Electronics Guide

The SS7 Protocol Stack

SS7 is layered. The Message Transfer Part (MTP), in three levels, provides the physical, link, and network functions that deliver signaling messages reliably between nodes identified by point codes. Above it, the Signaling Connection Control Part (SCCP) offers both connectionless and connection-oriented service and adds global-title addressing, allowing messages to be routed by logical address, such as an E.164 number range, rather than by fixed point code. Global-title translation at each transit node maps that logical address onto the next point code, which is what makes a query addressed to a subscriber's home network routable across borders. The Transaction Capabilities Application Part (TCAP) supports remote operations, providing the request-and-response transactions used by database queries.

The mobile-specific application is the Mobile Application Part (MAP). MAP was first specified for GSM by the European Telecommunications Standards Institute and is now maintained by the 3rd Generation Partnership Project (3GPP) as TS 29.002. MAP runs over TCAP and carries the procedures that manage subscriber location, authentication, and supplementary services, and it transports the Short Message Service (SMS). Two other application parts matter for voice: the ISDN User Part (ISUP) controls trunk circuits for call setup and release, and the CAMEL Application Part (CAP), from Customised Applications for Mobile networks Enhanced Logic, supports intelligent-network services such as prepaid charging.

Legacy Core Nodes and MAP Procedures

The second- and third-generation core is a set of named nodes joined by MAP. The Home Location Register (HLR) is the master subscriber database, paired with an Authentication Center that holds the long-term keys. The Visitor Location Register (VLR), normally co-located with a Mobile Switching Center (MSC), keeps a temporary record of every subscriber currently in that switch's service area. Packet data adds the Serving GPRS Support Node (SGSN), which handles mobility and session control, and the Gateway GPRS Support Node (GGSN), which connects to external networks. LTE's Home Subscriber Server consolidates the roles of the HLR and the Authentication Center, and 5G's Unified Data Management continues that lineage.

The MAP operations that tie these nodes together explain both the strengths and the later weaknesses of the design. UpdateLocation registers a subscriber's current VLR or SGSN with the HLR, and InsertSubscriberData pushes the subscription profile back down so the visited switch knows which services to allow. SendRoutingInfo asks the HLR where to deliver an incoming call, and SendRoutingInfoForSM does the same for a text message. ProvideSubscriberInfo and AnyTimeInterrogation return a subscriber's current location and status. Each operation was designed for a closed community of national operators, and each assumed the requester was legitimate.

SIGTRAN: SS7 over IP

As core networks migrated from time-division-multiplexed links to packet transport, the SIGTRAN protocol family was defined by the Internet Engineering Task Force to carry SS7 messages over Internet Protocol networks. At its heart is the Stream Control Transmission Protocol (SCTP), specified most recently in RFC 9260, which supersedes the long-standing RFC 4960. SCTP was designed for exactly this job. It adds multihoming, so a single association can survive the loss of a network path, and it multiplexes independent streams within one association, avoiding the head-of-line blocking that a single Transmission Control Protocol connection would impose on unrelated transactions.

Adaptation layers sit between SCTP and the existing SS7 upper layers. M3UA (MTP Level 3 User Adaptation) lets SCCP and ISUP run over IP as though MTP Level 3 were still beneath them, while M2PA (MTP Level 2 Peer-to-Peer Adaptation) replaces individual signaling links so that two nodes retain a full MTP Level 3 relationship across an IP network. SIGTRAN preserved the enormous installed base of SS7 applications, including MAP and its procedures, while freeing operators from dedicated signaling links. It also broadened the attack surface, because reaching an SS7 network no longer required physical access to a signaling link.

Reference Points and Applications

In the LTE Evolved Packet Core, Diameter carries the signaling across many of the named interfaces, called reference points. The S6a interface connects the Mobility Management Entity to the Home Subscriber Server for subscriber authentication and the download of subscription data, and the parallel S6d interface serves the SGSN. The Gx interface connects the Policy and Charging Rules Function to the Packet Data Network Gateway to install policy and charging rules, while the Rx interface lets application functions, including the IMS, request quality-of-service treatment for a session. Charging is conveyed over the Ro and Gy interfaces for online, real-time charging and the Rf interface for offline charging. Within the IMS, the Cx and Dx interfaces let Call Session Control Functions query the Home Subscriber Server, and the Sh interface gives application servers access to subscriber data.

The pattern is consistent: each reference point is a Diameter application with its own command codes and attribute-value pairs, layered on a common base. That uniformity is why a single Diameter routing infrastructure can serve authentication, policy, charging, and location services at once.

