-network concern as much as a telecom one.

Because SS7 assumes every peer is trusted, an attacker with signalling access can abuse legitimate operations. SRI-SM can be used to probe a subscriber's location or existence; other MAP messages can be misused to intercept SMS (including OTPs) or track movement.

The industry response is signalling firewalls that apply category-based filtering — as described in GSMA FS.11 — distinguishing messages that should only ever come from inside the home network, only from a roaming partner, or legitimately from anywhere. Messages arriving from the wrong direction are blocked.

Diameter, the signalling protocol for LTE/4G and beyond, inherits similar concerns and has its own security guidance (GSMA FS.19). The lesson is durable: signalling networks need explicit filtering because their original trust model no longer holds.