ppT=

T U P

Users I BSS BSS RAN RNS MAP CAP INAP S AP AP+ AP AP TCAP U P SCCP MTP 3 MTP 3b SAAL-NNI MTP 2 ATM MTP 1 PHY IP L1 + L2 M3UA SCTP

SS7 overview circuit-related and non-circuit applications (inter-exchange, not on access interfaces) layered design (transport + application) common channel signalling (associated or quasi-associated) transport over PCM lines, ATM, IP

SS7 applications call handling in PSTN & PLMN mobility & roaming IN call handling RANcore/RAN signalling (ISUP, TUP) (MAP, BSSAP+) (INAP, CAP) (BSSAP, RANAP, RNSAP)

over PCM over ATM over IP

SS7 network elements local / transit exchange MSC, BSC, HLR, ... SSF, SCF, ...

Classic SS7 layered structure

MTP rerouting only Application (user part) ex. ISUP STP Transport MTP SP LS MTP 1 signalling data link MTP 2 signalling link MTP 3 signalling network

Processor ISUP ` MTP 2 MTP 3 ST

call handling message handling error control

Processor ISUP MTP 3 ST

STP

SP

SP SL

transmission

MTP 1

16

31

SL: channel for signalling messages LS: all sig. links connecting two points SR: predetermined end-to-end path

synch

PCM coded speech 8000 samples x 8 bits 64000 bps

ATM BSC BSS BSSAP CAMEL CAP GSM HLR INAP Asynchronous Transfer Mode Base Station Controller Base Station System Base Station System Application Part Customised Application for Mobile network Enhanced Logic CAMEL Application Part Global System for Mobile communications Home Location Register Intelligent Network Application Part ISDN ISUP IP LS M3UA MAP MSC MTP PCM PLMN Integrated Services Digital Network ISDN User Part Internet Protocol Link Set MTP3 User Adaptation Mobile Application Part Mobile Switching Centre Message Transfer Part Pulse Code Modulation Public Land Mobile Network PSTN PS RAN RANAP RNS RNSAP SAAL SCCP SCF SCTP

PCM line (E1) 32 timeslots x 64 kbps 2 Mbps

SL SP SR SS7 SSF ST STP TCAP TUP UMTS Signalling Link Signalling Point Signalling Route Signalling System No. 7 Service Switching Function Signalling Terminal Signalling Transfer Point Transaction Capabilities Application Part Telephone User Part Universal Mobile Telecommunications System

SS7_SF_01_060418

Public Switched Telephony Network Packet Switched Radio Access Network RAN Application Part Radio Network Subsystem RNS Application Part Signalling ATM Adaptation Layer Signalling Connection Control Part Service Control Function Stream Control Transmission Protocol

MTP level 2 functions

jqmI=~=f
Signalling Link states Level 3 order Normal or Emergency alignment bits Proving OK 7 BSN Normal alignment (max 5X) Failure Ok Idle Out of service SIOS Not aligned SIO Proving SIN or SIE Aligned MSU FISU SIB SIPO Alignment failed
T U P MTP 3 MTP 2

Users I BSS BSS RAN RNS MAP CAP INAP S AP AP+ AP AP TCAP U P SCCP MTP 3b SAAL-NNI ATM MTP 1 PHY M3UA SCTP IP L1 + L2

transmission of level 3 messages in signal units error detection and correction signal unit delimitation link alignment link error monitoring routing label for MTP 3 user part information 16 MSU CK for error detection NI SI max 8 * 272 SIF 2 2 NI 8 SIO 4 SI 2 6 LI 1 FIB 16 EC 7 FSN 1 BIB 8 F

High error rate on the link

national / international network SCCP, ISUP, TUP,

acknowledgements & retransmissions

# of errors AERM

Emergency alignment (max 1X) # of errors 1 Failure Ok 0.5 sec

16 LSSU CK 5

8 SF 3 SI

2 6 LI

16 EC

8 F

bits

4 3 2 1

SIO, SIN, SIE SIOS, SIPO, SIB 16 FISU CK 0 FISU 1 or 2 LSSU 2..63 MSU 2 6 LI

for delimitation all fields between flags require "bit stuffing": SEND: add 0 after every 11111 RECV: delete 0 from every 111110 16 EC 8 F bits SUERM

8.2 sec

Loss of alignment 64 -1 if 256 SUs OK +1 if faulty SU t

no retransmissions of FISU and LSSU

SS7_SF_02_ 060418

AERM BIB BSN CK EC F FIB FISU FSN

Alignment Error Rate Monitor Backward Indicator Bit Backward Sequence Number Check bits Error Control Flag Forward Indicator Bit Fill-In Signal Unit Forward Sequence Number

LI LSSU MSU MTP NI SF SI SIB SIE

Length Indicator Link Status Signal Unit Message Signal Unit Message Transfer Part Network Indicator Status Field Service Indicator Status Indication Busy Status Indication Emergency alignment

SIF SIN SIO SIO SIOS SIPO SU SUERM

Signalling Information Field Status Indication Normal alignment Service Information Octet Status Indication Out of alignment Status Indication Out of Service Status Indication Processor Outage Signal Unit Signal Unit Error Rate Monitor

jqmI=~=ff
MTP level 3 functions message routing load sharing message discrimination message distribution signalling network management signalling link testing NI,DPC SL SLS one of SLs NI,DPC deliver or reroute SI user part Routing & load sharing 2-55 STP SLC=0 =1 2-66 STP
T U P MTP 3 MTP 2