Routing, Agents, and Overload Control

Because a single subscriber procedure may touch several interfaces, Diameter routing through agents is essential. Relay and proxy agents forward messages between realms, redirect agents point a requester at the correct destination, and Diameter Routing Agents concentrate traffic inside an operator's network so that individual network elements need not maintain a full mesh of peer connections. Diameter Edge Agents sit at network boundaries and mediate signaling with other operators, translating identifiers, hiding internal topology, and enforcing policy on what a roaming partner may ask.

Signaling nodes fail badly when they are saturated, so the IETF defined Diameter Overload Indication Conveyance in RFC 7683. It lets an overloaded node tell its peers to reduce the offered load by a stated percentage, for a stated duration, rather than allowing timeouts and retransmissions to compound the congestion. The same elements that make Diameter routing flexible also make it a target for the security mediation discussed later.

GTP-C and GTP-U

The control-plane variant, GTP-C, establishes, modifies, and deletes the sessions that allow a device to send and receive data. In LTE it manages the bearers between the Serving Gateway and the Packet Data Network Gateway and signals the device's assigned address and quality-of-service parameters. The user-plane variant, GTP-U, encapsulates the subscriber's actual data packets inside an outer header so that they can be tunneled across the core regardless of the device's own address, with each tunnel identified by a Tunnel Endpoint Identifier. Because the outer header is rewritten while the inner packet is untouched, a handover changes only the tunnel endpoints, and the subscriber's address and transport connections survive intact.

In the 5G core, GTP-U continues to carry user-plane traffic between the gNodeB and the User Plane Function, but GTP-C is retired. Its session-control role passes to the Packet Forwarding Control Protocol on the N4 interface, while the rest of the control plane moves to the service-based interfaces described below. GTP-U's persistence across four generations is a good illustration of how mobile networks change their control plane far more readily than their data path.

Non-Access Stratum Signaling

Non-Access Stratum (NAS) signaling comprises two protocols in each generation: one for mobility management and one for session management. LTE defines EPS Mobility Management and EPS Session Management in 3GPP TS 24.301; 5G defines the corresponding 5GS procedures in TS 24.501. Mobility-management messages carry attachment, registration, tracking-area update, paging response, and detach. Session-management messages establish, modify, and release the data sessions that the packet core then realizes with GTP or PFCP.

NAS messages are integrity-protected and ciphered end to end between the device and the Mobility Management Entity or the Access and Mobility Management Function, using keys derived during authentication. The security mode command procedure activates that protection immediately after the device is authenticated, which is why the small number of messages that must be sent before it, such as the initial registration request, receive the special identity treatment described later.

S1AP and NGAP

The base station and the core exchange their own control messages, and they also carry NAS messages as opaque payloads. LTE uses the S1 Application Protocol (3GPP TS 36.413) over the S1-MME interface between the eNodeB and the Mobility Management Entity. 5G uses the NG Application Protocol (3GPP TS 38.413) over the N2 interface between the gNodeB and the Access and Mobility Management Function. Both run over SCTP, which supplies the ordered, multihomed, congestion-controlled transport that a radio-to-core signaling bearer requires.

These protocols manage the context of each connected device: they set up and release the radio-level bearers or protocol data unit sessions, trigger paging, coordinate handovers between base stations, and convey the security keys the base station needs. NGAP generalizes what S1AP did for LTE radio alone, because the 5G core must also serve non-3GPP access such as trusted and untrusted Wi-Fi.

IMS Architecture

The IP Multimedia Subsystem is the 3GPP framework that turns SIP into a carrier-grade service platform, providing the registration, routing, and service control needed for operator voice. Its central elements are the Call Session Control Functions (CSCFs). The Proxy CSCF is the subscriber's first point of contact and secures the signaling. The Interrogating CSCF is the contact point at the network edge for traffic arriving from outside; it queries the Home Subscriber Server to find which Serving CSCF is assigned to the subscriber. The Serving CSCF performs registration, invokes application servers, and routes sessions according to subscriber profiles retrieved from the Home Subscriber Server.

The reference points follow the same discipline as the rest of the core. Gm carries SIP between the device and the Proxy CSCF; Mw carries SIP between CSCFs; the ISC interface connects the Serving CSCF to application servers; and Cx, Dx, and Sh carry Diameter to and from the subscriber database. Service invocation is data-driven: the subscriber profile contains initial filter criteria, a set of rules that tell the Serving CSCF which application server to involve for which kind of request, so that supplementary services are configured rather than coded into the routing path.

Voice Delivery and Continuity

IMS delivers Voice over LTE (VoLTE) and Voice over New Radio (VoNR), carrying telephony as packet sessions rather than over a legacy circuit-switched core. It also provides Rich Communication Services messaging and interworks with the public switched telephone network through media gateway control functions and their associated media gateways, which translate between SIP and ISUP and between packet and circuit media.

