SS7 Tutorial
SS7 Tutorial
SS7 Tutorial
This tutorial gives provides an introduction to the terms and structure of the Signalling System
Number 7 (SS7) protocol.
• What is a signalling protocol?
• The SS7 Protocol
• Message Transfer Part (MTP)
• MTP layer 2
• MTP Layer 3
• Telephony User Part (TUP)
INAP MAP
ISUP TUP
TCAP
SCCP
MTP Layer 3
MTP Layer 2
MTP Layer 1
MTP layer 2
The layer 2 part of the protocol provides reliable transfer of messages between two adjacent
nodes, ensuring that messages are delivered in sequence and error free. The SS7 protocol
specifies that empty frames known as Fill in Signal Units (FISU) should be sent when no signalling
information from the upper layers is waiting for transmission, hence the SS7 receiver always
expects to receive frames (information or empty) continuously, enabling rapid detection of any
failure or break in communication.
Layer 2 provides a method of message acknowledgement using sequence numbers and indicator
bits in both the forwards and backward direction. Each information message carries a Forward
Sequence Number (FSN) uniquely identifying that message. The message also carries a
Backwards Sequence Number (BSN) acknowledging the FSN of the last message successfully
received. Forward and Backward Indicator bits are toggled to indicate positive or negative
acknowledgement.
The two common methods for handling errors on SS7 links are either the basic method, whereby a
message is only retransmitted on receipt of a negative acknowledgement, and Preventative Cyclic
Retransmission (PCR), whereby a frame is repeatedly sent when the upper layers have no
information to be sent to the network. PCR is generally only used over transmission paths where
the transmission delay is large, such as satellite links.
Before an SS7 link is able to convey information from the higher layers, the layer 2 entities at each
end of the link follow a handshaking procedure known as the proving period, lasting for 0.5 to 8.2
seconds (depending on the availability of routes served by the link in question). During this time,
Link Status Signal Units (LSSU) are exchanged between the layer 2 parts of the protocol, enabling
both ends to monitor the number of received errors during this time. If less than a pre-set threshold,
the link enters the IN SERVICE state, and may now carry Message Signal Units (MSU) containing
information from the upper layers.
The layer 2 entities also monitor the state of the link and communicate link state information to their
peers in layer 2 messages or Link Status Signal Units (LSSU). These are transmitted, for example,
when links become congested or are taken out of service.
Figure 2 illustrates the three basic types of messages passed by layer 2 are therefore Fill In Signal
Units FISU, Link Status Signal Units LSSU and message Signal Units MSU.
Link Set
SS7
Signalling link
node #A
SS7
node #A
Link Set
SS7
node #A Link Set
MTP3 adds information into the Signalling Information Field (SIF) of the MSU described in Figure 2.
This includes a Destination Point Code (DPC) identifying the destination for a message, an
Originating Point Code (OPC) identifying the originator of a message and a Signalling Link
Selection (sls) value used by MTP3 to load share messages between links in a link set. Figure 4
shows the basic format of the MTP3 header part of an SS7 message.
SIO
SCCP
NI Pri SI 4
MTP3
TUP
NI Network indicator
Pri Priority (or spare) 5
SI Service indicator
Routing of messages to a destination by MTP3 can either be Quasi Associated, where a message
passes through an intermediate node before reaching its final destination or Fully Associated, in
which case there is a direct signalling connection between the sender and recipient of a message.
The intermediate nodes are known as Signalling Transfer Points (STP) which act as SS7 routers to
provide multiple paths to a destination in order to handle failures within the network. The Classic
SS7 architecture also defines two other types of nodes, a Service Switching Point (SSP) which is
the point where the service user access the network (using an access protocol), and a Service
Control Point (SCP) that contains network and data control functions (such as billing or free-phone
number translation).
Types of SS7 Nodes
Service Switching Points (SSP), connecting subscribers’ telephones and terminal equipment to the
network. These nodes contain large switching matrices in order to switch the high volumes of
traffic from the interconnected subscribers.
Signalling Transfer Points (STP) act as SS7 routers and give alternate paths to destinations when
one possible route to a destination fails. A true STP does not have any layer 4 (User Part) protocol.
Signalling Control Points (SCP) provide database and data processing functions within the
network, such as billing, maintenance, and subscriber control and number translation.
Figure 6 illustrates the three classic types of SS7 nodes
STP
SSP STP SSP
PSTN
STP
SSP STP
SCP
SSP
Database
Layer 4 protocols
The layer 4 protocols define the contents of the messages sent to MTP3 and sequences of
messages in order to control network resources, such as circuits and databases.
1 Circuit selected for outbound call attempt, dialled digits collected from calling user
analysed and a route for the call selected. The IAM contains information relating to the
called subscribed and optionally the calling subscriber.
