SS7
Transcript of SS7
ppT=áåíêçÇìÅíáçå
SS7_SF_01_060418
I
S
U
PSCCP
T
U
PTCAP
MAPBSS
AP
RAN
AP
BSS
AP+
Users
RNS
AP
CAP INAP
MTP 3 MTP 3b M3UA
MTP 2SAAL-NNI SCTP
ATM IP
MTP 1 PHY L1 + L2
ST STMTP 2
Processor
`
ISUP
Processor
ISUP
error control
call handling
message handling
MTP 1 – signalling data linkMTP 2 – signalling linkMTP 3 – signalling network
0 16 31
MTP 3
TransportMTP
Application(“user part”)
ex. ISUP
transmission
SS7 overview
• circuit-related and non-circuit applications(inter-exchange, not on access interfaces)
• layered design(transport + application)
• common channel signalling(associated or quasi-associated)
• transport over PCM lines, ATM, IP
SS7 applications
• call handling in PSTN & PLMN (ISUP, TUP)• mobility & roaming (MAP, BSSAP+)• IN call handling (INAP, CAP)• RAN—core/RAN signalling (BSSAP, RANAP, RNSAP)
Classic SS7 layered structure
PCM coded speech8000 samples x 8 bits � 64000 bps
PCM line (E1)32 timeslots x 64 kbps � 2 Mbps
over PCM over ATM over IP
SS7 network elements
MTP rerouting onlylocal / transit exchangeMSC, BSC, HLR, ...SSF, SCF, ...
STP STP
SPSP SP
SL: channel for signalling messagesLS: all sig. links connecting two pointsSR: predetermined end-to-end path
SL LS
synch
ATM Asynchronous Transfer ModeBSC Base Station ControllerBSS Base Station SystemBSSAP Base Station System Application PartCAMEL Customised Application for Mobile network
Enhanced LogicCAP CAMEL Application PartGSM Global System for Mobile communicationsHLR Home Location RegisterINAP Intelligent Network Application Part
ISDN Integrated Services Digital NetworkISUP ISDN User PartIP Internet ProtocolLS Link SetM3UA MTP3 User AdaptationMAP Mobile Application PartMSC Mobile Switching CentreMTP Message Transfer PartPCM Pulse Code ModulationPLMN Public Land Mobile Network
PSTN Public Switched Telephony NetworkPS Packet SwitchedRAN Radio Access NetworkRANAP RAN Application PartRNS Radio Network SubsystemRNSAP RNS Application PartSAAL Signalling ATM Adaptation LayerSCCP Signalling Connection Control PartSCF Service Control FunctionSCTP Stream Control Transmission Protocol
SL Signalling LinkSP Signalling PointSR Signalling RouteSS7 Signalling System No. 7SSF Service Switching FunctionST Signalling TerminalSTP Signalling Transfer PointTCAP Transaction Capabilities Application PartTUP Telephone User PartUMTS Universal Mobile Telecommunications System
MTP 1
MTP 3
jqmI=é~êí=f
SS7_SF_02_ 060418
Signalling Link states
Idle – Out of serviceSIOS
Not alignedSIO
AlignedMSU FISU SIB SIPO
ProvingSIN or SIE
Normal or Emergencyalignment
Proving OK
Level 3order
Alignmentfailed
High errorrate onthe link
AERM
0.5 sec
1
8.2 sec
4
3
2
1
Normal alignment(max 5X)
Emergency alignment(max 1X)
SUERM
Failure
Ok
⊗⊗⊗⊗
⊗⊗⊗⊗
⊗⊗⊗⊗
⊗⊗⊗⊗
t
-1 if 256 SUs OK+1 if faulty SU
Loss of alignment64
# of errors
# of errors
CK SIF SIO LI EC F
BSNFSN BIB
FIBSINI
• routing label for MTP 3• user part information
• NI � national / international network• SI � SCCP, ISUP, TUP, …
for error detection2 2 4 1 7 1 7
CK LI EC F
no retransmissionsof FISU and LSSU
• 0 � FISU• 1 or 2 � LSSU• 2..63 � MSU
CK SF LI EC F
SIO, SIN, SIESIOS, SIPO, SIB
SIfor delimitationall fields between flagsrequire "bit stuffing":SEND: add 0 after every 11111RECV: delete 0 from every 111110
5 3
acknowledgements & retransmissions
� MSU
� LSSU
� FISU
16 max 8 * 272 8 2 6 16 8 bits
16 8 2 6 16 8 bits
16 2 6 16 8 bits
MTP level 2 functions
• transmission of level 3 messages in signal units• error detection and correction• signal unit delimitation• link alignment• link error monitoring
AERM Alignment Error Rate MonitorBIB Backward Indicator BitBSN Backward Sequence NumberCK Check bitsEC Error ControlF FlagFIB Forward Indicator BitFISU Fill-In Signal UnitFSN Forward Sequence Number
LI Length IndicatorLSSU Link Status Signal UnitMSU Message Signal UnitMTP Message Transfer PartNI Network IndicatorSF Status FieldSI Service IndicatorSIB Status Indication BusySIE Status Indication Emergency alignment
SIF Signalling Information FieldSIN Status Indication Normal alignmentSIO Service Information OctetSIO Status Indication Out of alignmentSIOS Status Indication Out of ServiceSIPO Status Indication Processor OutageSU Signal UnitSUERM Signal Unit Error Rate Monitor
I
S
U
PSCCP
T
U
PTCAP
MAPBSS
AP
RAN
AP
BSS
AP+
Users
RNS
AP
CAP INAP
MTP 3 MTP 3b M3UA
MTP 2SAAL-NNI SCTP
ATM IP
MTP 1 PHY L1 + L2
FailureOk
jqmI=é~êí=ff
SS7_SF_03_ 060418
MTP level 3 functions
• message routing• load sharing• message discrimination• message distribution• signalling network management• signalling link testing
I
S
U
PSCCP
T
U
PTCAP
MAPBSS
AP
RAN
AP
BSS
AP+
Users
RNS
AP
CAP INAP
MTP 3 MTP 3b M3UA
MTP 2SAAL-NNI SCTP
ATM IP
MTP 1 PHY L1 + L2
Routing & load sharing
2-55 2-66
2-10 2-20 2-30
STP
SP
STP
SP SP
SLC=0=1
DPC LS SLC
2-20 2-20 0
2-55 0 or 1
2-66 0 or 1
2-30 2-55 0 or 1… … …
load sharing (among SLs)load sharing (among LSs)
high priority
MTP addressing
DPCOPCSLS[ CIC ]UP msg
TUP and ISUP only
for loadsharing
12+4 4 14 14 2 2 2 bits
routing label
SINI
SIF SIO
whereFROM
whereTO
national (2)international (0)
OPC/DPCNI
National addressassigned nationally
International addressassigned by ITU-T
e.g. 2 – 8277
e.g. 0 – 7-246-1
Signalling AreaNetwork Code
pointcode
indicate node where UP creates/receives the message, not STP address
NI,DPC � SLSLS � one of SLsNI,DPC � deliver or rerouteSI � user part
SNM & SNT
• Signalling link managementcontrol locally connected links
• Signalling traffic managementdivert signalling among available links
• Signalling route managementdistribute status & routing info
• Signalling link testingafter alignment and periodically
Example procedures
COO
COA
TFP
RST
TFA
SLTM
SLTA
divert signalling fromunavailable link
rerouting to DPC=x not possible
rerouting to DPC=x possible again
periodic test: rerouting possible?