Continuity mechanisms bridge the generations. When a network cannot yet carry voice over its packet core, circuit-switched fallback hands the device to an older radio for the duration of the call. When a device with an established VoLTE call leaves LTE coverage, Single Radio Voice Call Continuity transfers the session to the circuit-switched domain without dropping it. Both are pure signaling maneuvers, and both illustrate how the control plane absorbs the complexity of a network that spans several generations at once.

The Evolved Packet Core

The Evolved Packet Core (EPC) is the flat, all-Internet-Protocol core introduced with LTE. Its control plane centers on the Mobility Management Entity, which handles device attachment, authentication, and mobility, signaling to the radio network over S1AP and exchanging Diameter with the Home Subscriber Server. The user plane runs through the Serving Gateway and the Packet Data Network Gateway, interconnected by GTP. The Policy and Charging Rules Function applies operator policy over Diameter. This separation of a single mobility manager from the data-forwarding gateways was a deliberate flattening of the more hierarchical third-generation core, which had distributed those roles across the MSC, the VLR, and the GPRS support nodes.

The 5G Service-Based Architecture

The 5G core (5GC) replaces rigid point-to-point interfaces with a service-based architecture in which network functions expose and consume services over a common bus. Functions such as the Access and Mobility Management Function (AMF), the Session Management Function (SMF), the User Plane Function (UPF), the Policy Control Function (PCF), the Authentication Server Function (AUSF), and the Unified Data Management (UDM) communicate through service-based interfaces named after the producer, such as Namf, Nsmf, and Nudm. Each service exposes a Representational State Transfer (REST) style application programming interface defined in OpenAPI, and the signaling rides HTTP/2 carrying JavaScript Object Notation (JSON) payloads. A Network Repository Function lets each function discover and authorize the others at run time, replacing the statically configured interconnections of earlier cores. Transport Layer Security protects the interfaces, and the Network Repository Function issues OAuth 2.0 access tokens that a consumer must present before a producer will honor a service request.

The separation of control and user planes is formal and complete in the 5G core, an arrangement first introduced into the LTE core under the name Control and User Plane Separation (CUPS). The User Plane Function can therefore be placed close to the radio edge for low latency while control functions remain centralized in the cloud. The control of the distributed user plane does not use the service-based bus: the Session Management Function programs each User Plane Function over the N4 reference point using the Packet Forwarding Control Protocol (PFCP), specified in 3GPP TS 29.244. PFCP installs the packet-detection, forwarding, quality-of-service, and usage-reporting rules that govern a session. It is the direct 5G descendant of GTP-C's control role, and the same protocol carries CUPS signaling over the Sx interfaces in late-generation LTE cores.

This shift from telecom-specific protocols to mainstream web technologies eases integration with cloud-native and virtualized infrastructure, and it enables network slicing, in which logically independent virtual networks with tailored characteristics share the same physical core. Each slice is identified by Single Network Slice Selection Assistance Information, and the Network Slice Selection Function steers each device to the appropriate slice during registration. That is a purely signaling-plane decision with large consequences for the service the subscriber receives, since the chosen slice determines which Session Management Function, User Plane Function, and policy rules will serve the device.

Authentication and Key Agreement

Cellular authentication is mutual and challenge-based. The network and the subscriber identity module share a long-term secret key that never leaves either side. In LTE, the Mobility Management Entity fetches authentication vectors from the Home Subscriber Server over the S6a Diameter interface; in 5G, the Authentication Server Function obtains the corresponding material from the Unified Data Management. The device computes a response to a random challenge using the shared key, and it also verifies a network authentication token, which is what makes the exchange mutual and defeats a simple false base station. Sequence numbers protect against replay.

The procedure is a 3GPP profile of Authentication and Key Agreement (AKA). The 5G variant is specified in 3GPP TS 33.501, which defines two methods, 5G-AKA and EAP-AKA', and builds a key hierarchy from the shared secret: successive derivations yield an anchor key held by the serving network, then separate keys for non-access stratum integrity and ciphering and for the radio interface. Because each level is derived rather than transmitted, compromise of a key low in the hierarchy does not expose the levels above it.

Identity Privacy

Identity privacy has been a long-running weakness. Earlier generations transmitted the permanent subscriber identity, the International Mobile Subscriber Identity (IMSI), in the clear during initial attach, which enabled the passive trackers commonly called IMSI catchers. The 5G system addresses this directly: the permanent identifier, now called the Subscription Permanent Identifier (SUPI), is never sent in the clear. Instead the device transmits a Subscription Concealed Identifier (SUCI), an elliptic-curve encryption of the SUPI under the home network's public key, and only the home network holds the private key needed to recover the permanent identity.