Users I BSS BSS RAN RNS MAP CAP INAP S AP AP+ AP AP TCAP U P SCCP MTP 3b SAAL-NNI ATM MTP 1 PHY M3UA SCTP IP L1 + L2

SP

SP

SP

MTP addressing

SIF

SIO routing label

0: SNM 1: SNT 3: SCCP 4: TUP 5: ISUP 14 DPC 2 2 NI 2 bits SI national (2) international (0)

2-10 DPC LS 2-20 2-20 2-55 2-66 2-30 2-55 SLC 0 0 or 1 0 or 1 0 or 1

2-20

2-30 high priority load sharing (among SLs) load sharing (among LSs)

12+4 UP msg TUP and ISUP only

14 OPC

[ CIC ] SLS for load sharing

where FROM

where TO

SNM & SNT Signalling link management control locally connected links Signalling traffic management divert signalling among available links Signalling route management distribute status & routing info Signalling link testing after alignment and periodically

Example procedures COO COA TFP RST TFA SLTM SLTA divert signalling from unavailable link rerouting to DPC=x not possible periodic test: rerouting possible? rerouting to DPC=x possible again done by both sides test bit pattern sent

indicate node where UP creates/receives the message, not STP address

National address assigned nationally

e.g. 2 8277 NI OPC/DPC

International address assigned by ITU-T

e.g. 0 7-246-1 point code

messages sent in MSUs

Signalling Area Network Code

SS7_SF_03_ 060418

CIC DPC LS LSSU MSU NI

Circuit Identity Code Destination Point Code Link Set Link Status Signal Unit Message Signal Unit Network Indicator

OPC SANC SI SIF SIO SL

Originating Point Code Signalling Area Network Code Service Indicator Signalling Information Field Service Information Octet Signalling Link

SLC SLS SNM SNT UP

Signalling Link Code Signalling Link Selection Signalling Network Management Signalling Network Testing User Part

Users I BSS BSS RAN RNS MAP CAP INAP S AP AP+ AP AP TCAP U P SCCP MTP 3 MTP 2 ATM MTP 1 PHY IP L1 + L2 MTP 3b SAAL-NNI M3UA SCTP

ISUP functions circuit-related call control (setup, conversation, cleardown) link-by-link signalling interworking (older ISUP and other systems) support for basic and supplementary services

fprm
Example flow select circuit create message through-connect T7: max 20 .. 30s T9: max 1.5 .. 3 min expiry release through-connect charge IAM IAM T7 ACM CPG T9 ANM

T U P

select circuit through-connect basic call setup

ACM CPG ANM CPG

called party found event, e.g. alerting connect ring tone (if speech) called party answer through-connect

Message structure also SCCP SIF SIO no CIC in SCCP SLS CIC OPC DPC

CPG T2: max 3 min expiry release

optional

mandatory mandatory message variable fixed type

event, e.g. on-hold, forwarding, e.g. analogue on-hook

SUS RES T2 REL T1 RLC T5

SUS suspend & resume RES e.g. analogue off-hook REL RLC CGB call release O&M: block CGBA block group of circuits O&M: unblock CGU unblock group of circuits CGUA

E OP

L N K K

L N H H

L E

L P P P D OP E D

A ABC disconnect stop charging

P = Pointer

L = Length

N = Parameter name

OP = Optional Part

EOP = End of Opt. Part

Interworking with other versions of ISUP Confusion message ABC CFN unknown msg bad param unknown param re-send modified message send another message release call Parameter compatibility info ABC param X param Y param Z param info

circuit released

T1: max 15 .. 60 sec expiry restart, resend T5: max 5 .. 15 min expiry circuit reset

param X: notify / discard / pass / release call param Y: . . . . . / . . . . . . /. . . . . /. . . . . . ... info what to do with unrecognized parameters
CIC DPC ISDN ISUP OPC Circuit Identity Code Destination Point Code Integrated Services Digital Network ISDN User Part Originating Point Code SCCP SIF SIO SLS Signalling Connection Control Part Signalling Information Field Service Information Octet Signalling Link Selection

SS7_SF_04_ 060418

Users I BSS BSS RAN RNS MAP CAP INAP S AP AP+ AP AP TCAP U P SCCP MTP 3 MTP 2 ATM MTP 1 PHY IP L1 + L2 MTP 3b SAAL-NNI M3UA SCTP

SCCP functions addition to MTP global addressing & routing using GT non-circuit related signalling connectionless and connection-oriented

p``m

SCCP addresses combination of GT SSN SPC routing distribution

T U P

GT = digits + numbering plan + translation type + nature of addr SSN = number (1..255) identifying SCCP user

GT: +48 SCCP messages format same as in ISUP UDT UDT UDT UDTS UDT SCCP modes

+48601

+486014

+48601445

Connectionless address included in each message UDT each message routed independently called addr GT translation in each node calling addr class 0 basic user data class 1 sequenced delivery sent if error used in GSM/UMTS core network CR CC DT1 DT1 DT1 IT RLSD RLC T(ias) expires send IT T(iar) expires release anything received T(iar) reset T(iar) > 2 * T(ias) Connection-oriented addresses included in CR only logical connection ref numbers fixed path in the network class 2 basic class 3 flow controlled used between MSC and BSC/RNC sent when idle (5 .. 10 min)

GT translation start of GT next node DPC

GT translation (optional) SSN SCCP user

Addressing in 3GPP network Call interrogation GT = MSISDN, NP = E.164, SSN = 6

HLR

CR setup CC DT1 DT1 dest ref no user data DT1 IT RLSD release RLC

First contact GT = MGT, NP = E.214, SSN = 6 IMSI = 260 01 1234567890 MGT = +48 603 1234567890