done by both sidestest bit pattern sent
0: SNM1: SNT3: SCCP4: TUP5: ISUP
messages sent in MSUs
CIC Circuit Identity CodeDPC Destination Point CodeLS Link SetLSSU Link Status Signal UnitMSU Message Signal UnitNI Network Indicator
OPC Originating Point CodeSANC Signalling Area Network CodeSI Service IndicatorSIF Signalling Information FieldSIO Service Information OctetSL Signalling Link
SLC Signalling Link CodeSLS Signalling Link SelectionSNM Signalling Network ManagementSNT Signalling Network TestingUP User Part
fprm
SS7_SF_04_ 060418
ISUP functions
• circuit-related call control (setup, conversation, cleardown)
• link-by-link signalling• interworking (older ISUP and other systems)• support for basic and supplementary
services
Example flow
IAMIAM
basic call setup
CPGCPG
ACM ACM
CPG CPG
ANM ANM
SUS SUS
RESRES
REL REL
RLCRLC
CGB
CGBA
CGU
CGUA
select circuitcreate messagethrough-connect �
called party found
event, e.g. alerting
called party answer
event, e.g. on-hold,forwarding, …
e.g. analogue on-hook
suspend & resume
call release
block group of circuits
unblock group of circuits
mandatoryvariable
SIF SIO
Message structure
CIC DPCOPC
SL
S
messagetype
mandatoryfixedoptional
ABCABCPD
POP
DE PE
LD
LH
LE
NHHL
KNKKE
OP
P = Pointer L = Length N = Parameter name OP = Optional Part EOP = End of Opt. Part
no CIC inSCCP
select circuitthrough-connect ��
connect ring tone (if speech)
through-connect ��
disconnectstop charging
O&M: block
through-connect �charge
circuit released
e.g. analogue off-hook
O&M: unblock
T7
T9
T2
T1T5
also SCCP
Interworkingwith other versions of ISUP
ABC
CFN• unknown msg• bad param• unknown param
ABC
• param X• param Y• param Z• param info
Confusion message Parameter compatibility info
• re-send modified message• send another message• release call
• param X: notify / discard / pass / release call• param Y: . . . . . / . . . . . . /. . . . . /. . . . . . • . . .
info what to do withunrecognized parameters
T1: max 15 .. 60 secexpiry � restart, resend
T5: max 5 .. 15 minexpiry � circuit reset
T7: max 20 .. 30sT9: max 1.5 .. 3 minexpiry � release
T2: max 3 minexpiry � release
I
S
U
PSCCP
T
U
PTCAP
MAPBSS
AP
RAN
AP
BSS
AP+
Users
RNS
AP
CAP INAP
MTP 3 MTP 3b M3UA
MTP 2SAAL-NNI SCTP
ATM IP
MTP 1 PHY L1 + L2
CIC Circuit Identity CodeDPC Destination Point CodeISDN Integrated Services Digital NetworkISUP ISDN User PartOPC Originating Point Code
SCCP Signalling Connection Control PartSIF Signalling Information FieldSIO Service Information OctetSLS Signalling Link Selection
p``m
SS7_SF_05_ 060418
I
S
U
PSCCP
T
U
PTCAP
MAPBSS
AP
RAN
AP
BSS
AP+
Users
RNS
AP
CAP INAP
MTP 3 MTP 3b M3UA
MTP 2SAAL-NNI SCTP
ATM IP
MTP 1 PHY L1 + L2
SCCP messages
UDTUDT
UDTUDT
UDT
UDTS
SCCP modes
Connectionless
Connection-oriented
• address included in each message• each message routed independently• GT translation in each node• class 0 � basic• class 1 � sequenced delivery
• used in GSM/UMTS core network
called addrcalling addruser data
sent iferror
RLCRLC
DT1DT1
setup
DT1DT1
DT1DT1dest ref no
user data
• addresses included in CR only• logical connection � ref numbers• fixed path in the network• class 2 � basic• class 3 � flow controlled
• used between MSC and BSC/RNC
RLSDRLSD
ITIT
sent when idle(5 .. 10 min)
CRCR
CCCC
datatransfer
release
format same as in ISUP
SCCP functions
• addition to MTP• global addressing & routing using GT• non-circuit related signalling• connectionless and connection-oriented
SCCP addresses
combination of• GT � routing• SSN � distribution• SPC
T(ias) expires � send ITT(iar) expires � releaseanything received � T(iar) reset T(iar) > 2 * T(ias)
GT translationstart of GT � next node DPC
GT: +48… +48601… +486014… +48601445
GT translation (optional)SSN � SCCP user
GT = digits + numbering plan + translation type + nature of addrSSN = number (1..255) identifying SCCP user
Addressing in 3GPP network
GMSC MSC/VLR
HLR
Call interrogationGT = MSISDN, NP = E.164, SSN = 6
First contactGT = MGT, NP = E.214, SSN = 6