Temporary identifiers assigned after the first contact then stand in for the permanent one. The network reallocates the temporary identifier periodically, limiting how long any single value can be correlated with a subscriber. The design is a good example of how a privacy property is achieved entirely through signaling: no new radio technology was required, only a change in what the registration message is allowed to contain.

Home-Routed and Local Breakout Roaming

Authentication and subscription data always come from the home network. What varies is where the user plane leaves the mobile network. Under home-routed roaming, the visited network tunnels the subscriber's traffic back to a gateway in the home network, over the S8 interface in LTE or N9 in 5G, so that home policy, charging, and lawful-intercept capabilities apply unchanged. Under local breakout, the traffic exits in the visited network, which shortens the path and reduces latency but requires the home operator to trust and settle with the visited operator for enforcement it does not perform itself. Home-routed roaming remains the common default; local breakout is used where latency matters, notably for IMS voice and for edge computing.

Session management is split accordingly. In 5G home-routed roaming, a Session Management Function in the visited network cooperates with one in the home network, each controlling its own User Plane Function. Operators also apply steering of roaming, a signaling practice in which the home network influences which visited network a device selects, so that traffic follows the most favorable commercial agreement.

The IPX and 5G Interconnect Security

Historically, inter-operator signaling traversed dedicated SS7 networks. Today most of it rides the IP Packet Exchange (IPX), a private, managed Internet Protocol backbone operated by carrier interconnect providers that offers quality-of-service guarantees absent from the public internet. Providers act either as transport, simply forwarding traffic, or as hubs, giving one operator a single commercial and technical relationship in place of hundreds of bilateral ones.

5G formalizes the boundary. A Security Edge Protection Proxy (SEPP) at each network's border terminates all service-based signaling to and from other operators. The two proxies first negotiate over N32-c, a control connection secured with mutual Transport Layer Security, and then exchange protected traffic over N32-f. Where roaming is direct, TLS protects that traffic outright. Where an IPX provider must still read or modify selected parameters, the proxies use the Protocol for N32 Interconnect Security (PRINS), which applies protection at the application layer so that an intermediary can alter only the fields it is authorized to alter while the rest stays confidential and integrity-protected. The GSMA's NG.113 roaming guidelines describe how operators deploy these arrangements in practice. The border is where commercial agreements, technical mediation, and security controls all meet.

Signaling Vulnerabilities and Protection

SS7 and the early MAP procedures lack authentication of the originating network, so an attacker with signaling access can request a subscriber's location through operations such as AnyTimeInterrogation, redirect or intercept SMS messages including one-time passcodes by abusing SendRoutingInfoForSM and UpdateLocation, or trigger denial of service. Diameter, despite being newer, inherited analogous weaknesses at the interconnect boundary, because it likewise trusts the realm a message claims to come from.

The industry responded with signaling firewalls that inspect cross-border traffic and screen messages by category, and with the architectural mediation of the Diameter Edge Agent. The GSMA publishes the reference guidance: FS.11 covers SS7 monitoring and firewall rules, FS.19 covers Diameter interconnect security, FS.20 covers GTP, and FS.21 sits above them as a common framework for interconnect signaling security. The 5G core advances protection further, since the Security Edge Protection Proxy provides authenticated, integrity-protected, and confidential signaling between operators, closing the trust gap that plagued earlier interconnect. Legacy protocols persist, however, so most operators must defend SS7, Diameter, GTP, and service-based interfaces simultaneously.

Lawful Intercept

Lawful intercept is the legally authorized, standardized capability for an operator to provide a target's communications and associated metadata to an authorized agency under due legal process. 3GPP and the European Telecommunications Standards Institute define reference architectures that separate the administrative function, which provisions a warrant, from the delivery functions that hand over intercept-related information and, where authorized, the content of communication. The 3GPP specifications for the 5G system state the requirements, the architecture, and the delivery protocols in TS 33.126, TS 33.127, and TS 33.128, and the ETSI TS 102 232 series defines the handover formats.

The handover interface is deliberately split into three ports: HI1 for administrative information such as warrant activation, HI2 for intercept-related information, which is essentially the signaling metadata of the target's sessions, and HI3 for the content itself. Separating them keeps authorization distinct from delivery, so interception is auditable, scoped to what the warrant permits, and invisible to the target, while remaining subject to the legal framework of each jurisdiction. Because so much of what an agency receives is signaling metadata, lawful intercept is best understood as another consumer of the control plane rather than a bolt-on to the user plane.