2 Optionally additional address digits can be sent following the IAM if the calling subscriber
continues to enter destination digits.
3 The destination switch recognises the called party number and starts to alert the called
party (by ringing the telephone). At this point, the speech path is made in the backward
direction enabling the calling subscriber to listen to ring tone. The speech path may be
completed in the forward direction at this point.
4 The called subscriber answers. The speech path is completed in the forward direction.
5 The calling subscriber hangs up.
6 The destination switch signals that all resources associated with the circuit used for this
call have been released and may be re-used.
7 The originating switch signals that all outbound resources associated with the circuit used
for this call have been released and may be re-used.
Figure 8 shows a typical ISUP message sequence, many other messages may be exchanged
during a call in order to support a variety of subscriber services. Each ISUP message conveys
parameter data associated with the call, such as the called address, calling party category. Every
message is specified to contain mandatory fixed length parameters that will always be present,
mandatory variable length parameters (such as the called party address digits) and optional
parameters which can be used to convey additional information relating to a call, such as the
identification of the calling party. Figure 9 presents the structure of an ISUP message, carried in
the Signalling Information field of a MSU.
Message type
Mandatory fixed P1
Mandatory fixed Pn
Pointer to variable P1
Pointer to variable Pn
Pointer to optional P1
Variable P1
00 terminator
Class Properties
0 Connectionless, data is sent to a destination without negotiation of a
session
1 Connectionless with sequence control. Messages are guaranteed to be
delivered to a destination in sequence.
2 Connection oriented. A session (SCCP connection) is negotiated prior to
the exchange of data.
3 Connection orientated with flow control.
SCCP maintains a state of every sub-system that it is aware of, sub-systems may be on-line
(Allowed) or off-line (Prohibited). A message or connection session can only be delivered to an
allowed destination sub-system.
The most commonly used class of SCCP is 0 and 1, used by TCAP and higher layers in the control
of mobile/wireless and intelligent networks. Class 2 and 3 can be used by mobile networks in the
communication between radio base-stations and the base-station controller.
The basic message of connectionless SCCP is the SCCP UNITDATA (also called UDT). When
SCCP detects that a destination for a message is prohibited, the UDT can either be discarded or
returned to the originator as a UNITDATA SERVICE (UDTS) if a return option parameter is set in
the quality of service field of the message.
In order to track and report the status of sub-systems, SCCP transmits management messages,
encapsulated in UDT message, sent between the management entities of each SCCP. The table
below lists the SCCP management messages.
Management Function
message
SSA Sub-system allowed. Report that the affected sub-system has become
available for message routing.
SSP Sub-system prohibited. Report that the affected sub-system has been
taken off-line and is no longer available for message routing.
SST Check if the affected sub-system is available.
UOR Check that a duplicate sub-system is prepared to take the traffic of an
active sub-system wanting to go off-line.
UOG Grant an off-line request to a duplicate sub-system.
SST messages are generated and sent periodically (approximately every 30 seconds) to all
prohibited sub-systems in order to determine when routing to those destinations becomes
available. SCCP also provides an option to make sub-systems concerned about the state of other
sub-systems so that any change in routing status is reported immediately.
Figure 10 presents a typical SCCP connectionless message flow.
sub-system
taken off-line UDT (return message on error)
(prohibited)
UDTS (return reason = sub-system unavailable
SSP
SST
SST
SST
sub-system
made active
SSA
(allowed)
Data delivered
to sub-system
function
Figure 10 – Routing to a prohibited sub-system
Country A Country B
Roaming mobile
Subscriber
2. Translate GT account database
New called address =
Incoming Gateway
point code + Global
Title
International SS7
Network
Figure 10 – Use of GTT in GSM international roaming
Figure 10 shows how Global Titles are used in GSM-mobile operation to locate subscriber account
information (stored in a Home Location Register sub-system, HLR) from other networks as used for
international roaming. The subscribers account information is held in a database in the home
network, which has to be interrogated in order for the subscriber to obtain service from the visited
network. The database query is sent through SCCP, with a called address Global Title constructed
from information within the subscribers handset (generally either the Equipment Identity or Mobile
Subscriber Number), this giving sufficient information to route the message to the correct outgoing
gateway using global title translation. Subsequent translation within the home network routes the
query to the correct database.
Global title translation can also be used to determine the location of a free-phone translation
database (held at a SCP), by using the 800 number as a Global Title which is translated at an STP
to give the database containing the entry for a range of 800 numbers. For example, 800-1xxxxx
could match to database A and 800-2xxxxx could match to database B. This is illustrated in Figure
11.