IMSI = 260 01 1234567890MGT = +48 603 1234567890
Other casesGT = preconfigured or received earlier
SCCP management
• maintain status info on other nodes & their subsystems• MTP indications � node status• own broadcasts & tests � subsystem status
CL ConnectionlessCO Connection OrientedDPC Destination Point CodeE.164 ISDN/telephony numbering planE.212 IMSI numbering planE.214 ISDN/IMSI numbering planGT Global TitleMGT Mobile Global Title
MSISDN Mobile Subscriber ISDN NumberNP Numbering PlanRNC Radio Network Controller SSN SCCP Subsystem NumberSPC Signalling Point CodeSCCP Signalling Connection Control PartTT Translation Type
q`^m
SS7_SF_06_ 060418
I
S
U
PSCCP
T
U
PTCAP
MAPBSS
AP
RAN
AP
BSS
AP+
Users
RNS
AP
CAP INAP
MTP 3 MTP 3b M3UA
MTP 2SAAL-NNI SCTP
ATM IP
MTP 1 PHY L1 + L2
TCAP functions
• generic services for application entities• transaction-oriented communication• component handling • dialogue handling
Protocol model
MTP+SCCP
MAPMSC
MAPVLR
INAP
TCAP TCAPTCAP
ApplicationEntities
NetworkService
Part
TCAP useroperations
ASN.1 and BER
• higher layer protocols � complex data types• separate notation (ASN.1) from coding (BER)• complex types made from basic types � primitives & constructors
Tag
Length
Content
what IT is �
how long �
IT is
here IT is �
Tag
Length
Message type tag
Message length
Transaction Id tag
Transaction Id length
Transaction Id
Component portion tag
Component portion length
Component type tag
Component length
Operation code tag
Operation code length
Operation code
Invoke Id tag
Invoke Id length
Invoke Id
Operation parameters
ex. BEGIN
ex. 123
ex. INVOKE
ex. �
ex. Update Location
ex. IMSI, MSC/VLR addr
TCAP + MAP message
TCAP + MAP example
BEGIN 123INVOKE �Update location
(IMSI,MSC/VLR addr)BEGIN 456INVOKE � Cancel location
(IMSI)CONTINUE 123INVOKE � Insert subscriber data
(MSISDN,services)
CONTINUE 123RET. RESULT �
END 123RET. RESULT �Update location
(HLR addr)
END 456RET. RESULT �
HLRVLR VLR
new oldnew subscriber in VLR: location update
Component sublayercomponents: INVOKE, RET. RESULT, RET. ERRORinvoke id n
Transaction sublayermessages: BEGIN, CONTINUE, ENDtransaction id nnn
AE Application EntityASN.1 Abstract Syntax Notation OneBER Basic Encoding RulesHLR Home Location RegisterIMSI International Mobile Subscriber IdentityINAP Intelligent Network Application Part
MAP Mobile Application PartMS Mobile StationMSC Mobile Switching CentreNSP Network Service PartTCAP Transaction Capabilities Application PartVLR Visitor Location Register
SMS-IWMSC
j^mI=é~êí=f
SS7_SF_07_060418
MSC
HLR
VLR
MSC VLR
AUCEIR
SGSN GGSN
SMS-GMSC gsmSCF
B
MAP interfaces in GSM/UMTS
B
C
C:• interrogation at MT call (GMSC)• interrogation at MT SMS transfer
D
D: location and subscriber data management (CS)
E
E: • inter-MSC handover or relocation• SMS transfer
B: internal (not standardised)
Notes• MSC � MSC server if split architecture (Rel-4)• HLR+AUC+other database � Home Subscriber Server (HSS, Rel-5)• MAP also for: location services (R99), Gateway Location Register (GLR)• SCCP CL class 0 and 1 used, SSN mandatory
F
F, Gf: IMEI verification
G
G: IMSI and triplets retrieval
H
H: triplets requests(not standardised)
Gr
Gr: location and subscriber data management (PS)
Gc
Gf
Gc: interrogation at network-requested packet session(optional)
Gd
Gd: SMS transfer
E
C
“IN”
“IN”: MS state/location requests; USSD requests from MS
Every operation comes with Application Context version
Version negotiation
fixed part:“ETSI mobile GSM MAP AC”
AC name:“networkLocUpContext”1 name �� few operations (1..7)
MAP operation(sent in component)
AC version(sent in TCAP dialogue portion)
version(1,2,3,4)
UPDATE LOCATION 4 – 0 – 0 – 1 – 0 – 1 – 3
CONT/END ACCEPT AC v2INV/RET OP-Y/X (…)
ABORT ABORT AC v2
BEGIN OPEN AC v3INVOKE OP-X (…)
BEGIN OPEN AC v2INVOKE OP-X (…)
new dialogue
initial version based on dest addr (or default)
operation component optional
version OK
dialogue portion not used later
alternative version offered
MAP “versions”