GMSC

Other cases GT = preconfigured or received earlier

MSC/VLR

data transfer

SCCP management maintain status info on other nodes & their subsystems MTP indications node status own broadcasts & tests subsystem status

SS7_SF_05_ 060418

CL CO DPC E.164 E.212 E.214 GT MGT

Connectionless Connection Oriented Destination Point Code ISDN/telephony numbering plan IMSI numbering plan ISDN/IMSI numbering plan Global Title Mobile Global Title

MSISDN NP RNC SSN SPC SCCP TT

Mobile Subscriber ISDN Number Numbering Plan Radio Network Controller SCCP Subsystem Number Signalling Point Code Signalling Connection Control Part Translation Type

Users

TCAP functions
T U P I BSS BSS RAN RNS MAP CAP INAP S AP AP+ AP AP TCAP U P SCCP MTP 3 MTP 2 ATM MTP 1 PHY IP L1 + L2 MTP 3b SAAL-NNI M3UA SCTP

q`^m

ASN.1 and BER higher layer protocols complex data types separate notation (ASN.1) from coding (BER) complex types made from basic types primitives & constructors

generic services for application entities transaction-oriented communication component handling dialogue handling TCAP user operations Protocol model Component sublayer components: INVOKE, RET. RESULT, RET. ERROR invoke id n

Tag Length

what IT is how long IT is here IT is

Tag Length

Application Entities Network Service Part

INAP TCAP

MAP MSC TCAP MTP+SCCP

MAP VLR TCAP

Content

TCAP + MAP message Transaction sublayer messages: BEGIN, CONTINUE, END transaction id nnn

TCAP + MAP example new subscriber in VLR: location update new

VLR HLR

old
VLR

BEGIN 123 INVOKE Update location (IMSI,MSC/VLR addr) CONTINUE 123 INVOKE Insert subscriber data (MSISDN,services) CONTINUE 123 RET. RESULT

BEGIN 456 INVOKE Cancel location (IMSI)

END 456 RET. RESULT

Message type tag Message length Transaction Id tag Transaction Id length Transaction Id Component portion tag Component portion length Component type tag Component length Invoke Id tag Invoke Id length Invoke Id Operation code tag Operation code length Operation code

ex. BEGIN

ex. 123

ex. INVOKE

ex.

ex. Update Location

Operation parameters

ex. IMSI, MSC/VLR addr

END 123 RET. RESULT

Update location (HLR addr)

AE ASN.1 BER HLR IMSI INAP Application Entity Abstract Syntax Notation One Basic Encoding Rules Home Location Register International Mobile Subscriber Identity Intelligent Network Application Part MAP MS MSC NSP TCAP VLR Mobile Application Part Mobile Station Mobile Switching Centre Network Service Part Transaction Capabilities Application Part Visitor Location Register

SS7_SF_06_ 060418

MAP interfaces in GSM/UMTS E: inter-MSC handover or relocation SMS transfer C: interrogation at MT call (GMSC) interrogation at MT SMS transfer E
SMS-GMSC SMS-IWMSC

j^mI=~=f
B: internal (not standardised)
T U P

Users I BSS BSS RAN RNS MAP CAP INAP S AP AP+ AP AP TCAP U P SCCP MTP 3 MTP 2 MTP 3b SAAL-NNI ATM MTP 1 M3UA SCTP IP L1 + L2

MSC

VLR

G: IMSI and triplets retrieval E G D: location and subscriber data management (CS)

MAP versions

PHY

MSC

Every operation comes with Application Context version

VLR

IN: MS state/location requests; DUSSD requests from MS

MAP operation (sent in component) UPDATE LOCATION fixed part: ETSI mobile GSM MAP AC

AC version (sent in TCAP dialogue portion) 4001013

F IN C

gsmSCF

H: triplets requests (not standardised)

EIR HLR

Gd: SMS transfer

AUC

AC name: networkLocUpContext 1 name few operations (1..7) Version negotiation

version (1,2,3,4)

Gf F, Gf: IMEI verification Gd

SGSN

Gr

Gc
GGSN

BEGIN OPEN AC v3 INVOKE OP-X () ABORT ABORT AC v2

initial version based on dest addr (or default) operation component optional alternative version offered

Gr: location and subscriber data management (PS)

Gc: interrogation at networkrequested packet session (optional)

Notes MSC MSC server if split architecture (Rel-4) HLR+AUC+other database Home Subscriber Server (HSS, Rel-5) MAP also for: location services (R99), Gateway Location Register (GLR) SCCP CL class 0 and 1 used, SSN mandatory
AC AUC CL CS EIR GGSN GMSC GPRS

BEGIN OPEN AC v2 INVOKE OP-X () CONT/END ACCEPT AC v2 INV/RET OP-Y/X ()

Application Context Authentication Centre Connectionless Circuit Switched Equipment Identity Register Gateway GPRS Support Node Gateway MSC General Packet Radio Service HLR IMEI IMSI IN IWMSC MAP MSC MT

new dialogue version OK dialogue portion not used later

NP PDP SCF SGSN SSN USSD VLR Numbering Plan Packet Data Protocol Service Control Function Serving GPRS Support Node SCCP Subsystem Number Unstructured Supplementary Service Data Visitor Location Register

