Signalling Systems#

(cictation 3) Signaling System 7 (SS7) is an international telecommunications standard that defines how network elements in a public switched telephone network (PSTN) exchange information over a digital signaling network. Nodes in an SS7 network are called signaling points. SS7 consists of a set of reserved or dedicated channels known as signaling links. There are three kinds of network points signaling points: Service Switching Points (SSPs), Signal Transfer Points (STPs), and Service Control Points (SCPs). SSPs originate or terminate a call and communicate on the SS7 network with SCPs to determine how to route a call or set up and manage some special feature. Traffic on the SS7 network is routed by packet switches called STPs. SCPs and STPs are usually mated so that service can continue if one network point fails.

The term signaling, when used in telephony, refers to the exchange of control information associated with the establishment of a telephone call on a telecommunications circuit. An example of this control information is the digits dialed by the caller, the caller's billing number, and other call-related information.

When the signaling is performed on the same circuit that will ultimately carry the conversation of the call, it is termed Channel Associated Signaling (CAS). This is the case for earlier analogue trunks, MF and R2 digital trunks, and DSS1/DASS PBX trunks.

In contrast, SS7 signaling is termed Common Channel Signaling (CCS) in that the path and facility used by the signaling is separate and distinct from the telecommunications channels that will ultimately carry the telephone conversation. With CCS, it becomes possible to exchange signaling without first seizing a facility, leading to significant savings and performance increases in both signaling and facility usage.

SS7, being a high-speed and high-performance packet-based communications protocol, can communicate significant amounts of information when setting up a call, during the call, and at the end of the call. This permits rich call-related services to be developed. Some of the first such services were call management related services that many take for granted today: call forwarding (busy and no answer), voice mail, call waiting, conference calling, calling name and number display, called name and number display, call screening, malicious caller identification, busy callback.

The earliest deployed upper layer protocols in the SS7 signaling suite were dedicated to the setup, maintenance, and release of telephone calls. The Telephone User Part (TUP) was adopted in Europe and the Integrated Services Digital Network (ISDN) User Part (ISUP) adapted for Public Switched Telephone Network (PSTN) calls was adopted in North America. ISUP was later used in Europe when the European networks upgraded to the ISDN. (North America never accomplished full upgrade to the ISDN and the predominant telephone service is still the older PSTN POTS service.) Due to its richness and the need for a completely separate signaling network for its operation, SS7 signaling is mostly used for signaling between telephone switches and not for signaling between local exchanges and Customer Premises Equipment (CPE).

Because SS7 signaling does not require seizure of a channel for a conversation prior to the exchange of control information, Non-Facility Associated Signalling (NFAS) became possible. NFAS is signaling that is not directly associated with the path that a conversation will traverse and may concern other information located at a centralized database such as service subscription, feature activation, and service logic. This makes possible a set of network-based services that do not rely upon the call being routed to a particular subscription switch at which service logic would be executed, but permits service logic to be distributed throughout the telephone network and executed more expediently at originating switches far in advance of call routing. It also permits the subscriber increased mobility due to the decoupling of service logic from the subscription switch. Another characteristic of ISUP made possible by SS7 with NFAS is the exchange of signaling information during the middle of a call.

Also possible with SS7 is Non-Call-Associated Signaling, which is signaling that is not directly related to the establishment of a telephone call. An example of this is the exchange of the registration information used between a mobile telephone and a Home Location Register (HLR) database: a database that tracks the location of the mobile. Other examples include Intelligent Network and Local number portability databases.

In 2014, security researchers in Germany demonstrated that attackers could exploit security holes in SS7 to track cell phone users' movements and communications and eavesdrop on conversations. The attack in question is essentially a man-in-the-middle attack on cell phone communications that, among other things, exploits the lack of authentication in the communication protocols that run on top of SS7.