AC Application ContextAUC Authentication CentreCL ConnectionlessCS Circuit SwitchedEIR Equipment Identity RegisterGGSN Gateway GPRS Support NodeGMSC Gateway MSCGPRS General Packet Radio Service
HLR Home Location RegisterIMEI International Mobile Equipment IdentityIMSI International Mobile Subscriber IdentityIN Intelligent NetworkIWMSC Interworking MSCMAP Mobile Application PartMSC Mobile Switching CentreMT Mobile Terminating
NP Numbering PlanPDP Packet Data ProtocolSCF Service Control FunctionSGSN Serving GPRS Support NodeSSN SCCP Subsystem NumberUSSD Unstructured Supplementary Service DataVLR Visitor Location Register
I
S
U
PSCCP
T
U
PTCAP
MAPBSS
AP
RAN
AP
BSS
AP+
Users
RNS
AP
CAP INAP
MTP 3 MTP 3b M3UA
MTP 2SAAL-NNI SCTP
ATM IP
MTP 1 PHY L1 + L2
j^mI=é~êí=ff
SS7_SF_08_060418
I
S
U
PSCCP
T
U
PTCAP
MAPBSS
AP
RAN
AP
BSS
AP+
Users
RNS
AP
CAP INAP
MTP 3 MTP 3b M3UA
MTP 2SAAL-NNI SCTP
ATM IP
MTP 1 PHY L1 + L2
HLR
MSCVLR
Example MAP procedures
Update location
Insert subsc. data
Update location
Insert subsc. data
Send routing info
Cancel location
GMSC
Cancel location
Process USS req
Send routing info
Check IMEI
Check IMEI
Get password
Activate SS
Get password
MSCVLR
Activate SS
Process USS req
location update (new subscriber, TMSI used)
return IMSI & unused triplets
delete subscriber record
update location info in HLR & get subscriber profile
incoming call with MSISDN
return white/grey/black
HLR
continue call with received MSRN
check phonee.g. at call setup
request handled in MSC, HLR, gsmSCF, or elsewhere
C I
Send Identification
E RR
E RR
B I
E RR
C RR
C I
B I
E RR
C RR
E RR
B I
E RR
B I
E RR
B I
B I
E RR
B= BEGINC= CONTINUEE= END
I = INVOKERR= RETURN
RESULT
Send Identification
EIR
Provide roaming no
Provide roaming no
E RR
B I
allocate & return MSRN
code required e.g. for barring services
Process USS reqProcess USS reqB I B IUSSD request received from MS
suppl. service management
(components sent to/from MS)
SGSN
SMS-GMSC
SMSC
Send routing info for SM
Send routing info for SME RR
B I
MT Forward SM
MT Forward SME RR
B I
return serving MSC address
Forward MO SM
Forward MO SME RR
HLR
Forward MT SM
Forward MT SME RR
B I
deliver SMS
MSCVLR
MO Forward SM
MO Forward SME RR
B I B ISMS via GPRS
from MS
ResetReset
sent to all VLRs and SGSNs on HLR reloadloc. update redone on radio contact
for all IMSIs from HLR
B I B I
SGSNHLRMSCVLR
to/from SMSC:not MAP
SMS-IWMSC
B / C / E BEGIN / CONTINUE / ENDI / RR INVOKE / RETURN RESULTIMSI International Mobile Subscriber IdentityMO Mobile OriginatedMSISDN Mobile Subscriber ISDN NumberMSRN Mobile Station Roaming Number
MT Mobile TerminatedSM Short MessageSMSC Short Message Service CentreTMSI Temporary Mobile Subscriber IdentityUSSD Unstructured Supplementary Service Data
gsmSCF
ST
P
SS
7_S
F_0
9_06
0418
LE
VL
R
TE
GM
SC
MS
C
HL
R
BS
S / R
NS
IAM
UD
T{B
EG
IN-I
NV
OK
E (
Sen
d R
outin
g In
fo)
}
UD
T{E
ND
-RE
TU
RN
RE
SU
LT (
Sen
d R
outin
g In
fo)
}
UD
T{B
EG
IN-I
NV
OK
E (
Pro
vide
Roa
min
g N
o)}
UD
T{E
ND
-RE
TU
RN
RE
SU
LT (
Pro
vide
Roa
min
g N
o)}
UD
T (
Pag
ing)
“Pag
ing”
Est
ablis
hmen
t ofs
igna
lling
radi
oco
nnec
tion
CR
(P
agin
g re
spon
se)
Pag
ing
resp
onse
CC
Aut
hent
icat
ion
and
star
t of s
ecur
ity fu
nctio
ns
Est
ablis
hmen
t of t
raffi
c co
nnec
tion
AC
M
Aw
aiti
ng
answ
er in
dic
atio
n (e
.g. r
ing
tone
)
IAM AC
M
CP
GC
PG
AN
MA
NM
IAM AC
M
CP
G
AN
M
Tra
ffic
SC
CP
rela
yS
CC
Pre
lay
DT
1 (C
onne
ct A
ck)
Con
nect
Ack
DT
1 (S
etup
)S
etup
DT
1 (C
all c
onfir
med
)C
all c
onfir
med
DT
1 (A
lert
ing)
Ale
rtin
g
DT
1 (C
onne
ct)
Con
nect
dial
led
no�
rout
eIS
UP
:se
lect
circ
uit
prep
are
mes
sage
MT
P: D
PC�
SL
LE
TE
calle
d pa
rty
num
ber
fwd
call
indi
cato
rsna
ture
of c
onne
ctio
ntr
ansm
issi
on m
ediu
m r
equi
rem
ent
[cal
ling
part
y nu
mbe
r][s
ervi
ce in
fo]
MS
ISD
Ndi
alle
d
dial
led
no�
inte
rrog
ate
MA
P+
TC
AP
:st
art d
ialo
gue
calle
d ad
dr =
MS
ISD
N
2-20
2-30
2-40
2-50
2-70
2-10
2-60
2-80
2-90
MT
P:
OP
C=
10D
PC
=20
MT
P:
OP
C=
20D
PC
=30
OP
C=
30 D
PC
=40
OP
C=
40 D
PC
=60
OP
C=
60 D
PC
=70
SC
CP
:•
[GT�
