SS7 Tutorial: Understanding Signaling System No. 7

This tutorial covers the basics of SS7 (Signaling System No. 7) as defined in CCITT. We’ll delve into SS7 terminology, the SS7 network architecture, the SS7 protocol stack, SS7 frame structure, and SS7 signal units.

SS7 Terminology

Let’s start with some key SS7 terms:

• Trunk: An interexchange connection. Think of it as a highway connecting different telephone exchanges.
• SSP (Signal Switching Point): An SS7-capable telephone exchange that can originate, switch, and terminate calls. It’s like a regular phone exchange, but with added SS7 capabilities.
• STP (Signal Transfer Point): Packet switches within the SS7 network. STPs perform routing functions, allowing exchanges to send and receive signaling information from each other. They’re the routers of the SS7 world.
• SCP (Signal Control Point): Databases that support advanced call processing functions. They’re used in services like freephone (toll-free) numbers where the called party is charged for the call.
• Tandem (Trunk Automatic Exchange): Connects two exchanges that might not have a direct trunk between them. A sort of intermediary exchange.

SS7 Network Overview

Here’s a visual representation of a typical SS7 network:

As illustrated, a typical SS7 network comprises COs (Central Offices), STPs, SCPs, and tandems. These elements are interconnected via signaling links, subscriber links, and trunks. CO functions are similar to SSP.

• CO (Central Office): Has subscriber lines to connect subscribers, trunk lines to connect to other exchanges, and signaling lines to connect to STPs.
• Tandem Exchange: Lacks subscriber lines and only has traffic trunk lines and signaling trunk lines.

How it Works: An Example

Let’s walk through a call setup example:

1. A subscriber connected to Exchange 1 dials the number 1-600-111-123. This is a virtual number.
2. Exchange 1 recognizes the dialed digits and decides to query the SCP.
3. The SCP (Signal Control Point) contains the mapping information for the 1-600 number.
4. The SCP sends a response (via STPs) to Exchange 1, instructing it to establish a call to 422-4444, which is the actual number the 1-600 number points to.

The main task of carrying traffic can be divided into four phases: idle, connection setup, transfer, and release. For a successful connection setup, the network requires the following:

• Detection of an off-hook signal from the calling party.
• Sending a dial tone to the calling subscriber, indicating the line is ready.
• Receiving the dialed digits from the calling subscriber.

SS7 Protocol Stack

The SS7 protocol stack is structured in layers, similar to the OSI model:

• Physical Layer (Layer 1): Utilizes time slot no. 16 in PCM-30 (2.048 Mbps) and time slot no. 24 in PCM-24 (1.544 Mbps). Deals with the physical transmission of data.
• Data Link Layer (Layer 2): Handles error control, flow control, link initialization, and more. Ensures reliable data transfer between two points.
• Signaling Network Layer (Layer 3): Each node at this layer has a 14-bit address called a signal point code. Each message contains source and destination codes for routing.

Layers 1-3 collectively form the MTP (Message Transfer Part).

• Layer 4 (User Part): MTP supports various user parts, including TUP (Telephone User Part), DUP (Data User Part), and ISDN-UP (ISDN User Part).
• SCCP (Signaling Connection Control Part): Added to Layer 3 to align with Layer 4 of the OSI protocol stack, providing connection-oriented services.
• ISP (Intermediate Service Part): Functions similarly to OSI layers 4-6.
• TCAP (Transaction Capabilities Application Part): Functions similarly to OSI Layer 7, enabling application-level interactions.

SS7 Frame Structure - HDLC Layer 2

SS7 uses a modified HDLC (High-Level Data Link Control) frame format at Layer 2:

• Beginning Flag: 1 octet (8 bits) long, unique pattern 01111110, marks the start of the frame and used for synchronization. Bit stuffing/unstuffing prevents misinterpretation of data with the same pattern.
• Address: 1 or 2 octets long, identifies the source or destination of the frame.
• Control: 1 octet long, contains control information about the frame (e.g., sequence numbers).
• Information: Variable length, carries the actual payload data.
• Check (FCS - Frame Check Sequence): 2 octets long, used for error detection. If an error is detected, a re-transmission can be requested.
• End Flag: 1 octet long, unique pattern 01111110, marks the end of the frame.

SS7 Signal Units

Information transmitted by Layer 2 is formatted as a Signal Unit (SU). SUs follow the HDLC frame format. There are three SU types:

• MSU (Message Signal Unit): Transfers information provided by the User Part (UP) via the signaling network layer (Layer 3). Carries actual call signaling information.
• LSSU (Link Status Signal Unit): Used for link initialization and flow control. Manages the status and operation of the signaling link.
• FISU (Fill-in Signal Unit): Used for link alignment maintenance when no signal traffic is being transmitted. Keeps the link active during idle periods.