SS7_SF_07_060418

Home Location Register International Mobile Equipment Identity International Mobile Subscriber Identity Intelligent Network Interworking MSC Mobile Application Part Mobile Switching Centre Mobile Terminating

Example MAP procedures

VLR

j^mI=~=ff
MSC VLR

Users I BSS BSS RAN RNS MAP CAP INAP S AP AP+ AP AP TCAP U P SCCP MTP 3 MTP 2 ATM IP L1 + L2 MTP 1 PHY MTP 3b SAAL-NNI M3UA SCTP

MSC

location update (new subscriber, TMSI used)

BI

Send Identification return IMSI & unused triplets

HLR

E RR Send Identification BI CI Update location Insert subsc. data

B= BEGIN C= CONTINUE E= END

I = INVOKE RR= RETURN RESULT

T U P

update location info in HLR & get subscriber profile

BI

Cancel location

E RR Cancel location C RR Insert subsc. data E RR Update location BI BI Send routing info

delete subscriber record

SGSN

SMS-IWMSC

SMSC

BI SMS via GPRS from MS

GMSC

MO Forward SM

BI

Forward MO SM

E RR MO Forward SM

E RR Forward MO SM

Provide roaming no

HLR

allocate & return MSRN

E RR Provide roaming no

incoming call with MSISDN E RR Send routing info continue call with received MSRN

SMS-GMSC

return serving MSC address

BI

Send routing info for SM B I

Forward MT SM

E RR Send routing info for SM

VLR

check phone e.g. at call setup

BI

Check IMEI

EIR

E RR Check IMEI

return white/grey/black

MSC

to/from SMSC: not MAP MT Forward SM E RR Forward MT SM

BI deliver SMS

E RR MT Forward SM suppl. service management BI CI Activate SS Get password

HLR VLR

(components sent C RR Get password to/from MS) E RR Activate SS USSD request B I Process USS req received from MS E RR Process USS req

code required e.g. for barring services

MSC

HLR

SGSN

BI

Reset

BI

Reset

gsmSCF

BI

Process USS req request handled in E RR Process USS req MSC, HLR, gsmSCF, or elsewhere

sent to all VLRs and SGSNs on HLR reload loc. update redone on radio contact for all IMSIs from HLR

SS7_SF_08_060418

B/C/E I / RR IMSI MO MSISDN MSRN

BEGIN / CONTINUE / END INVOKE / RETURN RESULT International Mobile Subscriber Identity Mobile Originated Mobile Subscriber ISDN Number Mobile Station Roaming Number

MT SM SMSC TMSI USSD

Mobile Terminated Short Message Short Message Service Centre Temporary Mobile Subscriber Identity Unstructured Supplementary Service Data

MSISDN dialled 2-10 2-20 2-30 2-40

SCCP relay

j=q~=`~=b~
2-50 2-60
SCCP relay

2-70

LE
MTP: OPC=10 DPC=20 MTP: OPC=20 DPC=30 OPC=30 DPC=40
IAM UDT {BEGIN-INVOKE (Send Routing Info)}

TE
MTP: DPC OPC=40 DPC=60 SL SCCP: GT DPC MTP: DPC SL

GMSC STP

HLR

IAM

OPC=60 DPC=70

dialled no route ISUP: select circuit prepare message MTP: DPC SL dialled no interrogate MAP+TCAP: start dialogue called addr = MSISDN transaction id invoke id AC ver called addr (GT=MSISDN,SSN=6) calling addr (GT=GMSC,SSN=8) 2-80 SCCP: GT DPC MTP: DPC SL

MSISDN GMSC capabilities interrogation type [service info] MSISDN IMSI

SCCP: [GT deliver] SSN MAP-HLR

MSC/VLR addr

called party number fwd call indicators nature of connection transmission medium requirement [calling party number] [service info]

MSC

VLR

called addr (GT=VLR,SSN=7) calling addr (GT=HLR,SSN=6)

UDT {BEGIN-INVOKE (Provide Roaming No)}

IMSI MSC addr [service info]

UDT {END-RETURN RESULT (Provide Roaming No)}

MS attached? allocate MSRN MSRN IMSI start timer continue call setup with MSRN

MSRN

UDT {END-RETURN RESULT (Send Routing Info)}

MSRN 2-90 dialled no MSRN series MSRN IMSI release MSRN IMSI registration area
IAM UDT (Paging)

dialled no route ISUP: select circuit prepare msg MTP: DPC SL called party no = MSRN now

BSS / RNS

allocate & setup: SDCCH if GERAN SRB if UTRAN

Paging

no GT src ref no

no GT, SSN= 254 if BSSAP 142 if RANAP

IMSI, TMSI area id cause/channel

CR (Paging response)

Establishment of signalling radio connection Paging response

TMSI or IMSI start SCCP connection no GT src ref no dest ref no dest ref no backward call indicators [echo control info]
DT1 (Setup) Setup CC

Authentication and start of security functions

LE

TE

[bearer capabilities] [calling party number]

DT1 (Call confirmed) Call confirmed

[bearer capabilities]
ACM ACM ACM Establishment of traffic connection

Awaiting answer indication (e.g. ring tone) DT1 (Alerting) CPG CPG CPG

allocate & setup TCH if GERAN RAB if UTRAN

Alerting

ringing event info (=alerting)

ANM ANM ANM

answer
DT1 (Connect) Connect

DT1 (Connect Ack) Connect Ack

backward call indicators

Traffic

SRB TCH UTRAN

Signalling Radio Bearer Traffic Channel Universal Terrestrial Radio Access Network