deliv
er]
•S
SN�
MA
P-H
LR
SC
CP
:G
T�
DP
CM
TP
:D
PC�
SL
MT
P: D
PC�
SL
SC
CP
:G
T�
DP
CM
TP
:D
PC�
SL
calle
d ad
dr(G
T=
MS
ISD
N,S
SN
=6)
calli
ng a
ddr
(GT
=G
MS
C,S
SN
=8)
tran
sact
ion
idin
voke
idA
C v
er
MS
ISD
NG
MS
C c
apab
ilitie
sin
terr
ogat
ion
type
[ser
vice
info
]
MS
ISD
N�
IMS
I�M
SC
/VLR
add
r
calle
d ad
dr(G
T=
VLR
,SS
N=
7)ca
lling
add
r(G
T=
HLR
,SS
N=
6)
IMS
IM
SC
add
r [s
ervi
ce in
fo]
MS
RN
MS
atta
ched
?al
loca
te M
SR
NM
SR
N��
IMS
Ist
art t
imer
MS
RN
cont
inue
cal
l set
upw
ith M
SR
N
dial
led
no�
rout
eIS
UP
:se
lect
circ
uit
prep
are
msg
MT
P: D
PC�
SL
calle
d pa
rty
no=
MS
RN
now
dial
led
no�
MS
RN
ser
ies
MS
RN�
IMS
Ire
leas
e M
SR
NIM
SI�
regi
stra
tion
area
IMS
I, T
MS
Iar
ea id
caus
e/ch
anne
l
no G
T, S
SN
=25
4 if
BS
SA
P14
2 if
RA
NA
P
TM
SI o
r IM
SI
allo
cate
& s
etup
:S
DC
CH
if G
ER
AN
SR
B if
UT
RA
N
star
t SC
CP
con
nect
ion
no G
Tsr
c re
f no
no G
Tsr
c re
f no
dest
ref
no
dest
ref n
o
[bea
rer
capa
bilit
ies]
[cal
ling
part
y nu
mbe
r]
[bea
rer
capa
bilit
ies]
allo
cate
& s
etup
TC
H if
GE
RA
NR
AB
if U
TR
AN
back
war
d ca
ll in
dica
tors
[ech
o co
ntro
l inf
o]
back
war
d ca
llin
dica
tors
— — —
even
t inf
o(=
aler
ting)
answ
er
ringi
ng
GE
RA
NG
SM E
DG
E R
adio
Acc
ess
Net
wor
kM
SR
NM
obil
e St
atio
n R
oam
ing
Num
ber
RA
BR
adio
Acc
ess
Bea
rer
SDC
CH
Stan
d-A
lone
Ded
icat
ed C
ontr
ol C
hann
el
SRB
Sign
allin
g R
adio
Bea
rer
TC
HT
raff
ic C
hann
el
UT
RA
NU
nive
rsal
Ter
rest
rial
Rad
io A
cces
s N
etw
ork
jçÄáäÉ=qÉêã
áå~íáåÖ=`~ää=bëí~ÄäáëÜãÉåí
`^jbi=~åÇ=`^m
SS7_SF_10_060418
gsmSCF
CAMEL introduction
incomingcall leg
outgoingcall leg
orders
reports/ack’s
• flexible call handling• in G/MSC and SGSN
• service logic and execution• in Home PLMNCAP
I
S
U
PSCCP
T
U
PTCAP
MAPBSS
AP
RAN
AP
BSS
AP+
Users
RNS
AP
CAP INAP
MTP 3 MTP 3b M3UA
MTP 2SAAL-NNI SCTP
ATM IP
MTP 1 PHY L1 + L2
R96R97/R98R99/Rel-4Rel-5/Rel-6
Ph 1: basic call rerouting, simple VPNPh 2: prepaid, DTMF and announcementsPh 3: call handling improvements, GPRS prepaidPh 4: IMS support, GPRS improvements
MAP
CAMEL Subscription Info:zero/one/many per IMSI
• trigger DP or list (O-/T-/VT-/GPRS-/SMS-CSI)
• mobility event or list (M-/MG-CSI)• SS code or list (SS-CSI)• service key• gsmSCF address• default call handling• dialled num (D-CSI only)
IN triggering
HLR
MSC
SGSN
GMSC
CSI sent in ISD at GPRS loc. updateGPRS sessionsattach/detach/RA updateMO/MT SMS via GPRS
CSI sent in SRI responseMT call forwarding of MT call
CSI sent in ISD at location updateall/selected MO/forwarded callsMT callsattach/detach/LA updateMO/MT SMSSS invoke notifications
Example CAP procedures
announcements andtone receivers
gsmSRF
gsmSSF
gsmSCF
gsmSRF
gsmSSF
ISUP
for CS call handling
VLR
SRI
ISD
ISD
M-CSI Mobility Management CSIMG-CSI Mobility Management for GPRS CSIMO Mobile OriginatingMT Mobile TerminatingO-CSI Originating CSIPLMN Public Land Mobile NetworkRA Routing AreaSCF Service Control FunctionSRF Specialised Resource FunctionSRI MAP Send Routing InfoSS Supplementary ServiceSS-CSI Supp. Service Invocation Notification CSISSF Service Switching FunctionT-CSI Terminating CSIVPN Virtual Private Network VT-CSI Visited MSC Terminating CSI
BCSM Basic Call State ModelCAMEL Customised Application for Mobile network
Enhanced LogicCAP CAMEL Application PartCS Circuit SwitchedCSE CAMEL Service EnvironmentCSI CAMEL Subscription InformationD-CSI Dialled Services CSIDP Detection PointDTMF Dual Tone Multiple FrequencyIMS IP Multimedia SubsystemIMSI International Mobile Subscriber IdentityIN Intelligent NetworkINAP Intelligent Network Application PartISD MAP Insert Subscriber DataLA Location Area
Disconnect Forward Connection–
Initial DPB#, service key, IMSIMSISDN, call ref no
Req Report BCSM Eventarmed DPs
Prompt And Collect User Infomsg/tone id, # of digits
Event Report BCSM Eventevent [, info]
service logicexecution starts
clear down at any phase
monitor call event(s)
e.g. for prepaid
proceed with suspended call
Apply Chargingtimer, tone? release? A/B?