5. The query reaches
1. Subscriber dials the database; a new
800-xxxxxxx called party number
is returned
3. The SSP does not
know the sub-system
number of the
translation database, SCP
so the query is sent
to a database with
global title set to the
dialled 800 number
STP
SSP 4. The STP 800 translation
translates the global database
title (probably a
2. To forward route range of values) to
the call, the 800 route the query to the
number must be sub-system number
translated to a real and point code of the
number correct database
Component
Component
Dialogue
TCAP message
Dialogue
Component
Component
The components that convey the operations and their results are listed below
Invoke
Invoke
Begin/Query
TC-BEGIN/QUERY
TC-CONTINUE/CONVERSATION
Continue/Conversation
Result
Result
Invoke
End/response TC-END/RESPONSE
Mobile
subscriber HLR
AuC
GMSC
PSTN
Base Base Station
Transceiver Controller (BSC)
System BTS
HLR
VLR HLR
AuC
EIR AuC
HLR Home Location register. Stores information for each subscriber, independent of
location.
GMSC Gateway MSC - inter-working between the mobile and fixed network or between
different mobile networks
AuC Authentication Centre
EIR Equipment Identity Register (for identification of lost or stolen MS)
MAP provides the capability for all of the above elements to inter-work, each exchange of
information taking place in a MAP service. Figure 15 shows how a mobile terminated call is routed.
HLR
3
6
4
5
GMSC 7
GMSC MSC/VLR
2
PSTN
1
IP SCP
SMP
SSP
The SSP (Service Switching Point) is the point of subscription for the service user, and is
responsible for detecting special conditions during call processing that cause a query for
instructions to be issued to the SCP.
The SCP (service Control Point) validates and authenticates information from the service user
(such as PIN information), processing requests from the SSP and issuing responses.
The IP (Intelligent Peripheral) provides additional voice resources to the SSP for playing back
standard announcements and detecting DTMF tones when gathering information from the user.
The SMP (Service Management Point) provides the administration of the service.
In an IN system, the service user interacts with the SSP (by dialling the called party number).
During the processing of the call, if certain pre-set conditions are met the SSP determines that this
is an IN call and contacts the SCP to determine how the call should continue. The SCP can
optionally obtain further caller information by instructing the IP to play back announcements and to
detect tones (DTMF) from the user, for example to collect PIN information. The SCP instructs the
SSP on how the call should continue, modifying call data as appropriate to any subscribed
services.
The IN standards present a conceptual model of the Intelligent Network that model and abstract
the IN functionality in four planes:
The Service Plane (SP) Uppermost, describes services from the users perspective. Hides details of
implementation from the user
The Global Functional Plane (GFP) contains Service Independent Building Blocks (SIBs), reusable
components to build services
The Distributed Functional Plane (DFP) models the functionality in terms of units of network
functionality, known as Functional Entities (FEs). The basis for IN execution in the DPF is the IN
Basic Call State Model.
The Physical Plane (PP) Real view of the physical network.
The IN standards specify a vendor independent standard Basic Call State Model (BCSM) defining
call processing states and events. Trigger Detection Points are pre-defined in both the Originating
Basic Call State Model OBCSM and the Termination Basic Call State Model (TBCSM), with non-
interruptible sequences of processing being termed Points-In-Call (PIC). Figure 17 shows the
Originating Basic Call State Model.
A normal call becomes an ‘IN call’ if a special condition is recognised during the call handling;
recognition of such a condition ‘triggers’ a query to an external control component (SCP). This
recognition takes place at pre-defined Detection Points DP in the call handling, which may be
armed (active) or not armed (inactive). DPs may be armed statically for a long period to implement
a particular IN service, or armed dynamically to report particular events and errors. The detection
points defined for the OBCSM are shown below
DP Name Function
1 Origination_attempt_authorized Call setup is recognized and authorized
2 Collected_Information Pre-defined number of dialed digits is collected
3 Analyzed_Information Dialed digits are analyzed
4 Route_Select_Failure Routing failed : no free channel, dialed number not
available, network overload
5 O_Called_Party_Busy Destination busy
6 O_NO_Answer Caller does not answer in predefined time, Service
Logic specifies the “no answer time” for SSP
7 O_Answer Called subscriber answers: SSP receives e.g. an ANM
8 O_Mid_Call Signal (hook flash, F-key) recognized during call
9 O_Disconnect A or B side hangs up
10 O_Abandon Call set-up discontinued by the A-side
1. O_Null & Authorise
10 5. O_Exception
Origination_Attempt
2. Collect_info
3. Analyse_info
4
3
4. Routing_&_Aalerting 5
6
7
9 5. O_Active
8
SSF SDF
TC-END
The set of services and features that an IN system supports is referred to as a Capability Set. The
current level of deployment of INAP is based around Capability Set 1 (CS1), which define single
ended, single point of control services, where either the calling or called subscriber controls the
INAP part of a call at any one time (but not both together). CS2, recently defined ads interaction
between called and calling parties to enable far more complex services to be built.
IP IP MTP Layer 1
IP PSTN/SS7
_____________________________________________________