GERAN MSRN RAB SDCCH

GSM EDGE Radio Access Network Mobile Station Roaming Number Radio Access Bearer Stand-Alone Dedicated Control Channel

SS7_SF_09_060418

Users I BSS BSS RAN RNS MAP CAP INAP S AP AP+ AP AP TCAP U P SCCP MTP 3 MTP 2 ATM MTP 1 PHY IP L1 + L2 MTP 3b SAAL-NNI M3UA SCTP

`^jbi=~=`^m
R96 R97/R98 R99/Rel-4 Rel-5/Rel-6 Ph 1: basic call rerouting, simple VPN Ph 2: prepaid, DTMF and announcements Ph 3: call handling improvements, GPRS prepaid Ph 4: IMS support, GPRS improvements
gsmSSF gsmSRF

T U P

Example CAP procedures for CS call handling

gsmSCF

CAMEL introduction

trigger

Initial DP B#, service key, IMSI MSISDN, call ref no Req Report BCSM Event armed DPs

service logic execution starts monitor call event(s)

incoming call leg

flexible call handling in G/MSC and SGSN

gsmSSF

CAP orders

service logic and execution in Home PLMN event handling

Apply Charging e.g. for prepaid timer, tone? release? A/B? Continue proceed with suspended call

ISUP
gsmSRF

gsmSCF

reports/acks

outgoing call leg

announcements and tone receivers

Event Report BCSM Event event notification event [, info] Apply Charging Report duration, active/released charging notification

SRF interaction

IN triggering CSI sent in SRI response MT call forwarding of MT call

GMSC

MAP
SRI
HLR

Connect To Resource gsmSRF num Prompt And Collect User Info msg/tone id, # of digits Disconnect Forward Connection Connect called party number Release Call cause
BCSM Basic Call State Model CAMEL Customised Application for Mobile network Enhanced Logic CAP CAMEL Application Part CS Circuit Switched CSE CAMEL Service Environment CSI CAMEL Subscription Information D-CSI Dialled Services CSI DP Detection Point DTMF Dual Tone Multiple Frequency IMS IP Multimedia Subsystem IMSI International Mobile Subscriber Identity IN Intelligent Network INAP Intelligent Network Application Part ISD MAP Insert Subscriber Data LA Location Area

set up SSF-SRF connection inband interaction ask for DTMF digits release SSF-SRF connection route call to specific destination clear down at any phase

MSC

VLR

CAMEL Subscription Info: zero/one/many per IMSI trigger DP or list (O-/T-/VT-/GPRS/SMS-CSI) mobility event or list (M-/MG-CSI) SS code or list (SS-CSI) service key gsmSCF address default call handling dialled num (D-CSI only)

CSI sent in ISD at GPRS loc. update GPRS sessions attach/detach/RA update MO/MT SMS via GPRS

SGSN

call actions

IS D

CSI sent in ISD at location update all/selected MO/forwarded calls MT calls attach/detach/LA update MO/MT SMS SS invoke notifications

D IS

SS7_SF_10_060418

M-CSI MG-CSI MO MT O-CSI PLMN RA SCF SRF SRI SS SS-CSI SSF T-CSI VPN VT-CSI

Mobility Management CSI Mobility Management for GPRS CSI Mobile Originating Mobile Terminating Originating CSI Public Land Mobile Network Routing Area Service Control Function Specialised Resource Function MAP Send Routing Info Supplementary Service Supp. Service Invocation Notification CSI Service Switching Function Terminating CSI Virtual Private Network Visited MSC Terminating CSI

Functional overview as classic MTP level 3, except: max SIF size is 4095 octets (was 272) new SNM procedure: extended changeover "simulation" of signalling link link status control SSCS sequence and error control flow control connection-oriented transmission

jqm==^qj
more than 4 octets MTP 3b SIF SIO

Users

Message handling
T U P I BSS BSS RAN RNS MAP CAP INAP S AP AP+ AP AP TCAP U P SCCP MTP 3 MTP 3b SAAL-NNI M3UA SCTP IP L1 + L2

4 octets SSCF PDU SSCF 4 oct Trailer SSCOP 0..3 Pad 4*n octets 8 oct CPCS Trailer 0..47 Pad 48*m octets 48 octets 48 octets SSCF PDU max 65535 Info max 4096 Info

MTP 2 ATM MTP 1 PHY

SAAL-NNI

Sent in Sequenced Data PDU Trailer: PDU type (= SD here) Pad Length (0..3) N(S) 24-bit send seq num Trailer: CRC for error detection Length of Info User-to-User Info not used CP Indicator by SSCOP SAR PDU uses ATM User-to-User Indication bit: last/not last segment in Payload Type in ATM header

error detection padding to m*48 octets CP AAL 5 n*48 octets sent as n ATM cells no header / trailer added

SAR

SAR PDU

payload for one ATM cell

SSCF & SSCOP procedures Normal link alignment alignment order BGN BGAK link proving: repeat 1000 times max 30 sec alignment successful SD POLL STAT SD POLL STAT (In Service) (Normal) ignored polling every 100 ms other side does the same SD N(S)=1 N(S)=2 N(S)=3 N(S)=4 Error control SD N(S)=6 N(S)=7 N(S)=8 N(S)=9

error detected
ATM CP CPCS CRC NNI N(R) N(S) PDU SAAL SAR SDU SIF SIO SNM SSCF SSCOP Asynchronous Transfer Mode Common Part CP Convergence Sub-layer Cyclic Redundancy Check Network Node Interface Receive sequence Number Send sequence Number Protocol Data Unit Signalling ATM Adaptation Layer Segmentation And Reassembly Service Data Unit Signalling Information Field Service Information Octet Signalling Network Management Service Specific Coordination Function Service Specific Connection Oriented Protocol