Apply Charging Reportduration, active/released
Release Callcause
charging notification
release SSF-SRF connection
Connect To ResourcegsmSRF num
inband interactionask for DTMF digits
Continue–
set up SSF-SRF connection
route call to specificdestination
Connectcalled party number
event notification
call
actio
nstr
igge
rev
ent h
andl
ing
SR
F in
tera
ctio
n
jqm=çîÉê=^qj
SS7_SF_11_060418
I
S
U
PSCCP
T
U
PTCAP
MAPBSS
AP
RAN
AP
BSS
AP+
Users
RNS
AP
CAP INAP
MTP 3 MTP 3b M3UA
MTP 2SAAL-NNI SCTP
ATM IP
MTP 1 PHY L1 + L2
SSCF & SSCOP procedures
BGAK
SD (In Service)
POLL
STAT
BGN
SD (Normal)
POLL
STAT
link proving:repeat
1000 timesmax 30 sec
alignmentsuccessful
alignmentorder
other side doesthe same
ignored
Normal link alignment
SD N(S)=7N(S)=8N(S)=10N(S)=11
USTAT N(R)=7, lost list
SD N(S)=6N(S)=7N(S)=8N(S)=9 error
detected
Error control
STAT N(R)=3, lost list
SD N(S)=3N(S)=4N(S)=5
POLL N(S)=5
SD N(S)=1N(S)=2N(S)=3N(S)=4
pollingevery
100 ms reply topolling
SA
AL-
NN
IMessage handling
"simulation" of signalling linklink status control
CPAAL 5
SSCS
as classic MTP level 3, except:• max SIF size is 4095 octets (was 272)• new SNM procedure: extended changeover
n*48 octets sent as n ATM cellsno header / trailer added
error detectionpadding to m*48 octets
sequence and error controlflow controlconnection-oriented transmission
SIF SIO
SSCF PDU
InfoTrailer
more than 4 octets
4 octets
Pad
4 oct 0..3 max 4096
SAR PDU• uses ATM User-to-User Indication bit:� last/not last segment� in Payload Type in ATM header
4*n octets
MTP 3b
SSCF
SSCOP
CPCS
SAR
InfoTrailer Pad
8 oct 0..47 max 65535
48*m octets
Sent in Sequenced Data PDUTrailer:• PDU type (= SD here)• Pad Length (0..3)• N(S) – 24-bit send seq num
SAR PDU SSCF PDU
48 octets 48 octets
payload for one ATM cell
Trailer:• CRC for error detection• Length of Info• User-to-User Info not used• CP Indicator by SSCOP
Functional overview
ATM Asynchronous Transfer ModeCP Common PartCPCS CP Convergence Sub-layerCRC Cyclic Redundancy CheckNNI Network Node InterfaceN(R) Receive sequence NumberN(S) Send sequence NumberPDU Protocol Data UnitSAAL Signalling ATM Adaptation LayerSAR Segmentation And ReassemblySDU Service Data UnitSIF Signalling Information FieldSIO Service Information OctetSNM Signalling Network ManagementSSCF Service Specific Coordination
FunctionSSCOP Service Specific Connection Oriented
Protocol
ppT=çîÉê=fmI=é~êí=f
SS7_SF_12_060418
I
S
U
PSCCP
T
U
PTCAP
MAPBSS
AP
RAN
AP
BSS
AP+
Users
RNS
AP
CAP INAP
MTP 3 MTP 3b M3UA
MTP 2SAAL-NNI SCTP
ATM IP
MTP 1 PHY L1 + L2
RNC
RNC
MGW
MSCserver
trafficTE
VLR
HLR
G/MSC
HLR
SG
MGW
GMSCserver
Some SS7 over IP interfaces
RNSAP
ISUP
IP-based UTRAN IP-based CS core network non-IP PLMN/PSTN
RANAP
ISUP
MAP
MAP
IP-based Servers (IPS) if point-to-pointApplication Servers (AS) if via SG
Signalling Points (SP)
MAP//CAP
TCAP
SCCP
MTP 3
MTP 2
MTP 1
SCTP
L1+L2IP
M2UA
UserPart
MTP 3
Protocol overview
M2PA
UserPart
MTP 3
SCTP
L1 L2IP
M3UA
UserPart
SCTP
L1+L2IP
SUA
SCCPUser
SCTP
L1+L2IP
TUA
TCAPUser
SCTP
L1+L2IP
classic SS7SS7 over IP options
standardised forUTRAN and core net
• based on TCP• acknowledged, packet-oriented error-free, non-
duplicated data transfer• data segmentation• resistance to blind attacks• multi-homing support (primary + backups)
SCTP functions
Chunk[s] Header
SCTP packet
• verification tag• src + dest port num• checksum
• type, length, flags• stream id• SSN, TSN• other fields
if DATA
one or more in packet(“chunk bundling”)
Y
Y
X
Y
DATA DATA
HEARTBEAT
HEARTBEAT ACK
DATA
cookie = encryptedprotocol state data
INIT tag X [, backup addrs]
INIT ACK tag Y, cookie [, backup addrs]
COOKIE ECHO cookie [ DATA ]
COOKIE ACK [ DATA ]
start association
DATA TSN, SSN, payload data, …
DATA DATA DATA
SACK TSN, duplicates, gaps
DATA DATA
also sent to inactive
0
X
Y
X
too many retrans.� use backup
primary restored
AS Application ServerCS Circuit SwitchedIP Internet ProtocolIPS IP-based ServerM2PA MTP2 User Peer-to-peer AdaptationM2UA MTP2 User Adaptation
retransmissionsto backup addr
M3UA MTP3 User AdaptationMGW Media GatewaySCTP Stream Control Transmission ProtocolSG Signalling GatewaySP Signalling PointSSN Stream Sequence Number
SUA SCCP User AdaptationTCP Transmission Control ProtocolTE Transit ExchangeTSN Transmission Sequence NumberTUA TCAP User Adaptation
Example packet flow
Y
Y
X
Y
primary
backup
ppT=çîÉê=fmI=é~êí=ff
SS7_SF_13_060418
I
S
U
PSCCP
T
U
PTCAP
MAPBSS
AP
RAN
AP
BSS
AP+
Users
RNS
AP
CAP INAP
MTP 3 MTP 3b M3UA
MTP 2SAAL-NNI SCTP
ATM IP
MTP 1 PHY L1 + L2
M3UA introduction
• emulates MTP functions over IP+SCTP• supports multi-homing
primary + backup(s)load sharing
• two modesAS—SGIPS—IPS
M3UA
UserPart
SCTPM3UA
UserPart
SCTP
MTP3 primitives
IPS—IPS (“peer-to-peer” signalling)
IPS IPS
M3UA
UserPart
SCTPM3UASCTP
MTP3MTP2
AS—SG (“border” signalling)
MTP3 primitives
AS SG
Addressing & routing
• one SCTP association �� one or many RCs• dynamic RK registration possible
SCTP associationIP addr(s)
Routing KeyDPCSI listOPC or listCIC range
optional
• point codes still used (also for IP nodes)
Routing Context32-bit integer
n:1
1:1
ASPAC RCs, mode
ASPAC ACK RCs, mode
NTFY RCs, status
NTFY RCs, status
