Everything worth knowing, nothing that isn't.
How Diameter signaling security works
Diameter is the AAA signaling protocol that replaced SS7 MAP on the 4G core — the MME and HSS exchange S6a/S6d messages to attach subscribers, authorise service, and route SMS. A Diameter Edge Agent sits at the roaming interconnect (the S6a/S9/S6d border) and every inbound message is checked against GSMA FS.19 rules, the origin realm's reputation, and plausibility — does this Update-Location come from a realm the subscriber could actually be roaming in? — then passed, rate-limited, or dropped, with every decision logged. See /answers/diameter-s6a-explained and /answers/what-is-hss.
The threats it stops
Forged Update-Location-Request (ULR) messages that hijack a subscriber's routing to intercept calls and SMS; Insert-Subscriber-Data and Cancel-Location abuse that tampers with a profile or forces a denial of service; and location disclosure through the SLh/SLg location interfaces. These are the Diameter equivalents of the SS7 MAP attacks GSMA FS.11 addresses. See /answers/ss7-signaling-security and /answers/ss7-map-send-routing-info-for-sm.
GSMA FS.19 and the Diameter Edge Agent
GSMA FS.19 (Diameter Interconnect Security) is the reference document: it defines a category model for inter-operator Diameter messages and tells operators which to block, rate-limit, or allow by realm. The Diameter Edge Agent is the border element that enforces it — the topology-hiding, screening choke point at the LTE roaming edge, the exact analogue of the STP-plus-firewall on the SS7 side. See /answers/gsma-fs07-fs11-signaling-firewall.
Diameter vs SS7 signaling security
SS7/MAP security defends the 2G/3G control plane; Diameter security defends the 4G/LTE control plane. Because most networks run a hybrid 2G/3G/4G core and SMS still falls back to SS7 for many handsets, an attacker who is blocked on one plane simply tries the other — so the two firewalls must run as one policy with shared subscriber reputation. On 5G standalone the equivalent job passes to the SEPP over HTTP/2. See /answers/what-is-ss7 and /answers/what-is-sigtran.
Benefits for the operator
Subscriber protection against tracking and interception, GSMA and regulator compliance, a tamper-evident Diameter audit trail, and the ability to correlate Diameter with SS7 and A2P traffic to catch fraud that spans planes. BroadNet pairs the Diameter and SS7 signaling firewall with SMS-firewall and CDR intelligence for a single policy view across the network. See /operators/ss7-firewall and /platforms/signaling-cdr.
Limitations and operational realities
A Diameter firewall is only as good as its category rules and realm reputation — over-blocking breaks legitimate roaming partners, under-tuning leaks attacks. It cannot see inside the encrypted service-based signaling of a 5G standalone core, which needs its own SEPP and TLS controls, and it must be kept in step with the SS7 firewall so hybrid-core gaps do not open. See /answers/ss7-signaling-security.
Is Diameter more secure than SS7?
Only marginally, and not by design. Diameter supports IPsec/TLS and realm-based screening that SS7 lacked, but early LTE roaming shipped without them, so real-world Diameter interconnects inherited the same trust-the-peer weakness as SS7 — which is why GSMA FS.19 exists. The practical answer is that neither plane is safe unattended: both need a signaling firewall. BroadNet secures both across 60+ operator networks. See /operators/ss7-firewall.