POLL N(S)=5 STAT N(R)=3, lost list SD N(S)=3 N(S)=4 N(S)=5 reply to polling

USTAT N(R)=7, lost list SD N(S)=7 N(S)=8 N(S)=10 N(S)=11

SS7_SF_11_060418

ppT==fmI=~=f
Some SS7 over IP interfaces IP-based UTRAN IP-based CS core network non-IP PLMN/PSTN MAP
HLR HLR

Users I BSS BSS RAN RNS MAP CAP INAP S AP AP+ AP AP TCAP U P SCCP MTP 3 MTP 2 ATM MTP 1 PHY IP L1 + L2 MTP 3b SAAL-NNI M3UA SCTP

SCTP functions based on TCP acknowledged, packet-oriented error-free, nonduplicated data transfer data segmentation resistance to blind attacks multi-homing support (primary + backups) SCTP packet
G/MSC

T U P

RANAP
RNC MSC server

MAP ISUP
GMSC server SG VLR

RNSAP ISUP traffic

RNC MGW MGW TE

if DATA

type, length, flags Chunk[s] Header stream id SSN, TSN other fields one or more in packet (chunk bundling)

verification tag src + dest port num checksum

primary Example packet flow IP-based Servers (IPS) Application Servers (AS) if point-to-point if via SG Signalling Points (SP) 0 INIT X INIT ACK Protocol overview standardised for UTRAN and core net
SCCP User User Part MTP 3 M2UA SCTP IP L1+L2 User Part MTP 3 M2PA SCTP IP L1 L2 User Part SUA M3UA SCTP IP L1+L2 SCTP IP L1+L2 SCTP IP L1+L2 TUA TCAP User MAP/ /CAP TCAP SCCP MTP 3 MTP 2 MTP 1

backup start association cookie = encrypted protocol state data

tag X [, backup addrs] tag Y, cookie [, backup addrs] [ DATA ] [ DATA ] TSN, SSN, payload data, DATA DATA

Y COOKIE ECHO cookie X COOKIE ACK Y DATA Y DATA X SACK Y DATA Y DATA Y HEARTBEAT X HEARTBEAT ACK Y DATA

TSN, duplicates, gaps DATA DATA

retransmissions to backup addr too many retrans. use backup also sent to inactive primary restored

SS7 over IP options

classic SS7
AS CS IP IPS M2PA M2UA Application Server Circuit Switched Internet Protocol IP-based Server MTP2 User Peer-to-peer Adaptation MTP2 User Adaptation M3UA MGW SCTP SG SP SSN MTP3 User Adaptation Media Gateway Stream Control Transmission Protocol Signalling Gateway Signalling Point Stream Sequence Number SUA TCP TE TSN TUA SCCP User Adaptation Transmission Control Protocol Transit Exchange Transmission Sequence Number TCAP User Adaptation

SS7_SF_12_060418

Users I BSS BSS RAN RNS MAP CAP INAP S AP AP+ AP AP TCAP U P SCCP MTP 3 MTP 2 ATM MTP 1 PHY IP L1 + L2 MTP 3b SAAL-NNI M3UA SCTP

ppT==fmI=~=ff
Addressing & routing point codes still used (also for IP nodes) Routing Key DPC SI list optional OPC or list CIC range 1:1 Routing Context 32-bit integer SCTP association IP addr(s) Param type length value(s) Param Header version message class & type length M3UA message

T U P

M3UA introduction emulates MTP functions over IP+SCTP supports multi-homing primary + backup(s) load sharing two modes ASSG IPSIPS ASSG (border signalling)
User Part

n:1

one SCTP association one or many RCs dynamic RK registration possible

Example message flows Establishment of association ASPUP ASP id User Part data transfer DATA DATA ASP id DATA SIO, SIF, RC SIO, SIF, RC SIO, SIF, RC if load sharing

MTP3 primitives
M3UA SCTP MTP3 MTP2

ASPUP ACK ASPUP ASPUP ACK REG REQ RKs, RCs

M3UA SCTP

AS

SG

REG RESP RKs, RCs IPSIPS (peer-to-peer signalling) ASPAC

User Part User Part

optional RK registration mode: override loadshare broadcast status: inactive active pending
Application Server Application Server Process Circuit Identity Code Destination Point Code IP-based Server M3UA OPC RC RK SCTP

Network management DUNA RC, DPC RC, DPC RC, DPC RC, DPC remote SP up remote SP down

RCs, mode

DAUD DAUD DAVA

ASPAC ACK RCs, mode NTFY RCs, status RCs, status

MTP3 primitives
M3UA SCTP M3UA SCTP

NTFY

IPS

IPS
AS ASP CIC DPC IPS MTP3 User Adaptation Originating Point Code Routing Context Routing Key Stream Control Transmission Protocol SG SI SIF SIO SP Signalling Gateway Service Indicator Signalling Information Field Service Information Octet Signalling Point