DAUD RC, DPC
DAVA RC, DPC
DATA SIO, SIF, RC
DATA SIO, SIF, RC
DATA SIO, SIF, RC
DUNA RC, DPC
DAUD RC, DPC
Example message flows
Network managementoptional RKregistration
Establishment of association
ASPUP ASP id
ASPUP ACK
ASPUP ASP id
ASPUP ACK
REG REQ RKs, RCs
REG RESP RKs, RCs
User Part data transfer
M3UA message
• version• message class& type
• length
• type• length• value(s)
Param Header…Param
AS Application ServerASP Application Server ProcessCIC Circuit Identity CodeDPC Destination Point CodeIPS IP-based Server
M3UA MTP3 User AdaptationOPC Originating Point CodeRC Routing ContextRK Routing KeySCTP Stream Control Transmission Protocol
SG Signalling GatewaySI Service IndicatorSIF Signalling Information FieldSIO Service Information OctetSP Signalling Point
status:• inactive• active• pending
mode:• override• loadshare• broadcast
remoteSP up
if loadsharing
remoteSP down
jÉëë~ÖÉ=äáëíë
SS7_SF_14_060418
CBA Changeback-acknowledgement signalCBD Changeback-declaration signalCNP Connection-not-possible signalCNS Connection-not-successful signalCOA Changeover-acknowledgement signalCOO Changeover-order signalCSS Connection-successful signalDLC Signalling-data-link-connection-order signalECA Emergency-changeover-acknowledgement signalECO Emergency-changeover-order signalLFU Link forced uninhibit signalLIA Link inhibit acknowledgement signalLID Link inhibit denied signalLIN Link inhibit signalLLT Link local inhibit test signalLUA Link uninhibit acknowledgement signalLUN Link uninhibit signalLRT Link remote inhibit test signalRCT Route-set-congestion-test signalRSM Route-set-test messageRSR Route-set-test signal for restricted destinationRST Route-set-test signal for prohibited destinationTFA Transfer-allowed signalTFC Transfer-controlled signalTFP Transfer-prohibited signalTFR Transfer-restricted signalTRA Traffic-restart-allowed signalUPU User part unavailable signal
(national options are in italics)
ANSI only
TCP Transfer-cluster-prohibited signalTCR Transfer-cluster-restricted signalTCA Transfer-cluster-allowed signalRCP Signalling-route-set-test cluster-prohibited signalRCR Signalling-route-set-test cluster-restricted signalTRW Traffic restart-waiting signal
MTP Signalling Network Management
SLTM Signalling Link Test MessageSLTA Signalling Link Test Acknowledgement message
MTP Signalling Network Testing
REL ReleaseRLC Release completeRSC Reset circuitRES ResumeSGM SegmentationSUS SuspendUBL UnblockingUBA Unblocking ackUCIC Unequipped CICUPA User Part availableUPT User Part test
ITU-T ISUP
CON ConnectCRG Charge informationFAA Facility acceptedFRJ Facility rejectFAR Facility requestOLM OverloadSAM Subsequent addressUSR User-to-user information
ANSI ISUP
CRM Circuit ReservationCVR Circuit Validation ResponseCVT Circuit Validation TestEXM Exit
ISDN User Part
ANSI only, removed from ITU-T
CMC Call Modification CompletedCMR Call Modification RequestCMRJ Call Modification RejectCSVR CUG Selection & Validation RequestCSVS CUG Selection & Validation ResponseDRS Delayed ReleaseFAD Facility DeactivatedFAI Facility Info
ETSI ISUP
APM Application TransportCON ConnectCRG Charge informationFAA Facility acceptedFRJ Facility rejectFAR Facility requestOLM OverloadPRI Pre-release InformationSAM Subsequent addressUSR User-to-user information
ITU-T and ETSI messages for nationaluse only are marked in italics. ANSI ISUP includes all these messages.
Common messages
ACM Address completeANM AnswerBLO BlockingBLA Blocking ackCPG Call progressCGB Circuit group blockingCGBA Circuit group blocking ackCQM Circuit group queryCQR Circuit group query responseGRS Circuit group resetGRA Circuit group reset ackCGU Circuit group unblockingCGUA Circuit group unblocking ackCFN ConfusionCOT ContinuityCCR Continuity check requestFAC FacilityFOT Forward transferIDR Identification requestIRS Identification responseINF InformationINR Information requestIAM Initial addressLPA Loop back ackLOP Loop preventionNRM Network resource managementPAM Pass-along
CR --xx Connection RequestCC --xx Connection ConfirmCREF --xx Connection RefusedRLSD --xx ReleasedRLC --xx Release CompleteDT1 --x- Data form 1DT2 ---x Data form 2AK ---x Data AcknowledgementUDT xx-- UnitdataUDTS xx-- Unitdata ServiceED ---x Expedited DataEA ---x Expedited Data AckRSR ---x Reset RequestRSC ---x Reset ConfirmERR --xx PDU ErrorIT --xx Inactivity TestXUDT xx-- Extended UnitdataXUDTS xx-- Extended Unitdata ServiceLUDT xx-- Long UnitdataLUDTS xx-- Long Unitdata Service
Second column indicates protocol class(es)(0,1,2,3) where given message may be usedMessages in italics used only over MTP-3b
SCCP
SSA Subsystem AllowedSSP Subsystem ProhibitedSST Subsystem Status TestSOR Subsystem Out-of-service RequestSOG Subsystem Out-of-service GrantSSC SCCP / Subsystem Congested
SCCP Management Components
Invoke (ITU-T)Invoke Last (ANSI)Invoke Not Last (ANSI)Return Result LastReturn Result Not LastReturn ErrorReject
Dialogue PDUs (ITU-T only)
AARQ Dialogue RequestAARE Dialogue ResponseABRT Dialogue AbortRLRQ Release RequestRLRE Release ResponseAUDT Uni-Dialogue
PDUs in italics are not used and includedfor completeness only (aligned with X.227).
