Telephone Switching

Signaling System #7 (SS7)

SS7 ( ITU-T Q.700 series) is the out-of-band signaling protocol used to set up, manage, and tear down telephone calls in the Public Switched Telephone Network (PSTN). SS7 operates on dedicated signaling links (56 or 64 kbps) completely separate from the voice path:

SS7 Protocol Stack

• MTP-1 (Message Transfer Part Level 1): Physical layer — E1/T1 or SS7 signaling links
• MTP-2 (Level 2): Data link layer — error detection/correction, frame synchronization
• MTP-3 (Level 3): Network layer — message routing between signaling points
• SCCP (Signaling Connection Control Part): Addressing and connectionless/connection-oriented services
• TCAP (Transaction Capabilities Application Part): Database queries (e.g., LRN lookup, number portability)
• ISUP (ISDN User Part): Call setup/teardown messages between SSPs

ISUP Messages

• IAM (Initial Address Message): Initiates call setup; carries called/calling number, routing info
• ACM (Address Complete Message): Called party has been located
• ANM (Answer Message): Called party has answered
• REL (Release): Tear down the call
• RLC (Release Complete): Acknowledgment of release

SS7 Vulnerabilities

SS7 was designed in the 1970s when the network was considered a trusted, closed system. Modern SS7 networks interconnect with mobile operators worldwide, exposing critical vulnerabilities:

• SRIforLC attack: Query subscriber routing info from HLR via MAP SRIforLC message
• ATI (Any Time Interrogation): Real-time location tracking of any subscriber
• SMS interception: MAP MT-FSM/MO-FSM for forwarding or reading SMS
• Call forwarding manipulation: MAP FORWARD CALL to redirect calls
• USSD balance depletion: Prepaid airtime theft via USSD commands

ISDN (Integrated Services Digital Network)

ISDN digitized the subscriber loop, carrying voice and data over the same infrastructure with separate bearer (B) and delta (D) channels:

• BRI (Basic Rate Interface): 2B + D = 144 kbps (2×64 kbps bearer + 16 kbps delta)
• PRI (Primary Rate Interface): 23B + D = 1.544 Mbps (US/Japan); 30B + D = 2.048 Mbps (Europe)
• D-channel: Carries signaling (Q.931) for call setup
• B-channels: Carry voice (64 kbps PCM) or data (X.25, frame relay)

SIP (Session Initiation Protocol) — RFC 3261

SIP is the IETF's text-based signaling protocol for VoIP and real-time communications. It has replaced SS7 for call control in modern networks:

• Ports: 5060 (UDP/TCP), 5061 (TLS)
• Architecture: User Agent (UA), Registrar, Proxy, Redirect server
• Text-based: Human-readable messages (unlike SS7's binaryMTP)
• SDP (Session Description Protocol): Negotiates media (codecs, ports, IPs)

Core SIP Methods

• INVITE: Initiates session; carries SDP with media parameters
• ACK: Confirms final response to INVITE
• BYE: Terminates session
• CANCEL: Cancels pending INVITE
• OPTIONS: Queries server capabilities
• REGISTER: Binds user URI to contact IP (for location)

SIP Response Codes

• 1xx: Provisional — 180 Ringing, 183 Session Progress
• 2xx: Success — 200 OK
• 3xx: Redirection — 302 Moved Temporarily
• 4xx: Request Failure — 404 Not Found, 486 Busy Here
• 5xx: Server Failure — 500 Server Internal Error
• 6xx: Global Failure — 603 Decline, 604 Does Not Exist Anywhere

IMS (IP Multimedia Subsystem)

IMS (3GPP TS 23.002) is the architecture enabling all-IP services — voice, video, messaging, and data — on LTE and 5G networks:

Core IMS Functions

• P-CSCF (Proxy Call Session Control Function): First contact for UE; all SIP messages pass through
• I-CSCF (Interrogating CSCF): Queries HSS to locate the appropriate S-CSCF
• S-CSCF (Serving CSCF): Main SIP registrar; maintains session state; handles authentication
• HSS (Home Subscriber Server): Master database — IMSI, subscription data, authentication keys
• VoLTE/VoNR: Voice bearer on LTE/5G data plane with IMS signaling

VoLTE (Voice over LTE)

• Radio: Voice carried over LTE radio bearer (GBR connection, QCI=1)
• IMS: SIP signaling via P-CSCF; S-CSCF handles call control
• Codecs: AMR (NB and WB), EVS (Enhanced Voice Services)
• TMSI-based paging: VoLTE devices paged via S-TMSI (SAE-Temporary Mobile Subscriber Identity)

VoNR (Voice over NR)

• 5G NR standalone (SA): Voice on 5G without LTE anchor
• EPS Fallback: VoNR may fall back to VoLTE if 5G coverage lost
• QCI: Voice QoS Class Identifier = 1 (GBR)

Diameter Protocol

Diameter (RFC 6733) replaces SS7 as the authentication/authorization protocol in 4G/5G networks. It is the foundation for the PCC (Policy and Charging Control) architecture:

• Gx: PCRF ↔ PCEF — policy rules for bearer QoS
• Rx: AF ↔ PCRF — application session parameters
• Sy: OCS ↔ PCRF — spending limits, charging
• SLh: HSS ↔ MME — subscriber location in LTE

GTP (GPRS Tunneling Protocol)

GTP manages tunnels for user data in 2G/3G/4G. GTP-C handles session management:

• Create Session: Establishes context for subscriber
• Update Session: Modifies QoS, bearer parameters
• Delete Session: Tears down subscriber context
• GTP-U: User plane — encapsulated data between SGSN/GGSN or S-GW/P-GW
• GTP': Charging data transfer to billing systems

Number Portability

Telephone Number Portability (TNP) allows subscribers to keep their number when changing carriers or service types:

• LNP (Local Number Portability): US wireline/wireless portability; query via LRN (Location Routing Number)
• NPAC (Number Portability Administration Center): Database of ported numbers; SS7 TCAP queries
• WNP (Wireless Number Portability): Portability between wireless carriers

When a call is placed to a ported number, the originating switch queries NPAC via SS7 TCAP to find the current switch serving that number (LRN), then routes accordingly.