SS7_SF_13_060418

MTP Signalling Network Management

CBA CBD CNP CNS COA COO CSS DLC ECA ECO LFU LIA LID LIN LLT LUA LUN LRT RCT RSM RSR RST TFA TFC TFP TFR TRA UPU Changeback-acknowledgement signal Changeback-declaration signal Connection-not-possible signal Connection-not-successful signal Changeover-acknowledgement signal Changeover-order signal Connection-successful signal Signalling-data-link-connection-order signal Emergency-changeover-acknowledgement signal Emergency-changeover-order signal Link forced uninhibit signal Link inhibit acknowledgement signal Link inhibit denied signal Link inhibit signal Link local inhibit test signal Link uninhibit acknowledgement signal Link uninhibit signal Link remote inhibit test signal Route-set-congestion-test signal Route-set-test message Route-set-test signal for restricted destination Route-set-test signal for prohibited destination Transfer-allowed signal Transfer-controlled signal Transfer-prohibited signal Transfer-restricted signal Traffic-restart-allowed signal User part unavailable signal (national options are in italics) ANSI only TCP TCR TCA RCP RCR TRW Transfer-cluster-prohibited signal Transfer-cluster-restricted signal Transfer-cluster-allowed signal Signalling-route-set-test cluster-prohibited signal Signalling-route-set-test cluster-restricted signal Traffic restart-waiting signal

j~=
ISDN User Part
Common messages ACM ANM BLO BLA CPG CGB CGBA CQM CQR GRS GRA CGU CGUA CFN COT CCR FAC FOT IDR IRS INF INR IAM LPA LOP NRM PAM Address complete Answer Blocking Blocking ack Call progress Circuit group blocking Circuit group blocking ack Circuit group query Circuit group query response Circuit group reset Circuit group reset ack Circuit group unblocking Circuit group unblocking ack Confusion Continuity Continuity check request Facility Forward transfer Identification request Identification response Information Information request Initial address Loop back ack Loop prevention Network resource management Pass-along REL RLC RSC RES SGM SUS UBL UBA UCIC UPA UPT Release Release complete Reset circuit Resume Segmentation Suspend Unblocking Unblocking ack Unequipped CIC User Part available User Part test ITU-T ISUP CON CRG FAA FRJ FAR OLM SAM USR Connect Charge information Facility accepted Facility reject Facility request Overload Subsequent address User-to-user information ANSI ISUP CRM CVR CVT EXM Circuit Reservation Circuit Validation Response Circuit Validation Test Exit ITU-T and ETSI messages for national use only are marked in italics. ANSI ISUP includes all these messages. APM CON CRG FAA FRJ FAR OLM PRI SAM USR Application Transport Connect Charge information Facility accepted Facility reject Facility request Overload Pre-release Information Subsequent address User-to-user information ANSI only, removed from ITU-T CMC CMR CMRJ CSVR CSVS DRS FAD FAI Call Modification Completed Call Modification Request Call Modification Reject CUG Selection & Validation Request CUG Selection & Validation Response Delayed Release Facility Deactivated Facility Info ETSI ISUP

CAMEL Application Part

ActivityTest ActivityTestGPRS (Ph3) ApplyCharging (Ph2) ApplyChargingGPRS (Ph3) ApplyChargingReport (Ph2) ApplyChargingReportGPRS (Ph3) AssistRequestInstructions (Ph2) CallGap (Ph3) CallInformationReport (Ph2) CallInformationRequest (Ph2) Cancel (Ph2) CancelGPRS (Ph3) Connect ConnectSMS (Ph3) ConnectToResource (Ph2) Continue ContinueGPRS (Ph3) ContinueSMS (Ph3) ContinueWithArgument (Ph3) DisconnectForwardConnection (Ph2) DisconnectForwardConnectionWithArgument (Ph4) DisconnectLeg (Ph4) EntityReleased (Ph4) EntityReleasedGPRS (Ph3) EstablishTemporaryConnection (Ph2) EventReportBCSM ReleaseCall ReleaseGPRS (Ph3) ReleaseSMS (Ph3) RequestReportBCSMEvent RequestReportGPRSEvent (Ph3) RequestReportSMSEvent (Ph3) ResetTimer (Ph2) ResetTimerGPRS (Ph3) ResetTimerSMS (Ph3) SendChargingInformation (Ph2) SendChargingInformationGPRS (Ph3) SpecializedResourceReport (Ph2) SplitLeg (Ph4) EventReportGPRS (Ph3) EventReportSMS (Ph3) FurnishChargingInformation (Ph2) FurnishChargingInformationGPRS (Ph3) FurnishChargingInformationSMS (Ph3) InitialDP InitialDPGPRS (Ph3) InitialDPSMS (Ph3) InitiateCallAttempt (Ph4) MoveLeg (Ph4) PlayAnnouncement (Ph2) PlayTone (Ph4) PromptAndCollectUserInformation (Ph2)

The CAMEL phase in which an operation was introduced is given in parenthesis.