Messages (ITU-T)
UnidirectionalBeginContinueEndAbort
TCAP
Messages (ANSI)
UnidirectionalQuery with PermissionQuery without PermissionResponseConversation with PermissionConversation without PermissionAbort
processGroupCallSignalling (R1997)processUnstructuredSS-Request (Ph2)processUnstructuredSSData (Ph1 only)provideRoamingNumberprovideSIWFSNumber (R1997)provideSubscriberInfo (R1996)provideSubscriberLocation (R1998)purgeMS (Ph2)readyForSM (Ph2)registerCC-Entry (R1997)registerPassword (Ph2)registerSSremoteUserFree (R1997)reportSmDeliveryStatus (Ph2)resetrestoreData (Ph2)secureTransportClass1 (Rel4)secureTransportClass2 (Rel4)secureTransportClass3 (Rel4)secureTransportClass4 (Rel4)sendAuthenticationInfo (Ph2)sendEndSignalsendGroupCallEndSignal (R1997)sendIdentification (Ph2)sendIMSI (Ph2)sendParameters (Ph1 only)sendRoutingInfosendRoutingInfoForGprs (R1997)sendRoutingInfoForLCS (R1998)sendRoutingInfoForSMsetMessageWaitingData (Ph1 only)setReportingState (R1997)SIWFSSignallingModify (R1997)ss-Invocation-Notification (R1997)statusReport (R1997)subscriberLocationReport (R1998)unstructuredSS-Notify (Ph2)unstructuredSS-Request (Ph2)updateGprsLocation (R1997)updateLocation
The GSM/3GPP phase/release in which an operation was introduced is given inparenthesis. 3G specific operations are shown in italics.
activateSSactivateTraceModealertServiceCentreanyTimeInterrogaton (R1996)anyTimeModification (R1999)anyTimeSubscriptionInterrogation (R1999)authenticationFailureReport (R1999)beginSubscriberActivity (Ph1 only)cancelLocationcheckIMEIdeactivateSSdeactivateTraceModedeleteSubscriberDataderegisterMobileSubscriber (Ph1 only)eraseCC-Entry (R1997)eraseSSfailureReport (R1997)forwardAccessSignallingforwardCheckSsIndication (Ph2)forwardGroupCallSignalling (R1997)forwardSM (Ph1 Ph2 only)getPassword (Ph2)informServiceCentre (Ph2)insertSubscriberDatainterrogateSSistAlert (R1999)istCommand (R1999)mo-forwardSM (R1996)mt-forwardSM (R1996)noteInternalHandover (Ph1 only)NoteMM-Event (R1999)noteMsPresent (Ph1 only)noteMsPresentForGprs (R1997)noteSubscriberDataModified (R1999)performHandover (Ph1 only)performSubsequentHandover (Ph1 only)prepareGroupCall (R1997)prepareHandover (Ph2)prepareSubsequentHandover (Ph2)processAccessSignalling
Mobile Application Part
ActivityTestActivityTestGPRS (Ph3)ApplyCharging (Ph2)ApplyChargingGPRS (Ph3)ApplyChargingReport (Ph2)ApplyChargingReportGPRS (Ph3)AssistRequestInstructions (Ph2)CallGap (Ph3)CallInformationReport (Ph2)CallInformationRequest (Ph2)Cancel (Ph2)CancelGPRS (Ph3)Connect
CAMEL Application Part
ReleaseCallReleaseGPRS (Ph3)ReleaseSMS (Ph3)RequestReportBCSMEventRequestReportGPRSEvent (Ph3)RequestReportSMSEvent (Ph3)ResetTimer (Ph2)ResetTimerGPRS (Ph3)ResetTimerSMS (Ph3)SendChargingInformation (Ph2)SendChargingInformationGPRS (Ph3)SpecializedResourceReport (Ph2)SplitLeg (Ph4)
ConnectSMS (Ph3)ConnectToResource (Ph2)ContinueContinueGPRS (Ph3)ContinueSMS (Ph3)ContinueWithArgument (Ph3)DisconnectForwardConnection (Ph2)DisconnectForwardConnectionWithArgument (Ph4)DisconnectLeg (Ph4)EntityReleased (Ph4)EntityReleasedGPRS (Ph3)EstablishTemporaryConnection (Ph2)EventReportBCSM
EventReportGPRS (Ph3)EventReportSMS (Ph3)FurnishChargingInformation (Ph2)FurnishChargingInformationGPRS (Ph3)FurnishChargingInformationSMS (Ph3)InitialDPInitialDPGPRS (Ph3)InitialDPSMS (Ph3)InitiateCallAttempt (Ph4)MoveLeg (Ph4)PlayAnnouncement (Ph2)PlayTone (Ph4)PromptAndCollectUserInformation (Ph2)
The CAMEL phase in which an operation was introduced is given in parenthesis.
ASPAC ASP ActiveASPAC ACK ASP Active AckASPDN ASP DownASPDN ACK ASP Down AckASPIA ASP InactiveASPIA ACK ASP Inactive AckASPUP ASP UpASPUP ACK ASP Up AckBEAT HeartbeatBEAT ACK Heartbeat AckDATA Payload DataDAUD Destination State Audit
DAVA Destination AvailableDEREG REQ Deregistration RequestDEREG RSP Deregistration ResponseDRST Destination RestrictedDUNA Destination UnavailableDUPU Destination UP UnavailableERR ErrorNTFY NotifyREG REQ Registration RequestREG RSP Registration ResponseSCON Signalling Congestion
Unused messages shown in italics.
M3UA
SCTP
ABORT AbortCOOKIE ACK Cookie AcknowledgementCOOKIE ECHO State CookieCWR Congestion Window ReducedDATA Payload DataECNE Explicit Congestion Notification EchoERROR Operation ErrorHEARTBEAT Heartbeat RequestHEARTBEAT ACK Heartbeat AcknowledgementINIT InitiationINIT ACK Initiation AcknowledgementSACK Selective AcknowledgementSHUTDOWN ShutdownSHUTDOWN ACK Shutdown AcknowledgementSHUTDOWN COMPLETE Shutdown Complete
Unused, reserved messages are in italics.
OS Out of ServicePO Processor OutageIS In ServiceNM NormalEM EmergencyANS Alignment Not SuccessfulMI Management InitiatedPE Protocol ErrorPNS Proving Not Successful
SSCF
SD Sequenced DataPOLL Status RequestSTAT Solicited Status ResponseUSTAT Unsolicited Status ResponseUD Unnumbered DataMD Management Data
PDUs not required by SSCFare marked in italics.
SSCOP
BGN BeginBGAK Begin AckBGREJ Begin RejectEND EndENDAK End AckRS ResynchroniseRSAK Resynch AckER Error RecoveryERAK Error Recovery Ack