Mobile Application Part

activateSS activateTraceMode alertServiceCentre anyTimeInterrogaton (R1996) anyTimeModification (R1999) anyTimeSubscriptionInterrogation (R1999) authenticationFailureReport (R1999) beginSubscriberActivity (Ph1 only) cancelLocation checkIMEI deactivateSS deactivateTraceMode deleteSubscriberData deregisterMobileSubscriber (Ph1 only) eraseCC-Entry (R1997) eraseSS failureReport (R1997) forwardAccessSignalling forwardCheckSsIndication (Ph2) forwardGroupCallSignalling (R1997) forwardSM (Ph1 Ph2 only) getPassword (Ph2) informServiceCentre (Ph2) insertSubscriberData interrogateSS istAlert (R1999) istCommand (R1999) mo-forwardSM (R1996) mt-forwardSM (R1996) noteInternalHandover (Ph1 only) NoteMM-Event (R1999) noteMsPresent (Ph1 only) noteMsPresentForGprs (R1997) noteSubscriberDataModified (R1999) performHandover (Ph1 only) performSubsequentHandover (Ph1 only) prepareGroupCall (R1997) prepareHandover (Ph2) prepareSubsequentHandover (Ph2) processAccessSignalling processGroupCallSignalling (R1997) processUnstructuredSS-Request (Ph2) processUnstructuredSSData (Ph1 only) provideRoamingNumber provideSIWFSNumber (R1997) provideSubscriberInfo (R1996) provideSubscriberLocation (R1998) purgeMS (Ph2) readyForSM (Ph2) registerCC-Entry (R1997) registerPassword (Ph2) registerSS remoteUserFree (R1997) reportSmDeliveryStatus (Ph2) reset restoreData (Ph2) secureTransportClass1 (Rel4) secureTransportClass2 (Rel4) secureTransportClass3 (Rel4) secureTransportClass4 (Rel4) sendAuthenticationInfo (Ph2) sendEndSignal sendGroupCallEndSignal (R1997) sendIdentification (Ph2) sendIMSI (Ph2) sendParameters (Ph1 only) sendRoutingInfo sendRoutingInfoForGprs (R1997) sendRoutingInfoForLCS (R1998) sendRoutingInfoForSM setMessageWaitingData (Ph1 only) setReportingState (R1997) SIWFSSignallingModify (R1997) ss-Invocation-Notification (R1997) statusReport (R1997) subscriberLocationReport (R1998) unstructuredSS-Notify (Ph2) unstructuredSS-Request (Ph2) updateGprsLocation (R1997) updateLocation

M3UA MTP Signalling Network Testing

SLTM SLTA Signalling Link Test Message Signalling Link Test Acknowledgement message

SSCOP
BGN BGAK BGREJ END ENDAK RS RSAK ER ERAK Begin SD Begin Ack POLL Begin Reject STAT End USTAT End Ack UD Resynchronise MD Resynch Ack Error Recovery Error Recovery Ack Sequenced Data Status Request Solicited Status Response Unsolicited Status Response Unnumbered Data Management Data PDUs not required by SSCF are marked in italics.

SCCP
CR CC CREF RLSD RLC DT1 DT2 AK UDT UDTS ED EA RSR RSC ERR IT XUDT XUDTS LUDT LUDTS --xx --xx --xx --xx --xx --x---x ---x xx-xx----x ---x ---x ---x --xx --xx xx-xx-xx-xx-Connection Request Connection Confirm Connection Refused Released Release Complete Data form 1 Data form 2 Data Acknowledgement Unitdata Unitdata Service Expedited Data Expedited Data Ack Reset Request Reset Confirm PDU Error Inactivity Test Extended Unitdata Extended Unitdata Service Long Unitdata Long Unitdata Service

ASPAC ASPAC ACK ASPDN ASPDN ACK ASPIA ASPIA ACK ASPUP ASPUP ACK BEAT BEAT ACK DATA DAUD

ASP Active ASP Active Ack ASP Down ASP Down Ack ASP Inactive ASP Inactive Ack ASP Up ASP Up Ack Heartbeat Heartbeat Ack Payload Data Destination State Audit

DAVA DEREG REQ DEREG RSP DRST DUNA DUPU ERR NTFY REG REQ REG RSP SCON

Destination Available Deregistration Request Deregistration Response Destination Restricted Destination Unavailable Destination UP Unavailable Error Notify Registration Request Registration Response Signalling Congestion

Unused messages shown in italics.

SSCF
OS PO IS NM EM ANS MI PE PNS Out of Service Processor Outage In Service Normal Emergency Alignment Not Successful Management Initiated Protocol Error Proving Not Successful

TCAP
Messages (ITU-T) Unidirectional Begin Continue End Abort Messages (ANSI) Unidirectional Query with Permission Query without Permission Response Conversation with Permission Conversation without Permission Abort Components Invoke (ITU-T) Invoke Last (ANSI) Invoke Not Last (ANSI) Return Result Last Return Result Not Last Return Error Reject

SCTP
ABORT Abort COOKIE ACK Cookie Acknowledgement COOKIE ECHO State Cookie CWR Congestion Window Reduced DATA Payload Data ECNE Explicit Congestion Notification Echo ERROR Operation Error HEARTBEAT Heartbeat Request HEARTBEAT ACK Heartbeat Acknowledgement INIT Initiation INIT ACK Initiation Acknowledgement SACK Selective Acknowledgement SHUTDOWN Shutdown SHUTDOWN ACK Shutdown Acknowledgement SHUTDOWN COMPLETE Shutdown Complete Unused, reserved messages are in italics.

SCCP Management
SSA SSP SST SOR SOG SSC Subsystem Allowed Subsystem Prohibited Subsystem Status Test Subsystem Out-of-service Request Subsystem Out-of-service Grant SCCP / Subsystem Congested

Dialogue PDUs (ITU-T only) AARQ AARE ABRT RLRQ RLRE AUDT Dialogue Request Dialogue Response Dialogue Abort Release Request Release Response Uni-Dialogue

Second column indicates protocol class(es) (0,1,2,3) where given message may be used Messages in italics used only over MTP-3b

SS7_SF_14_060418

PDUs in italics are not used and included for completeness only (aligned with X.227).

The GSM/3GPP phase/release in which an operation was introduced is given in parenthesis. 3G specific operations are shown in italics.